From be64a715ae5aeac17666c7950a334164b49cd0a4 Mon Sep 17 00:00:00 2001
From: erjosito <9462396+erjosito@users.noreply.github.com>
Date: Mon, 21 Oct 2024 21:41:59 +0000
Subject: [PATCH] [create-pull-request] automated change
---
.../appservicewebapps_sg_checklist.en.json | 2 +-
.../appservicewebapps_sg_checklist.es.json | 44 +-
.../appservicewebapps_sg_checklist.ja.json | 18 +-
.../appservicewebapps_sg_checklist.ko.json | 40 +-
.../appservicewebapps_sg_checklist.pt.json | 18 +-
...ppservicewebapps_sg_checklist.zh-Hant.json | 18 +-
...ureapplicationgateway_sg_checklist.en.json | 2 +-
...ureapplicationgateway_sg_checklist.es.json | 214 +-
...ureapplicationgateway_sg_checklist.ja.json | 214 +-
...ureapplicationgateway_sg_checklist.ko.json | 214 +-
...ureapplicationgateway_sg_checklist.pt.json | 214 +-
...plicationgateway_sg_checklist.zh-Hant.json | 214 +-
.../azureblobstorage_sg_checklist.en.json | 2 +-
.../azureblobstorage_sg_checklist.es.json | 46 +-
.../azureblobstorage_sg_checklist.ja.json | 18 +-
.../azureblobstorage_sg_checklist.ko.json | 48 +-
.../azureblobstorage_sg_checklist.pt.json | 18 +-
...azureblobstorage_sg_checklist.zh-Hant.json | 18 +-
.../azureexpressroute_sg_checklist.en.json | 2 +-
.../azureexpressroute_sg_checklist.es.json | 54 +-
.../azureexpressroute_sg_checklist.ja.json | 18 +-
.../azureexpressroute_sg_checklist.ko.json | 54 +-
.../azureexpressroute_sg_checklist.pt.json | 18 +-
...zureexpressroute_sg_checklist.zh-Hant.json | 18 +-
.../azurefiles_sg_checklist.en.json | 2 +-
.../azurefiles_sg_checklist.es.json | 60 +-
.../azurefiles_sg_checklist.ja.json | 18 +-
.../azurefiles_sg_checklist.ko.json | 60 +-
.../azurefiles_sg_checklist.pt.json | 18 +-
.../azurefiles_sg_checklist.zh-Hant.json | 18 +-
.../azurefirewall_sg_checklist.en.json | 2 +-
.../azurefirewall_sg_checklist.es.json | 64 +-
.../azurefirewall_sg_checklist.ja.json | 18 +-
.../azurefirewall_sg_checklist.ko.json | 62 +-
.../azurefirewall_sg_checklist.pt.json | 18 +-
.../azurefirewall_sg_checklist.zh-Hant.json | 18 +-
.../azurefrontdoor_sg_checklist.en.json | 2 +-
.../azurefrontdoor_sg_checklist.es.json | 38 +-
.../azurefrontdoor_sg_checklist.ja.json | 18 +-
.../azurefrontdoor_sg_checklist.ko.json | 44 +-
.../azurefrontdoor_sg_checklist.pt.json | 18 +-
.../azurefrontdoor_sg_checklist.zh-Hant.json | 18 +-
...zurekubernetesservice_sg_checklist.en.json | 2 +-
...zurekubernetesservice_sg_checklist.es.json | 72 +-
...zurekubernetesservice_sg_checklist.ja.json | 18 +-
...zurekubernetesservice_sg_checklist.ko.json | 62 +-
...zurekubernetesservice_sg_checklist.pt.json | 18 +-
...ubernetesservice_sg_checklist.zh-Hant.json | 18 +-
.../azuremachinelearning_sg_checklist.en.json | 2 +-
.../azuremachinelearning_sg_checklist.es.json | 70 +-
.../azuremachinelearning_sg_checklist.ja.json | 18 +-
.../azuremachinelearning_sg_checklist.ko.json | 64 +-
.../azuremachinelearning_sg_checklist.pt.json | 18 +-
...emachinelearning_sg_checklist.zh-Hant.json | 18 +-
.../azureopenai_sg_checklist.en.json | 2 +-
.../azureopenai_sg_checklist.es.json | 38 +-
.../azureopenai_sg_checklist.ja.json | 18 +-
.../azureopenai_sg_checklist.ko.json | 32 +-
.../azureopenai_sg_checklist.pt.json | 18 +-
.../azureopenai_sg_checklist.zh-Hant.json | 18 +-
checklists-ext/fullwaf_checklist.en.json | 16338 +++--
.../virtualmachines_sg_checklist.en.json | 2 +-
.../virtualmachines_sg_checklist.es.json | 76 +-
.../virtualmachines_sg_checklist.ja.json | 18 +-
.../virtualmachines_sg_checklist.ko.json | 54 +-
.../virtualmachines_sg_checklist.pt.json | 18 +-
.../virtualmachines_sg_checklist.zh-Hant.json | 18 +-
checklists-ext/wafsg_checklist.en.json | 2 +-
checklists-ext/wafsg_checklist.es.json | 1070 +-
checklists-ext/wafsg_checklist.ja.json | 382 +-
checklists-ext/wafsg_checklist.ko.json | 954 +-
checklists-ext/wafsg_checklist.pt.json | 384 +-
checklists-ext/wafsg_checklist.zh-Hant.json | 402 +-
checklists/checklist.en.master.json | 60913 ++++++++--------
checklists/waf_checklist.en.json | 16630 +++--
checklists/waf_checklist.es.json | 10318 +--
checklists/waf_checklist.ja.json | 14500 ++--
checklists/waf_checklist.ko.json | 13128 ++--
checklists/waf_checklist.pt.json | 12646 ++--
checklists/waf_checklist.zh-Hant.json | 13398 ++--
.../appservicewebapps_sg_checklist.en.xlsx | Bin 24005 -> 24006 bytes
.../appservicewebapps_sg_checklist.es.xlsx | Bin 24473 -> 24562 bytes
.../appservicewebapps_sg_checklist.ja.xlsx | Bin 25981 -> 25981 bytes
.../appservicewebapps_sg_checklist.ko.xlsx | Bin 25447 -> 25439 bytes
.../appservicewebapps_sg_checklist.pt.xlsx | Bin 24515 -> 24516 bytes
...ppservicewebapps_sg_checklist.zh-Hant.xlsx | Bin 24991 -> 24992 bytes
...ureapplicationgateway_sg_checklist.en.xlsx | Bin 25780 -> 22791 bytes
...ureapplicationgateway_sg_checklist.es.xlsx | Bin 26309 -> 23215 bytes
...ureapplicationgateway_sg_checklist.ja.xlsx | Bin 27841 -> 24230 bytes
...ureapplicationgateway_sg_checklist.ko.xlsx | Bin 27316 -> 23749 bytes
...ureapplicationgateway_sg_checklist.pt.xlsx | Bin 26480 -> 23208 bytes
...plicationgateway_sg_checklist.zh-Hant.xlsx | Bin 26874 -> 23572 bytes
.../azureblobstorage_sg_checklist.en.xlsx | Bin 24409 -> 24409 bytes
.../azureblobstorage_sg_checklist.es.xlsx | Bin 24906 -> 24890 bytes
.../azureblobstorage_sg_checklist.ja.xlsx | Bin 26220 -> 26221 bytes
.../azureblobstorage_sg_checklist.ko.xlsx | Bin 25554 -> 25545 bytes
.../azureblobstorage_sg_checklist.pt.xlsx | Bin 24811 -> 24812 bytes
...azureblobstorage_sg_checklist.zh-Hant.xlsx | Bin 25245 -> 25246 bytes
.../azureexpressroute_sg_checklist.en.xlsx | Bin 22852 -> 22852 bytes
.../azureexpressroute_sg_checklist.es.xlsx | Bin 23246 -> 23232 bytes
.../azureexpressroute_sg_checklist.ja.xlsx | Bin 24221 -> 24222 bytes
.../azureexpressroute_sg_checklist.ko.xlsx | Bin 23887 -> 23899 bytes
.../azureexpressroute_sg_checklist.pt.xlsx | Bin 23281 -> 23282 bytes
...zureexpressroute_sg_checklist.zh-Hant.xlsx | Bin 23580 -> 23581 bytes
.../macrofree/azurefiles_sg_checklist.en.xlsx | Bin 25745 -> 25745 bytes
.../macrofree/azurefiles_sg_checklist.es.xlsx | Bin 26440 -> 26415 bytes
.../macrofree/azurefiles_sg_checklist.ja.xlsx | Bin 28175 -> 28175 bytes
.../macrofree/azurefiles_sg_checklist.ko.xlsx | Bin 27294 -> 27251 bytes
.../macrofree/azurefiles_sg_checklist.pt.xlsx | Bin 26436 -> 26436 bytes
.../azurefiles_sg_checklist.zh-Hant.xlsx | Bin 26993 -> 26994 bytes
.../azurefirewall_sg_checklist.en.xlsx | Bin 25738 -> 25738 bytes
.../azurefirewall_sg_checklist.es.xlsx | Bin 26346 -> 26349 bytes
.../azurefirewall_sg_checklist.ja.xlsx | Bin 28256 -> 28256 bytes
.../azurefirewall_sg_checklist.ko.xlsx | Bin 27163 -> 27430 bytes
.../azurefirewall_sg_checklist.pt.xlsx | Bin 26320 -> 26320 bytes
.../azurefirewall_sg_checklist.zh-Hant.xlsx | Bin 26910 -> 26911 bytes
.../azurefrontdoor_sg_checklist.en.xlsx | Bin 23499 -> 23499 bytes
.../azurefrontdoor_sg_checklist.es.xlsx | Bin 23967 -> 23972 bytes
.../azurefrontdoor_sg_checklist.ja.xlsx | Bin 25228 -> 25229 bytes
.../azurefrontdoor_sg_checklist.ko.xlsx | Bin 24707 -> 24694 bytes
.../azurefrontdoor_sg_checklist.pt.xlsx | Bin 23992 -> 23992 bytes
.../azurefrontdoor_sg_checklist.zh-Hant.xlsx | Bin 24251 -> 24251 bytes
...zurekubernetesservice_sg_checklist.en.xlsx | Bin 26172 -> 26173 bytes
...zurekubernetesservice_sg_checklist.es.xlsx | Bin 26752 -> 26762 bytes
...zurekubernetesservice_sg_checklist.ja.xlsx | Bin 28773 -> 28774 bytes
...zurekubernetesservice_sg_checklist.ko.xlsx | Bin 28097 -> 28115 bytes
...zurekubernetesservice_sg_checklist.pt.xlsx | Bin 26729 -> 26730 bytes
...ubernetesservice_sg_checklist.zh-Hant.xlsx | Bin 27354 -> 27355 bytes
.../azuremachinelearning_sg_checklist.en.xlsx | Bin 26178 -> 26179 bytes
.../azuremachinelearning_sg_checklist.es.xlsx | Bin 27051 -> 27034 bytes
.../azuremachinelearning_sg_checklist.ja.xlsx | Bin 28810 -> 28810 bytes
.../azuremachinelearning_sg_checklist.ko.xlsx | Bin 27985 -> 27974 bytes
.../azuremachinelearning_sg_checklist.pt.xlsx | Bin 27028 -> 27028 bytes
...emachinelearning_sg_checklist.zh-Hant.xlsx | Bin 27434 -> 27434 bytes
.../azureopenai_sg_checklist.en.xlsx | Bin 21345 -> 21346 bytes
.../azureopenai_sg_checklist.es.xlsx | Bin 21667 -> 21672 bytes
.../azureopenai_sg_checklist.ja.xlsx | Bin 22520 -> 22521 bytes
.../azureopenai_sg_checklist.ko.xlsx | Bin 22108 -> 22114 bytes
.../azureopenai_sg_checklist.pt.xlsx | Bin 21656 -> 21657 bytes
.../azureopenai_sg_checklist.zh-Hant.xlsx | Bin 21928 -> 21928 bytes
.../macrofree/checklist.en.master.xlsx | Bin 549528 -> 558538 bytes
.../virtualmachines_sg_checklist.en.xlsx | Bin 24987 -> 24987 bytes
.../virtualmachines_sg_checklist.es.xlsx | Bin 25609 -> 25620 bytes
.../virtualmachines_sg_checklist.ja.xlsx | Bin 27057 -> 27058 bytes
.../virtualmachines_sg_checklist.ko.xlsx | Bin 26259 -> 26276 bytes
.../virtualmachines_sg_checklist.pt.xlsx | Bin 25509 -> 25510 bytes
.../virtualmachines_sg_checklist.zh-Hant.xlsx | Bin 25805 -> 25806 bytes
spreadsheet/macrofree/waf_checklist.en.xlsx | Bin 220553 -> 230969 bytes
spreadsheet/macrofree/waf_checklist.es.xlsx | Bin 209997 -> 209489 bytes
spreadsheet/macrofree/waf_checklist.ja.xlsx | Bin 229844 -> 229304 bytes
spreadsheet/macrofree/waf_checklist.ko.xlsx | Bin 223143 -> 222353 bytes
spreadsheet/macrofree/waf_checklist.pt.xlsx | Bin 210748 -> 210217 bytes
.../macrofree/waf_checklist.zh-Hant.xlsx | Bin 216290 -> 215581 bytes
spreadsheet/macrofree/wafsg_checklist.en.xlsx | Bin 116423 -> 116019 bytes
spreadsheet/macrofree/wafsg_checklist.es.xlsx | Bin 123780 -> 123724 bytes
spreadsheet/macrofree/wafsg_checklist.ja.xlsx | Bin 149938 -> 149468 bytes
spreadsheet/macrofree/wafsg_checklist.ko.xlsx | Bin 139080 -> 138668 bytes
spreadsheet/macrofree/wafsg_checklist.pt.xlsx | Bin 124291 -> 123723 bytes
.../macrofree/wafsg_checklist.zh-Hant.xlsx | Bin 130472 -> 130380 bytes
.../alz_checklist.en_network_counters.json | 598 +-
...hecklist.en_network_counters_template.json | 2 +-
.../alz_checklist.en_network_tabcounters.json | 2034 +-
...klist.en_network_tabcounters_template.json | 2 +-
.../alz_checklist.en_network_workbook.json | 604 +-
...hecklist.en_network_workbook_template.json | 2 +-
...hecklist.en_network_counters_workbook.json | 102 +-
...en_network_counters_workbook_template.json | 2 +-
...elivery_checklist.en_network_workbook.json | 66 +-
...hecklist.en_network_workbook_template.json | 2 +-
169 files changed, 84138 insertions(+), 83055 deletions(-)
diff --git a/checklists-ext/appservicewebapps_sg_checklist.en.json b/checklists-ext/appservicewebapps_sg_checklist.en.json
index 8e5c28a6b..368505d90 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.en.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.en.json
@@ -253,6 +253,6 @@
"name": "App Service Web Apps Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/appservicewebapps_sg_checklist.es.json b/checklists-ext/appservicewebapps_sg_checklist.es.json
index 351510460..ef9a0c56a 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.es.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.es.json
@@ -6,12 +6,12 @@
"description": "Un plan premium de App Service ofrece características de escalado avanzadas y garantiza la redundancia si se producen errores.",
"guid": "ad95f4ca-bd35-4ac7-a993-733c320fa4c4",
"service": "App Service Web Apps",
- "text": "(Plan de App Service) Elija el nivel Premium de un plan de App Service para cargas de trabajo de producción. Establezca el número máximo y mínimo de trabajadores de acuerdo con su planificación de capacidad. Para obtener más información, consulte Introducción al plan de App Service.",
+ "text": "(Plan de App Service) Elija el nivel Premium de un plan de App Service para las cargas de trabajo de producción. Establezca el número máximo y mínimo de trabajadores de acuerdo con su planificación de capacidad. Para obtener más información, consulte Información general sobre el plan de App Service.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "La aplicación puede soportar errores en una sola zona cuando varias instancias se distribuyen entre zonas. El tráfico cambia automáticamente a instancias en buen estado en otras zonas y mantiene la confiabilidad de la aplicación si una zona no está disponible.",
+ "description": "La aplicación puede resistir errores en una sola zona cuando hay varias instancias distribuidas entre zonas. El tráfico cambia automáticamente a instancias en buen estado en otras zonas y mantiene la confiabilidad de la aplicación si una zona no está disponible.",
"guid": "8a18771a-8a59-47de-905e-6e6b72f36990",
"service": "App Service Web Apps",
"text": "(Plan de App Service) Habilite la redundancia de zona. Considere la posibilidad de aprovisionar más de tres instancias para mejorar la tolerancia a errores. Compruebe la compatibilidad regional con la redundancia de zona, ya que no todas las regiones ofrecen esta característica.",
@@ -19,7 +19,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Las solicitudes entrantes se distribuyen uniformemente entre todos los nodos disponibles cuando se deshabilita la afinidad ARR. Las solicitudes distribuidas uniformemente evitan que el tráfico abrume a un solo nodo. Las solicitudes se pueden redirigir sin problemas a otros nodos en buen estado si un nodo no está disponible. Evite la afinidad de sesión para asegurarse de que la instancia de App Service permanezca sin estado. Un servicio de aplicaciones sin estado reduce la complejidad y garantiza un comportamiento coherente en todos los nodos. Quite las sesiones permanentes para que App Service pueda agregar o quitar instancias para escalar horizontalmente.",
+ "description": "Las solicitudes entrantes se distribuyen uniformemente entre todos los nodos disponibles cuando se deshabilita la afinidad de ARR. Las solicitudes distribuidas uniformemente evitan que el tráfico sature cualquier nodo individual. Las solicitudes se pueden redirigir sin problemas a otros nodos en buen estado si un nodo no está disponible. Evite la afinidad de sesión para asegurarse de que la instancia de App Service permanezca sin estado. Un servicio de aplicaciones sin estado reduce la complejidad y garantiza un comportamiento coherente en todos los nodos. Quite las sesiones permanentes para que App Service pueda agregar o quitar instancias para escalar horizontalmente.",
"guid": "5a05980f-0f3f-42c2-af59-563b037aa64c",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Considere la posibilidad de deshabilitar la característica de afinidad de enrutamiento de solicitudes de aplicación (ARR). La afinidad ARR crea sesiones permanentes que redirigen a los usuarios al nodo que manejó sus solicitudes anteriores.",
@@ -30,12 +30,12 @@
"description": "Las reglas de recuperación automática ayudan a la aplicación a recuperarse automáticamente de problemas inesperados. Las reglas configuradas desencadenan acciones de reparación cuando se superan los umbrales. La reparación automática permite un mantenimiento proactivo automático.",
"guid": "a92ea6eb-79b0-49f8-be2f-9ecbd56ca794",
"service": "App Service Web Apps",
- "text": "(Servicio de aplicaciones) Defina reglas de recuperación automática en función del recuento de solicitudes, las solicitudes lentas, los límites de memoria y otros indicadores que forman parte de la línea base de rendimiento. Considere esta configuración como parte de su estrategia de escalado.",
+ "text": "(Servicio de aplicaciones) Defina reglas de reparación automática en función del recuento de solicitudes, las solicitudes lentas, los límites de memoria y otros indicadores que forman parte de la línea base de rendimiento. Tenga en cuenta esta configuración como parte de su estrategia de escalado.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Las comprobaciones de estado pueden detectar problemas de forma temprana. A continuación, el sistema puede tomar automáticamente medidas correctivas cuando se produce un error en una solicitud de comprobación de estado. El equilibrador de carga enruta el tráfico lejos de las instancias en mal estado, lo que dirige a los usuarios a los nodos en buen estado.",
+ "description": "Las comprobaciones de estado pueden detectar problemas de forma temprana. A continuación, el sistema puede tomar medidas correctivas automáticamente cuando se produce un error en una solicitud de comprobación de estado. El equilibrador de carga enruta el tráfico lejos de las instancias en mal estado, lo que dirige a los usuarios a los nodos en buen estado.",
"guid": "8804a347-b18e-4dce-88b6-9beee13dc12b",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Habilite la característica de comprobación de estado y proporcione una ruta de acceso que responda a las solicitudes de comprobación de estado.",
@@ -59,10 +59,10 @@
"waf": "Seguridad"
},
{
- "description": "Al usar esta característica, no es necesario usar bibliotecas de autenticación en el código de la aplicación, lo que reduce la complejidad. El usuario ya está autenticado cuando una solicitud llega a la aplicación.",
+ "description": "Al usar esta característica, no tiene que usar bibliotecas de autenticación en el código de la aplicación, lo que reduce la complejidad. El usuario ya está autenticado cuando una solicitud llega a la aplicación.",
"guid": "b2b6b6df-7bd0-4394-a6df-86c3a15bcaf7",
"service": "App Service Web Apps",
- "text": "(App Service) evalúe si la autenticación integrada de App Service es el mecanismo adecuado para autenticar a los usuarios que acceden a la aplicación. La autenticación integrada de App Service se integra con el identificador de Microsoft Entra. Esta característica controla la validación de tokens y la administración de identidades de usuario en varios proveedores de inicio de sesión y es compatible con OpenID Connect. Con esta característica, no tiene autorización a nivel granular y no tiene un mecanismo para probar la autenticación.",
+ "text": "(App Service) evalúe si la autenticación integrada de App Service es el mecanismo adecuado para autenticar a los usuarios que acceden a la aplicación. La autenticación integrada de App Service se integra con el identificador de Microsoft Entra. Esta función controla la validación de tokens y la administración de identidades de usuario en varios proveedores de inicio de sesión y es compatible con OpenID Connect. Con esta característica, no tiene autorización a nivel granular y no tiene un mecanismo para probar la autenticación.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -102,7 +102,7 @@
"description": "El registro captura patrones de acceso. Registra eventos relevantes que proporcionan información valiosa sobre cómo interactúan los usuarios con una aplicación o plataforma. Esta información es crucial para fines de responsabilidad, cumplimiento y seguridad.",
"guid": "a1278dd3-3ed5-43b3-9544-69ccd3694db1",
"service": "App Service Web Apps",
- "text": "(Plan de App Service) Habilite el registro de diagnóstico y agregue instrumentación a su aplicación. Los registros se envían a cuentas de Azure Storage, Azure Event Hubs y Log Analytics. Para obtener más información sobre los tipos de registro de auditoría, consulte Tipos de registro compatibles.",
+ "text": "(Plan de App Service) Habilite el registro de diagnóstico y agregue instrumentación a la aplicación. Los registros se envían a las cuentas de Azure Storage, Azure Event Hubs y Log Analytics. Para obtener más información sobre los tipos de registro de auditoría, consulte Tipos de registro compatibles.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -150,12 +150,12 @@
"description": "Los registros de diagnóstico proporcionan información valiosa sobre el comportamiento de tu app. Supervise los patrones de tráfico e identifique anomalías.",
"guid": "9540f299-ca72-4849-a58a-78153436fc26",
"service": "App Service Web Apps",
- "text": "(Servicio de aplicaciones) Habilite los registros de diagnóstico para la aplicación y la instancia. El registro frecuente puede ralentizar el rendimiento del sistema, aumentar los costos de almacenamiento e introducir riesgos si tiene acceso no seguro a los registros. Siga estas prácticas recomendadas: - Registre el nivel correcto de información. - Establecer políticas de retención. - Mantenga un registro de auditoría de los accesos autorizados y los intentos no autorizados. - Tratar los registros como datos y aplicar controles de protección de datos.",
+ "text": "(Servicio de aplicaciones) Habilite los registros de diagnóstico para la aplicación y la instancia. El registro frecuente puede ralentizar el rendimiento del sistema, aumentar los costos de almacenamiento e introducir riesgos si tiene acceso no seguro a los registros. Siga estas prácticas recomendadas: - Registre el nivel correcto de información. - Establecer políticas de retención. - Mantener un registro de auditoría del acceso autorizado y los intentos no autorizados. - Tratar los registros como datos y aplicar controles de protección de datos.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "App Service controla automáticamente procesos como la adquisición de certificados, la verificación de certificados, la renovación de certificados y la importación de certificados de Key Vault. Como alternativa, cargue el certificado en Key Vault y autorice al proveedor de recursos de App Service a acceder a él.",
+ "description": "App Service controla automáticamente procesos como la adquisición de certificados, la verificación de certificados, la renovación de certificados y la importación de certificados desde Key Vault. Como alternativa, cargue el certificado en Key Vault y autorice al proveedor de recursos de App Service a acceder a él.",
"guid": "4a17086d-c18e-4f8e-95ec-2f2b2ec65d17",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Aproveche los certificados administrados de App Service para descargar la administración de certificaciones en Azure.",
@@ -163,7 +163,7 @@
"waf": "Operaciones"
},
{
- "description": null,
+ "description": "Evite el tiempo de inactividad y los errores. Vuelva rápidamente al último estado bueno conocido si detecta un problema después de un intercambio.",
"guid": "0f0b02b2-941d-45a9-973a-74a01899a16d",
"service": "App Service Web Apps",
"text": "(Plan de App Service) Valide los cambios de la aplicación en la ranura de ensayo antes de intercambiarla por la ranura de producción.",
@@ -174,7 +174,7 @@
"description": "La aplicación nunca se descarga con Always On habilitado.",
"guid": "24d94b35-de37-4c04-9aea-dec880bf216c",
"service": "App Service Web Apps",
- "text": "Habilite la opción AlwaysOn cuando las aplicaciones compartan un único plan de App Service. Las aplicaciones de App Service se descargan automáticamente cuando están inactivas para ahorrar recursos. La siguiente solicitud desencadena un inicio en frío, lo que puede provocar tiempos de espera de solicitud.",
+ "text": "Habilite la opción Siempre activo cuando las aplicaciones compartan un único plan de App Service. Las aplicaciones de App Service se descargan automáticamente cuando están inactivas para ahorrar recursos. La siguiente solicitud desencadena un inicio en frío, lo que puede provocar tiempos de espera de solicitud.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -182,7 +182,7 @@
"description": "Elija HTTP/2 en lugar de HTTP/1.1 porque HTTP/2 multiplexa completamente las conexiones, reutiliza las conexiones para reducir la sobrecarga y comprime los encabezados para minimizar la transferencia de datos.",
"guid": "f5d46d58-7c3f-4917-a4f1-b97aa98a00c4",
"service": "App Service Web Apps",
- "text": "Considere la posibilidad de utilizar HTTP/2 para que las aplicaciones mejoren la eficiencia del protocolo.",
+ "text": "Considere la posibilidad de usar HTTP/2 para que las aplicaciones mejoren la eficiencia del protocolo.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -190,7 +190,7 @@
"metadata": {
"name": "App Service Web Apps Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -217,31 +217,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/appservicewebapps_sg_checklist.ja.json b/checklists-ext/appservicewebapps_sg_checklist.ja.json
index 1925962c4..b7919aff0 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.ja.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.ja.json
@@ -190,7 +190,7 @@
"metadata": {
"name": "App Service Web Apps Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -217,31 +217,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/appservicewebapps_sg_checklist.ko.json b/checklists-ext/appservicewebapps_sg_checklist.ko.json
index a2f25e0dc..136919ac0 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.ko.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.ko.json
@@ -19,7 +19,7 @@
"waf": "신뢰도"
},
{
- "description": "들어오는 요청은 ARR 선호도를 사용하지 않도록 설정할 때 사용 가능한 모든 노드에 균등하게 분산됩니다. 균등하게 분산된 요청은 트래픽이 단일 노드를 압도하는 것을 방지합니다. 노드를 사용할 수 없는 경우 요청을 다른 정상 노드로 원활하게 리디렉션할 수 있습니다. App Service 인스턴스가 상태 비저장으로 유지되도록 세션 선호도를 피합니다. 상태 비저장 App Service는 복잡성을 줄이고 노드 간에 일관된 동작을 보장합니다. App Service가 수평으로 크기를 조정할 인스턴스를 추가하거나 제거할 수 있도록 고정 세션을 제거합니다.",
+ "description": "들어오는 요청은 ARR 선호도를 사용하지 않도록 설정할 때 사용 가능한 모든 노드에 균등하게 분산됩니다. 요청이 균등하게 분산되면 트래픽이 단일 노드에 과부하되는 것을 방지할 수 있습니다. 노드를 사용할 수 없는 경우 요청을 다른 정상 노드로 원활하게 리디렉션할 수 있습니다. App Service 인스턴스가 상태 비저장 상태로 유지되도록 세션 선호도를 방지합니다. 상태 비저장 App Service는 복잡성을 줄이고 노드 간에 일관된 동작을 보장합니다. App Service가 인스턴스를 추가하거나 제거하여 수평으로 확장할 수 있도록 고정 세션을 제거합니다.",
"guid": "5a05980f-0f3f-42c2-af59-563b037aa64c",
"service": "App Service Web Apps",
"text": "(앱 서비스) ARR(애플리케이션 요청 라우팅) 선호도 기능을 사용하지 않도록 설정하는 것이 좋습니다. ARR 선호도는 사용자를 이전 요청을 처리한 노드로 리디렉션하는 고정 세션을 만듭니다.",
@@ -59,7 +59,7 @@
"waf": "안전"
},
{
- "description": "이 기능을 사용하면 애플리케이션 코드에서 인증 라이브러리를 사용할 필요가 없으므로 복잡성이 줄어듭니다. 요청이 애플리케이션에 도달할 때 사용자는 이미 인증된 상태입니다.",
+ "description": "이 기능을 사용하면 애플리케이션 코드에서 인증 라이브러리를 사용할 필요가 없으므로 복잡성이 줄어듭니다. 요청이 애플리케이션에 도달할 때 사용자는 이미 인증되었습니다.",
"guid": "b2b6b6df-7bd0-4394-a6df-86c3a15bcaf7",
"service": "App Service Web Apps",
"text": "(App Service) App Service 기본 제공 인증이 애플리케이션에 액세스하는 사용자를 인증하는 데 적합한 메커니즘인지 여부를 평가합니다. App Service 기본 제공 인증은 Microsoft Entra ID와 통합됩니다. 이 기능은 여러 로그인 공급자에서 토큰 유효성 검사 및 사용자 ID 관리를 처리하고 OpenID Connect를 지원합니다. 이 기능을 사용하면 세분화된 수준의 권한 부여가 없으며 인증을 테스트할 메커니즘이 없습니다.",
@@ -67,7 +67,7 @@
"waf": "안전"
},
{
- "description": "Azure 가상 네트워크 사용의 보안 이점을 누리세요. 예를 들어 응용 프로그램은 네트워크 내의 리소스에 안전하게 액세스할 수 있습니다. 애플리케이션을 보호하는 데 도움이 되는 프라이빗 엔드포인트를 추가합니다. 프라이빗 엔드포인트는 공용 네트워크에 대한 직접 노출을 제한하고 역방향 프록시를 통해 제어된 액세스를 허용합니다.",
+ "description": "Azure 가상 네트워크 사용의 보안 이점을 누리세요. 예를 들어, 애플리케이션은 네트워크 내의 리소스에 안전하게 액세스할 수 있습니다. 애플리케이션을 보호하는 데 도움이 되는 프라이빗 엔드포인트를 추가합니다. 프라이빗 엔드포인트는 공용 네트워크에 대한 직접 노출을 제한하고 역방향 프록시를 통해 제어된 액세스를 허용합니다.",
"guid": "bc1fd50b-a78a-44e6-bbd6-db1c75fa8fdd",
"service": "App Service Web Apps",
"text": "(앱 서비스) 가상 네트워크 통합을 위해 응용 프로그램을 구성합니다. App Service 앱에 프라이빗 엔드포인트를 사용합니다. 모든 공용 트래픽을 차단합니다. 가상 네트워크 통합을 통해 컨테이너 이미지 끌어오기를 라우팅합니다. 애플리케이션에서 나가는 모든 트래픽은 가상 네트워크를 통과합니다.",
@@ -75,7 +75,7 @@
"waf": "안전"
},
{
- "description": "기본 인증은 보안 배포 방법으로 권장되지 않습니다. Microsoft Entra ID는 OAuth 2.0 토큰 기반 인증을 사용하여 기본 인증과 관련된 제한 사항을 해결하는 다양한 이점과 향상된 기능을 제공합니다. 정책은 애플리케이션 리소스에 대한 액세스를 제한하고, 특정 도메인의 요청만 허용하며, 지역 간 요청을 보호합니다.",
+ "description": "기본 인증은 보안 배포 방법으로 권장되지 않습니다. Microsoft Entra ID는 OAuth 2.0 토큰 기반 인증을 사용하여 기본 인증과 관련된 제한 사항을 해결하는 많은 이점과 향상된 기능을 제공합니다. 정책은 애플리케이션 리소스에 대한 액세스를 제한하고, 특정 도메인의 요청만 허용하고, 리전 간 요청을 보호합니다.",
"guid": "aed08f98-d32e-43c4-8879-e2a3640ec82a",
"service": "App Service Web Apps",
"text": "(앱 서비스) 강화를 구현하려면 다음을 수행합니다. - Microsoft Entra ID 기반 인증을 위해 사용자 이름과 암호를 사용하는 기본 인증을 사용하지 않도록 설정합니다. - 인바운드 포트가 열리지 않도록 원격 디버깅을 끕니다. - CORS 정책을 활성화하여 들어오는 요청을 강화합니다. - FTP와 같은 프로토콜을 비활성화합니다.",
@@ -91,7 +91,7 @@
"waf": "안전"
},
{
- "description": "App Service 계획에서 실행되는 리소스에 대한 실시간 보호를 받으세요. 위협으로부터 보호하고 전반적인 보안 태세를 강화합니다.",
+ "description": "App Service 계획에서 실행되는 리소스에 대한 실시간 보호를 가져옵니다. 위협으로부터 보호하고 전반적인 보안 태세를 강화합니다.",
"guid": "4c020315-db82-4fd8-a3da-8f2b80bd5b4f",
"service": "App Service Web Apps",
"text": "(App Service 계획) App Service에 대해 클라우드용 Microsoft Defender를 사용하도록 설정합니다.",
@@ -150,12 +150,12 @@
"description": "진단 로그는 앱의 동작에 대한 중요한 인사이트를 제공합니다. 트래픽 패턴을 모니터링하고 이상 징후를 식별합니다.",
"guid": "9540f299-ca72-4849-a58a-78153436fc26",
"service": "App Service Web Apps",
- "text": "(앱 서비스) 응용 프로그램 및 인스턴스에 대한 진단 로그를 사용하도록 설정합니다. 잦은 로깅은 시스템 성능을 저하시키고, 스토리지 비용을 증가시키며, 로그에 안전하지 않은 액세스 권한이 있는 경우 위험을 초래할 수 있습니다. 다음 모범 사례를 따르십시오. - 적절한 수준의 정보를 기록합니다. - 보존 정책을 설정합니다. - 승인된 액세스 및 승인되지 않은 시도에 대한 감사 추적을 유지합니다. - 로그를 데이터로 처리하고 데이터 보호 제어를 적용합니다.",
+ "text": "(앱 서비스) 응용 프로그램 및 인스턴스에 대한 진단 로그를 사용하도록 설정합니다. 잦은 로깅은 시스템 성능을 저하시키고, 스토리지 비용을 증가시키며, 로그에 안전하지 않은 액세스 권한이 있는 경우 위험을 초래할 수 있습니다. 다음 모범 사례를 따르십시오. - 적절한 수준의 정보를 기록합니다. - 보존 정책을 설정합니다. - 승인된 액세스 및 무단 시도에 대한 감사 추적을 유지합니다. - 로그를 데이터로 처리하고 데이터 보호 제어를 적용합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "App Service는 인증서 조달, 인증서 확인, 인증서 갱신 및 Key Vault에서 인증서 가져오기와 같은 프로세스를 자동으로 처리합니다. 또는 Key Vault에 인증서를 업로드하고 App Service 리소스 공급자에게 액세스할 수 있는 권한을 부여합니다.",
+ "description": "App Service는 인증서 조달, 인증서 확인, 인증서 갱신 및 Key Vault에서 인증서 가져오기와 같은 프로세스를 자동으로 처리합니다. 또는 인증서를 Key Vault에 업로드하고 App Service 리소스 공급자에게 액세스할 수 있는 권한을 부여합니다.",
"guid": "4a17086d-c18e-4f8e-95ec-2f2b2ec65d17",
"service": "App Service Web Apps",
"text": "(앱 서비스) App Service 관리형 인증서를 활용하여 인증 관리를 Azure로 오프로드합니다.",
@@ -163,15 +163,15 @@
"waf": "작업"
},
{
- "description": "다운타임과 오류를 방지합니다. 스왑 후 문제를 감지한 경우 마지막으로 알려진 양호한 상태로 빠르게 되돌립니다.",
+ "description": "다운타임과 오류를 방지합니다. 스왑 후 문제를 감지하면 마지막으로 알려진 양호한 상태로 빠르게 되돌립니다.",
"guid": "0f0b02b2-941d-45a9-973a-74a01899a16d",
"service": "App Service Web Apps",
- "text": "(App Service 계획) 프로덕션 슬롯으로 교체하기 전에 스테이징 슬롯에서 앱 변경 사항의 유효성을 검사합니다.",
+ "text": "(App Service 계획) 프로덕션 슬롯으로 바꾸기 전에 스테이징 슬롯에서 앱 변경 사항의 유효성을 검사합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "응용 프로그램은 Always On이 활성화된 상태에서 언로드되지 않습니다.",
+ "description": "응용 프로그램은 Always On을 사용하도록 설정된 상태로 언로드되지 않습니다.",
"guid": "24d94b35-de37-4c04-9aea-dec880bf216c",
"service": "App Service Web Apps",
"text": "애플리케이션이 단일 App Service 계획을 공유하는 경우 Always On 설정을 사용하도록 설정합니다. App Service 앱은 리소스를 절약하기 위해 유휴 상태일 때 자동으로 언로드됩니다. 다음 요청은 콜드 스타트를 트리거하여 요청 시간 초과를 유발할 수 있습니다.",
@@ -182,7 +182,7 @@
"description": "HTTP/2는 연결을 완전히 다중화하고, 연결을 재사용하여 오버헤드를 줄이고, 헤더를 압축하여 데이터 전송을 최소화하기 때문에 HTTP/1.1보다 HTTP/2를 선택합니다.",
"guid": "f5d46d58-7c3f-4917-a4f1-b97aa98a00c4",
"service": "App Service Web Apps",
- "text": "프로토콜 효율성을 개선하기 위해 애플리케이션에 HTTP/2를 사용하는 것이 좋습니다.",
+ "text": "프로토콜 효율성을 향상시키기 위해 애플리케이션에 HTTP/2를 사용하는 것이 좋습니다.",
"type": "recommendation",
"waf": "공연"
}
@@ -190,7 +190,7 @@
"metadata": {
"name": "App Service Web Apps Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -217,31 +217,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/appservicewebapps_sg_checklist.pt.json b/checklists-ext/appservicewebapps_sg_checklist.pt.json
index f61fc52d4..f287e77f8 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.pt.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.pt.json
@@ -190,7 +190,7 @@
"metadata": {
"name": "App Service Web Apps Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -217,31 +217,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/appservicewebapps_sg_checklist.zh-Hant.json b/checklists-ext/appservicewebapps_sg_checklist.zh-Hant.json
index 1c07b2f30..d3d8dca05 100644
--- a/checklists-ext/appservicewebapps_sg_checklist.zh-Hant.json
+++ b/checklists-ext/appservicewebapps_sg_checklist.zh-Hant.json
@@ -190,7 +190,7 @@
"metadata": {
"name": "App Service Web Apps Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -217,31 +217,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.en.json b/checklists-ext/azureapplicationgateway_sg_checklist.en.json
index f497f846a..99994d098 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.en.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.en.json
@@ -213,6 +213,6 @@
"name": "Azure Application Gateway Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.es.json b/checklists-ext/azureapplicationgateway_sg_checklist.es.json
index 47c8a4d50..b57a58ea8 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.es.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.es.json
@@ -3,234 +3,146 @@
"categories": [],
"items": [
{
- "description": "Planifique el tiempo suficiente para las actualizaciones antes de acceder a Application Gateway o realizar más cambios. Por ejemplo, la eliminación de servidores del grupo de back-end puede llevar algún tiempo porque tienen que purgar las conexiones existentes.",
- "guid": "9a17eb2b-c5e3-428b-9e45-73dead45c4f9",
+ "description": "Cuando se distribuyen varias instancias entre zonas, la carga de trabajo puede soportar errores en una sola zona. Si tiene una zona no disponible, el tráfico se desplaza automáticamente a instancias en buen estado en otras zonas, lo que mantiene la fiabilidad de la aplicación.",
+ "guid": "a36e2517-aa81-4e4b-9962-e78144b18ac7",
"service": "Azure Application Gateway",
- "text": "Planear las actualizaciones de las reglas",
+ "text": "Implemente instancias de Application Gateway en una configuración que tenga en cuenta las zonas. Compruebe la compatibilidad regional con la redundancia de zona, ya que no todas las regiones ofrecen esta característica.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Si Application Gateway se usa para equilibrar la carga del tráfico entrante en varias instancias de back-end, se recomienda el uso de sondeos de estado. Esto garantizará que el tráfico no se enrute a backends que no puedan manejar el tráfico.",
- "guid": "5bfa95df-20d8-4452-a6c1-79c88b07d4cc",
+ "description": "Los sondeos de estado garantizan que el tráfico solo se dirija a los back-end que pueden controlar el tráfico. Application Gateway supervisa el estado de todos los servidores de su grupo de back-end y detiene automáticamente el envío de tráfico a cualquier servidor que considere incorrecto.",
+ "guid": "9afcdcea-4d65-4d51-9008-297c2c363625",
"service": "Azure Application Gateway",
- "text": "Uso de sondeos de estado para detectar la falta de disponibilidad del back-end",
+ "text": "Use sondeos de estado de Application Gateway para detectar la falta de disponibilidad del back-end.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "El sondeo de estado envía solicitudes al punto de conexión configurado en un intervalo establecido. Además, hay un umbral de solicitudes con errores que se tolerarán antes de que el back-end se marque como incorrecto. Estos números presentan una compensación.- Establecer un intervalo más alto pone una mayor carga en su servicio. Cada instancia de Application Gateway envía sus propios sondeos de estado, por lo que 100 instancias cada 30 segundos significa 100 solicitudes cada 30 segundos.- Establecer un intervalo inferior deja más tiempo antes de que se detecte una interrupción.- Establecer un umbral incorrecto bajo podría significar que errores breves y transitorios podrían derribar un back-end. - Al establecer un umbral alto, puede llevar más tiempo sacar un backend de la rotación.",
- "guid": "ec5bc6c4-6176-44a2-860e-8654f588effd",
+ "description": "Use la limitación de velocidad para evitar problemas como tormentas de reintentos.",
+ "guid": "7bcec0ab-ea83-427d-ae8c-946bf662ece6",
"service": "Azure Application Gateway",
- "text": "Revisión del impacto de la configuración de intervalo y umbral en los sondeos de estado",
+ "text": "Configure reglas de limitación de velocidad para Azure WAF de modo que los clientes no puedan enviar demasiado tráfico a la aplicación.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Supongamos que cada backend tiene sus propias dependencias para garantizar que se aíslen los errores. Por ejemplo, una aplicación hospedada detrás de Application Gateway puede tener varios back-ends, cada uno conectado a una base de datos diferente (réplica). Cuando se produce un error en una dependencia de este tipo, es posible que la aplicación esté funcionando, pero no devolverá resultados válidos. Por ese motivo, lo ideal es que el punto de conexión de mantenimiento valide todas las dependencias. Tenga en cuenta que si cada llamada al punto de conexión de estado tiene una llamada de dependencia directa, esa base de datos recibiría 100 consultas cada 30 segundos en lugar de 1. Para evitar esto, el punto de conexión de mantenimiento debe almacenar en caché el estado de las dependencias durante un breve período de tiempo.",
- "guid": "78bc5274-ca88-4e2a-8d3a-7b6a5ed1ccd6",
+ "description": "Las unidades definidas por el usuario de la subred de Application Gateway pueden causar algunos problemas. No use UDR en la subred de Application Gateway para poder ver el estado del back-end, los registros y las métricas.",
+ "guid": "b2881b32-11c9-4bec-94d0-255ec577fdab",
"service": "Azure Application Gateway",
- "text": "Comprobación de las dependencias de nivel inferior a través de puntos de conexión de estado",
+ "text": "No use UDR en Application Gateway para que el informe de estado de back-end funcione correctamente y genere los registros y las métricas correctos. Si debe usar una UDR en la subred de Application Gateway, consulte UDR admitidas.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Determinados escenarios pueden obligarle a implementar reglas específicamente en Application Gateway. Por ejemplo, si se requieren reglas ModSec CRS 2.2.9, CRS 3.0 o CRS 3.1, estas reglas solo se pueden implementar en Application Gateway. Por el contrario, la limitación de velocidad y el filtrado geográfico solo están disponibles en Azure Front Door, no en AppGateway.",
- "guid": "da7234f3-70a7-47d2-b685-3e47843003e9",
+ "description": "Establezca IdleTimeout para que coincida con el back-end. Esta configuración garantiza que la conexión entre Application Gateway y el cliente permanezca abierta si el back-end tarda más de cuatro minutos en responder a la solicitud. Si no configura esta opción, la conexión se cierra y el cliente no ve la respuesta de back-end.",
+ "guid": "0719fb38-2436-415b-8db7-3d19a1e57bee",
"service": "Azure Application Gateway",
- "text": "Al usar Azure Front Door y Application Gateway para proteger aplicaciones \"HTTP/S\", use directivas de WAF en Front Door y bloquee Application Gateway para recibir tráfico solo de Azure Front Door.",
+ "text": "Configure las opciones de IdleTimeout para que coincidan con las características del agente de escucha y el tráfico de la aplicación back-end. El valor predeterminado es cuatro minutos. Puede configurarlo hasta un máximo de 30 minutos. Para obtener más información, consulte Restablecimiento del protocolo de control de transmisión (TCP) del equilibrador de carga y tiempo de espera de inactividad.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Configure una política de TLS para mayor seguridad. Asegúrese de usar siempre la última versión de la política TLS disponible. Esto aplica TLS 1.2 y cifrados más seguros.",
- "guid": "9e5ba3b9-3512-425b-95e3-d5009e7630f3",
+ "description": "Utilice la política de TLS más reciente para exigir el uso de TLS 1.2 y cifrados más seguros. La política TLS incluye el control de la versión del protocolo TLS y los conjuntos de cifrado, así como el orden en el que un protocolo de enlace TLS utiliza cifrados.",
+ "guid": "8e0ffc7d-aecb-456f-8a8a-6cbd5743e076",
"service": "Azure Application Gateway",
- "text": "Configuración de una política de TLS para mejorar la seguridad",
+ "text": "Configure una política TLS para mejorar la seguridad. Asegúrese de utilizar la versión más reciente de la política TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Hay ventajas de usar Application Gateway para la terminación de TLS:- El rendimiento mejora porque las solicitudes que van a diferentes backends tienen que volver a autenticarse en cada backend.- Mejor utilización de los servidores de back-end porque no tienen que realizar el procesamiento de TLS.- Enrutamiento inteligente mediante el acceso al contenido de la solicitud.- Administración de certificados más fácil porque el certificado solo necesita instalarse en Application Gateway.",
- "guid": "5cbd84eb-56a7-4d18-9f50-de47d3b29a8f",
+ "description": "El rendimiento mejora porque las solicitudes que van a diferentes back-end no tienen que volver a autenticarse en cada back-end. La puerta de enlace puede acceder al contenido de la solicitud y tomar decisiones de enrutamiento inteligentes. Solo tiene que instalar el certificado en Application Gateway, lo que simplifica la administración de certificados.",
+ "guid": "0534341b-03de-4eb4-9fbb-47806be1958d",
"service": "Azure Application Gateway",
- "text": "Uso de AppGateway para la terminación de TLS",
+ "text": "Use Application Gateway para la terminación de TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Application Gateway se puede integrar con Key Vault. Esto proporciona una mayor seguridad, una separación más sencilla de roles y responsabilidades, compatibilidad con certificados administrados y un proceso de renovación y rotación de certificados más sencillo.",
- "guid": "c1e7b351-a459-49d1-b473-a1f663310205",
+ "description": "Este enfoque proporciona una seguridad más sólida, una separación más sencilla de roles y responsabilidades, compatibilidad con certificados administrados y un proceso de renovación y rotación de certificados más sencillo.",
+ "guid": "14551ef6-ea58-410f-bb9b-08a0c10381a8",
"service": "Azure Application Gateway",
- "text": "Uso de Azure Key Vault para almacenar certificados TLS",
+ "text": "Integre Application Gateway con Key Vault para almacenar certificados TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Un certificado TLS del servidor backend debe ser emitido por una CA conocida. Si el certificado no fue emitido por una entidad de certificación de confianza, Application Gateway comprueba si el certificado fue emitido por una entidad de certificación de confianza, y así sucesivamente, hasta que se encuentra un certificado de entidad de certificación de confianza. Solo entonces se establece una conexión segura. De lo contrario, Application Gateway marca el back-end como incorrecto.",
- "guid": "1f53df88-090e-4f67-8a41-866ea4938cb1",
+ "description": "La subred de Application Gateway admite grupos de seguridad de red, pero existen algunas restricciones. Por ejemplo, está prohibida cierta comunicación con ciertos rangos de puertos. Asegúrese de comprender las implicaciones de esas restricciones.",
+ "guid": "6febf0db-32d2-4e89-a3fd-debec3a426dd",
"service": "Azure Application Gateway",
- "text": "Al volver a cifrar el tráfico de backend, asegúrese de que el certificado del servidor de backend contenga las autoridades de certificación (CA) raíz e intermedias",
+ "text": "Cumpla con todas las restricciones de NSG para Application Gateway.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Cuando el grupo de back-end contiene un FQDN que se puede resolver, la resolución de DNS se basa en una zona DNS privada o en un servidor DNS personalizado (si está configurado en la red virtual), o bien usa el DNS predeterminado proporcionado por Azure.",
- "guid": "0e1af02a-017b-4a41-a7e5-98b47d7b1fd7",
+ "description": "Una instancia de Application Gateway detenida no genera costos. Las instancias de Application Gateway que se ejecutan continuamente pueden incurrir en costos innecesarios. Evalúe los patrones de uso y detenga las instancias cuando no las necesite. Por ejemplo, espere un uso bajo después del horario comercial en entornos de desarrollo y pruebas.",
+ "guid": "147308ab-aa3c-4724-b314-5820ebe6a0ee",
"service": "Azure Application Gateway",
- "text": "Usar un servidor DNS adecuado para los recursos del grupo de back-end",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Los grupos de seguridad de red se admiten en la subred de Application Gateway, pero existen algunas restricciones. Por ejemplo, se prohíbe cierta comunicación con ciertos rangos de puertos. Asegúrese de comprender las implicaciones de esas restricciones. Para obtener más información, consulte Grupos de seguridad de red.",
- "guid": "75da1adb-f8a2-4ad5-879a-a8552d1c836a",
- "service": "Azure Application Gateway",
- "text": "Cumplimiento de todas las restricciones de NSG para Application Gateway",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "El uso de rutas definidas por el usuario (UDR) en la subred de Application Gateway puede causar algunos problemas. Es posible que se desconozca el estado de mantenimiento en el back-end. Es posible que los registros y las métricas de Application Gateway no se generen. Se recomienda no usar UDR en la subred de Application Gateway para poder ver el estado, los registros y las métricas del back-end. Si las organizaciones necesitan usar UDR en la subred de Application Gateway, asegúrese de revisar los escenarios admitidos. Para obtener más información, consulte Rutas definidas por el usuario admitidas.",
- "guid": "7776e1c9-a0a7-4fd5-8fe9-1b2b9c56cf31",
- "service": "Azure Application Gateway",
- "text": "Abstenerse de usar UDR en la subred de Application Gateway",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Cuando WAF está habilitado, Application Gateway debe almacenar en búfer cada solicitud hasta que llegue por completo, comprueba si la solicitud coincide con alguna infracción de regla en su conjunto de reglas principal y, a continuación, reenvía el paquete a las instancias de back-end. Cuando hay cargas de archivos grandes (30 MB + de tamaño), puede resultar en una latencia significativa. Dado que los requisitos de capacidad de Application Gateway son diferentes con WAF, no se recomienda habilitar WAF en Application Gateway sin las pruebas y validaciones adecuadas.",
- "guid": "7c173790-6fac-43bc-b1b4-e787fdbb904f",
- "service": "Azure Application Gateway",
- "text": "Tenga en cuenta los cambios de capacidad de Application Gateway al habilitar WAF",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Para obtener información sobre los precios de Application Gateway, consulte Descripción de los precios de Azure Application Gateway y Web Application Firewall. También puede aprovechar la calculadora de precios. Asegúrese de que las opciones tengan el tamaño adecuado para satisfacer la demanda de capacidad y ofrecer el rendimiento esperado sin desperdiciar recursos.",
- "guid": "13adc786-048a-4720-9aad-610419507199",
- "service": "Azure Application Gateway",
- "text": "Familiarícese con los precios de Application Gateway",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "Identifique y elimine instancias de Application Gateway con grupos de back-end vacíos para evitar costos innecesarios.",
- "guid": "8d3979f9-bd25-4455-9e2f-2cc7e0deaf5e",
- "service": "Azure Application Gateway",
- "text": "Revisar los recursos infrautilizados",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "No se le facturará cuando Application Gateway esté en estado detenido. La ejecución continua de instancias de Application Gateway puede incurrir en costos superfluos. Evalúe los patrones de uso y detenga las instancias cuando no las necesite. Por ejemplo, se espera que el uso fuera del horario comercial en entornos de desarrollo y pruebas sea bajo. Consulte estos artículos para obtener información sobre cómo detener e iniciar instancias.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "fc01794b-1808-4152-a82c-95b43b2a4c45",
- "service": "Azure Application Gateway",
- "text": "Detener instancias de Application Gateway cuando no estén en uso",
+ "text": "Detenga las instancias de Application Gateway cuando no estén en uso. Para obtener más información, vea Stop-AzApplicationGateway y Start-AzApplicationGateway.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Una política de escalado horizontal garantiza que habrá suficientes instancias para controlar el tráfico entrante y los picos. Además, tenga una política de reducción horizontal que garantice que el número de instancias se reduzca cuando disminuya la demanda. Tenga en cuenta la elección del tamaño de la instancia. El tamaño puede afectar significativamente el costo. Algunas consideraciones se describen en Estimación del recuento de instancias de Application Gateway. Para más información, consulte ¿Qué es Azure Application Gateway v2?",
- "guid": "4e5743d9-44ec-4a09-9c80-d77056109fc6",
+ "description": "Utilice estas métricas para validar si el recuento de instancias aprovisionadas coincide con la cantidad de tráfico entrante y asegúrese de utilizar plenamente los recursos asignados.",
+ "guid": "1946aefd-0576-40b2-a8ed-58265dc9dcf0",
"service": "Azure Application Gateway",
- "text": "Tener una política de escalado horizontal y horizontal",
+ "text": "Supervise las métricas clave de Application Gateway que impulsan el costo, como: - Unidades de capacidad facturada estimadas. - Unidades fijas de capacidad facturable. - Unidades de capacidad actual. Asegúrese de tener en cuenta los costos de ancho de banda.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Se le facturará en función de las instancias medidas de Application Gateway en función de las métricas rastreadas por Azure. Evalúe las distintas métricas y unidades de capacidad y determine los factores de coste. Para obtener más información, consulte Administración de costos y facturación de Microsoft. Las siguientes métricas son clave para Application Gateway. Esta información se puede usar para validar que el recuento de instancias aprovisionadas coincida con la cantidad de tráfico entrante.- Unidades de capacidad facturadas estimadas- Unidades de capacidad facturables fijas- Unidades de capacidad actualesPara obtener más información, consulte Métricas de Application Gateway. Asegúrese de tener en cuenta los costos de ancho de banda.",
- "guid": "30129a61-cd84-4085-9533-5d42f89372d9",
+ "description": "Establezca alertas cuando las métricas crucen los umbrales para saber cuándo aumenta su uso. Este enfoque garantiza que tenga tiempo suficiente para implementar los cambios necesarios en la carga de trabajo y evita la degradación o las interrupciones.",
+ "guid": "aa1eacb3-ef9f-4e69-bc98-784ec67d1192",
"service": "Azure Application Gateway",
- "text": "Revisar las métricas de consumo en diferentes parámetros",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "Use estas métricas como indicadores de uso de la capacidad aprovisionada de Application Gateway. Recomendamos encarecidamente configurar alertas sobre la capacidad. Para obtener más información, consulte Compatibilidad con alto tráfico de Application Gateway.",
- "guid": "57cc0c49-939f-46d9-864e-d7ce31733771",
- "service": "Azure Application Gateway",
- "text": "Supervisión de las métricas de capacidad",
+ "text": "Configure alertas para notificar a su equipo cuando las métricas de capacidad, como el uso de CPU y el uso de unidades de proceso, superen los umbrales recomendados. Para configurar un conjunto completo de alertas basadas en métricas de capacidad, consulte Compatibilidad con el tráfico elevado de Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Hay otras métricas que pueden indicar problemas en Application Gateway o en el back-end. Se recomienda evaluar las siguientes alertas:- Recuento de hosts incorrectos- Estado de respuesta (dimensión 4xx y 5xx)- Estado de respuesta de back-end (dimensión 4xx y 5xx)- Tiempo de respuesta del último byte de back-end- Tiempo total de Application GatewayPara obtener más información, consulte Métricas para Application Gateway.",
- "guid": "071e5241-c008-41a2-9e62-c056081158d2",
+ "description": "Use alertas para ayudar a garantizar que su equipo pueda responder a los problemas de manera oportuna y facilitar la solución de problemas.",
+ "guid": "91992f80-fca7-48ad-85bc-3bad00352475",
"service": "Azure Application Gateway",
- "text": "Solución de problemas mediante métricas",
+ "text": "Configure alertas para notificar a su equipo sobre las métricas que indican problemas en Application Gateway o en el back-end. Se recomienda evaluar las siguientes alertas:- Recuento de hosts incorrectos- Estado de respuesta, como errores 4xx y 5xx - Estado de respuesta de back-end, como errores 4xx y 5xx - Tiempo de respuesta del último byte de back-end- Tiempo total de Application GatewayPara obtener más información, consulte Métricas para Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Los registros de diagnóstico le permiten ver los registros de firewall, los registros de rendimiento y los registros de acceso. Use estos registros para administrar y solucionar problemas con las instancias de Application Gateway. Para obtener más información, consulte Registros de diagnóstico y estado de back-end para Application Gateway.",
- "guid": "7e160588-dc1c-48d5-9a56-4ddc6aeb8fc2",
+ "description": "Use los registros para ayudar a detectar, investigar y solucionar problemas con las instancias de Application Gateway y la carga de trabajo.",
+ "guid": "59ddc80c-f93b-488b-814d-270a4ad7786d",
"service": "Azure Application Gateway",
- "text": "Habilitación de diagnósticos en Application Gateway y Web Application Firewall (WAF)",
+ "text": "Habilite los registros de diagnóstico en Application Gateway y WAF para recopilar registros de firewall, registros de rendimiento y registros de acceso.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Azure Monitor Network Insights proporciona una vista completa del estado y las métricas de los recursos de red, incluida Application Gateway. Para obtener más información y funcionalidades compatibles con Application Gateway, consulte Información de red de Azure Monitor.",
- "guid": "260dc49f-05b9-4c43-9cda-afc5b1923c89",
+ "description": "Utilice las alertas de Advisor para mantenerse al día y solucionar problemas de inmediato. Evite cualquier problema relacionado con el plano de control o el plano de datos. Application Gateway comprueba la versión de certificado renovada en la instancia de Key Vault vinculada cada 4 horas. Si no se puede acceder a la versión del certificado debido a una configuración incorrecta de Key Vault, registra ese error e inserta una recomendación de Advisor correspondiente.",
+ "guid": "88daf0df-5324-450c-ae59-e8d3f12f697a",
"service": "Azure Application Gateway",
- "text": "Uso de Azure Monitor Network Insights",
+ "text": "Use Advisor para supervisar los problemas de configuración de Key Vault. Establezca una alerta para notificar a su equipo cuando reciba la recomendación que indica Resolver el problema de Azure Key Vault para Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Asegúrese de que ha configurado la configuración de IdleTimeout para que coincida con las características de escucha y tráfico de la aplicación back-end. El valor predeterminado se establece en cuatro minutos y se puede configurar hasta un máximo de 30. Para obtener más información, consulte Restablecimiento de TCP del equilibrador de carga y tiempo de espera de inactividad.Para obtener consideraciones sobre la carga de trabajo, consulte Supervisión del estado de la aplicación para la confiabilidad.",
- "guid": "8c5e5e8f-44d7-4494-8819-c1d765838fec",
+ "description": "En el caso de Application Gateway v2, el escalado automático tarda aproximadamente de seis a siete minutos antes de que el conjunto adicional de instancias esté listo para atender el tráfico. Durante ese tiempo, si Application Gateway tiene picos cortos en el tráfico, espere latencia transitoria o pérdida de tráfico.",
+ "guid": "1c9a7b2a-0e95-4416-8af5-4d173c48870e",
"service": "Azure Application Gateway",
- "text": "Hacer coincidir la configuración de tiempo de espera con la aplicación back-end",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "Application Gateway comprueba la versión de certificado renovada en el almacén de claves vinculado cada intervalo de 4 horas. Si no se puede acceder a él debido a una configuración incorrecta de Key Vault, registra ese error y envía una recomendación de Advisor correspondiente. Debe configurar las alertas de Advisor para mantenerse actualizado y solucionar dichos problemas de inmediato para evitar problemas relacionados con el plano de control o de datos. Para obtener más información, consulte Investigación y resolución de errores de Key Vault. Para establecer una alerta para este caso específico, use el tipo de recomendación como Resolver problema de Azure Key Vault para Application Gateway.",
- "guid": "4123369e-cbd7-472d-9879-e155476c2595",
- "service": "Azure Application Gateway",
- "text": "Supervisión de problemas de configuración de Key Vault mediante Azure Advisor",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "Las limitaciones del puerto SNAT son importantes para las conexiones de back-end en Application Gateway. Hay factores independientes que afectan a la forma en que Application Gateway alcanza el límite de puertos SNAT. Por ejemplo, si el backend es una dirección IP pública, requerirá su propio puerto SNAT. Para evitar las limitaciones del puerto SNAT, puede aumentar el número de instancias por Application Gateway, escalar horizontalmente los back-end para que tengan más direcciones IP o mover los back-end a la misma red virtual y usar direcciones IP privadas para los back-end. Las solicitudes por segundo (RPS) en Application Gateway se verán afectadas si se alcanza el límite de puertos SNAT. Por ejemplo, si una puerta de enlace de aplicaciones alcanza el límite de puertos SNAT, no podrá abrir una nueva conexión al back-end y se producirá un error en la solicitud.",
- "guid": "d2713c48-1e6f-4ee8-b91c-8499e7146945",
- "service": "Azure Application Gateway",
- "text": "Tenga en cuenta las limitaciones de los puertos SNAT en el diseño",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "En el caso de la SKU de Application Gateway v2, el escalado automático tarda algún tiempo (aproximadamente de seis a siete minutos) antes de que el conjunto adicional de instancias esté listo para atender el tráfico. Durante ese tiempo, si hay picos cortos en el tráfico, espere latencia transitoria o pérdida de tráfico. Le recomendamos que establezca el número mínimo de instancias en un nivel óptimo. Después de calcular el número medio de instancias y determinar las tendencias de escalado automático de Application Gateway, defina el número mínimo de instancias en función de los patrones de la aplicación. Para obtener información, consulte Compatibilidad con el tráfico alto de Application Gateway. Compruebe las unidades de proceso actuales del último mes. Esta métrica representa la utilización de la CPU de la puerta de enlace. Para definir el número mínimo de instancias, divida el uso máximo por 10. Por ejemplo, si el promedio de unidades de proceso actuales en el último mes es de 50, establezca el recuento mínimo de instancias en cinco.",
- "guid": "8bba115b-e086-458e-beca-ae9d8144a1f6",
- "service": "Azure Application Gateway",
- "text": "Definir el número mínimo de instancias",
+ "text": "Establezca el número mínimo de instancias en un nivel óptimo en función del recuento de instancias estimado, las tendencias reales de escalado automático de Application Gateway y los patrones de la aplicación. Compruebe las unidades de proceso actuales del mes pasado. Esta métrica representa el uso de CPU de la puerta de enlace. Para definir el número mínimo de instancias, divida el uso máximo por 10. Por ejemplo, si el promedio de unidades de proceso actuales en el último mes es de 50, establezca el recuento mínimo de instancias en cinco.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Se recomienda 125 como número máximo de instancias de escalado automático. Asegúrese de que la subred que tiene Application Gateway tiene suficientes direcciones IP disponibles para admitir el conjunto de instancias de escalado vertical. Establecer el número máximo de instancias en 125 no tiene implicaciones de costo, ya que solo se le factura por la capacidad consumida.",
- "guid": "1250aa80-2761-4138-9565-57735472779b",
+ "description": "Application Gateway se puede escalar horizontalmente según sea necesario para controlar el aumento del tráfico a las aplicaciones. Esta configuración no aumenta el costo, ya que solo paga por la capacidad consumida.",
+ "guid": "2b1242f0-cf07-48fa-8567-63a11efd6d13",
"service": "Azure Application Gateway",
- "text": "Definir el número máximo de instancias",
+ "text": "Establezca el número máximo de instancias de escalado automático en el máximo posible, que es de 125 instancias. Asegúrese de que la subred dedicada de Application Gateway tenga suficientes direcciones IP disponibles para admitir el mayor conjunto de instancias.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Application Gateway necesita una subred dedicada dentro de una red virtual. La subred puede tener varias instancias del recurso de Application Gateway implementado. También puede implementar otros recursos de Application Gateway en esa SKU de subred, v1 o v2. Estas son algunas consideraciones para definir el tamaño de la subred:- Application Gateway usa una dirección IP privada por instancia y otra dirección IP privada si se configura una IP front-end privada.- Azure reserva cinco direcciones IP en cada subred para uso interno.- Application Gateway (SKU estándar o WAF) puede admitir hasta 32 instancias. Tomando 32 direcciones IP de instancia + 1 IP de front-end privada + 5 reservadas de Azure, se recomienda un tamaño de subred mínimo de /26. Dado que la SKU de Standard_v2 o WAF_v2 puede admitir hasta 125 instancias, con el mismo cálculo, se recomienda un tamaño de subred de /24.- Si desea implementar recursos adicionales de Application Gateway en la misma subred, tenga en cuenta las direcciones IP adicionales que se requerirán para su recuento máximo de instancias tanto para Estándar como para Estándar v2.",
- "guid": "dbf3ca82-d3a8-431e-a86e-65df49c72032",
+ "description": "Use una subred /24 para proporcionar compatibilidad con todas las direcciones IP que necesite la implementación de Application Gateway v2. Application Gateway usa una dirección IP privada para cada instancia y otra dirección IP privada si configura una dirección IP de front-end privada. La SKU Standard_v2 o WAF_v2 puede admitir hasta 125 instancias. Azure reserva cinco direcciones IP en cada subred para uso interno.",
+ "guid": "bd29ba93-56b6-43cc-9546-8aace18d45e5",
"service": "Azure Application Gateway",
- "text": "Definir el tamaño de la subred de Application Gateway",
- "type": "recommendation",
- "waf": "Rendimiento"
- },
- {
- "description": "La SKU v2 ofrece escalado automático para garantizar que Application Gateway se pueda escalar verticalmente a medida que aumenta el tráfico. En comparación con la SKU v1, v2 tiene capacidades que mejoran el rendimiento de la carga de trabajo. Por ejemplo, un mejor rendimiento de descarga de TLS, tiempos de implementación y actualización más rápidos, redundancia de zona y más. Para obtener más información sobre las características de escalado automático, consulte Escalado de Application Gateway v2 y WAF v2. Si ejecuta la SKU de Application Gateway v1, considere la posibilidad de migrar a la SKU de Application Gateway v2. Para obtener más información, consulte Migración de Azure Application Gateway y Web Application Firewall de v1 a v2.",
- "guid": "dffdc8e9-9139-46c1-93df-638e00cb3657",
- "service": "Azure Application Gateway",
- "text": "Aproveche las características para el escalado automático y las ventajas de rendimiento",
+ "text": "Dimensione correctamente la subred dedicada de Application Gateway. Se recomienda encarecidamente una subred /24 para una implementación de Application Gateway v2. Si desea implementar otros recursos de Application Gateway en la misma subred, tenga en cuenta las direcciones IP adicionales que necesita para el recuento máximo de instancias. Para obtener más consideraciones sobre el tamaño de la subred, consulte Configuración de la infraestructura de Application Gateway.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -238,7 +150,7 @@
"metadata": {
"name": "Azure Application Gateway Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +177,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.ja.json b/checklists-ext/azureapplicationgateway_sg_checklist.ja.json
index 7a13eddc6..b71f46c03 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.ja.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.ja.json
@@ -3,234 +3,146 @@
"categories": [],
"items": [
{
- "description": "Application Gateway にアクセスしたり、さらに変更を加えたりする前に、更新のための十分な時間を計画してください。たとえば、バックエンド プールからサーバーを削除すると、既存の接続をドレインする必要があるため、時間がかかる場合があります。",
- "guid": "9a17eb2b-c5e3-428b-9e45-73dead45c4f9",
+ "description": "複数のインスタンスを複数のゾーンに分散すると、ワークロードは 1 つのゾーンでの障害に耐えることができます。使用できないゾーンがある場合、トラフィックは他のゾーンの正常なインスタンスに自動的に移行されるため、アプリケーションの信頼性が維持されます。",
+ "guid": "a36e2517-aa81-4e4b-9962-e78144b18ac7",
"service": "Azure Application Gateway",
- "text": "ルールの更新を計画する",
+ "text": "Application Gateway インスタンスをゾーン対応構成でデプロイします。 ゾーン冗長のリージョン サポートを確認してください (すべてのリージョンでこの機能が提供されているわけではありません)。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "Application Gateway を使用して複数のバックエンド インスタンスで受信トラフィックの負荷を分散する場合は、正常性プローブを使用することをお勧めします。これにより、トラフィックを処理できないバックエンドにトラフィックがルーティングされなくなります。",
- "guid": "5bfa95df-20d8-4452-a6c1-79c88b07d4cc",
+ "description": "正常性プローブは、トラフィックを処理できるバックエンドにのみトラフィックがルーティングされるようにします。Application Gateway は、バックエンド プール内のすべてのサーバーの正常性を監視し、異常と見なされたサーバーへのトラフィックの送信を自動的に停止します。",
+ "guid": "9afcdcea-4d65-4d51-9008-297c2c363625",
"service": "Azure Application Gateway",
- "text": "正常性プローブを使用してバックエンドの可用性の低さを検出する",
+ "text": "Application Gateway の正常性プローブを使用して、バックエンドの使用不可を検出します。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "正常性プローブは、設定された間隔で構成されたエンドポイントに要求を送信します。また、バックエンドが異常とマークされる前に許容される失敗した要求のしきい値があります。これらの数値はトレードオフを示しています。- 間隔を長く設定すると、サービスに高い負荷がかかります。各 Application Gateway インスタンスは独自の正常性プローブを送信するため、30 秒ごとに 100 インスタンスは 30 秒あたり 100 要求を意味します。- 間隔を短く設定すると、停止が検出されるまでの時間が長くなります。- 異常なしきい値を低く設定すると、短時間の一時的な障害によってバックエンドがダウンする可能性があります。- しきい値を高く設定すると、バックエンドをローテーションから外すのに時間がかかる場合があります。",
- "guid": "ec5bc6c4-6176-44a2-860e-8654f588effd",
+ "description": "レート制限を使用して、再試行ストームなどの問題を回避します。",
+ "guid": "7bcec0ab-ea83-427d-ae8c-946bf662ece6",
"service": "Azure Application Gateway",
- "text": "正常性プローブに対する間隔としきい値の設定の影響を確認します",
+ "text": "Azure WAF のレート制限ルールを構成して、クライアントがアプリケーションに大量のトラフィックを送信できないようにします。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "各バックエンドに独自の依存関係があり、障害が分離されているとします。たとえば、Application Gateway の背後でホストされているアプリケーションには、複数のバックエンドがあり、それぞれが異なるデータベース (レプリカ) に接続されている場合があります。このような依存関係が失敗すると、アプリケーションは動作している可能性がありますが、有効な結果は返されません。そのため、正常性エンドポイントは、理想的にはすべての依存関係を検証する必要があります。正常性エンドポイントへの各呼び出しに直接依存関係の呼び出しがある場合、そのデータベースは 1 回ではなく 30 秒ごとに 100 回のクエリを受け取ることに注意してください。これを回避するには、正常性エンドポイントで依存関係の状態を短時間キャッシュする必要があります。",
- "guid": "78bc5274-ca88-4e2a-8d3a-7b6a5ed1ccd6",
+ "description": "Application Gateway サブネット上の UDR は、いくつかの問題を引き起こす可能性があります。バックエンドの正常性、ログ、メトリックを表示できるように、Application Gateway サブネットで UDR を使用しないでください。",
+ "guid": "b2881b32-11c9-4bec-94d0-255ec577fdab",
"service": "Azure Application Gateway",
- "text": "正常性エンドポイントによるダウンストリームの依存関係の確認",
+ "text": "バックエンドの正常性レポートが適切に機能し、正しいログとメトリックを生成するように、Application Gateway で UDR を使用しないでください。 Application Gateway サブネットで UDR を使用する必要がある場合は、「サポートされている UDR」を参照してください。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "特定のシナリオでは、Application Gateway にルールを実装することを余儀なくされる場合があります。たとえば、ModSec CRS 2.2.9、CRS 3.0、または CRS 3.1 のルールが必要な場合、これらのルールは Application Gateway にのみ実装できます。逆に、レート制限と geo フィルタリングは Azure Front Door でのみ使用でき、AppGateway では使用できません。",
- "guid": "da7234f3-70a7-47d2-b685-3e47843003e9",
+ "description": "バックエンドと一致するように IdleTimeout を設定します。この設定により、バックエンドが要求に応答するのに 4 分以上かかる場合でも、Application Gateway とクライアント間の接続が開いたままになります。この設定を構成しない場合、接続は閉じられ、クライアントにはバックエンドの応答が表示されません。",
+ "guid": "0719fb38-2436-415b-8db7-3d19a1e57bee",
"service": "Azure Application Gateway",
- "text": "Azure Front Door と Application Gateway を使用して \"HTTP/S\" アプリケーションを保護する場合は、Front Door で WAF ポリシーを使用し、Azure Front Door からのトラフィックのみを受信するように Application Gateway をロックダウンします。",
+ "text": "バックエンド・アプリケーションのリスナーおよびトラフィック特性に一致するように IdleTimeout 設定を構成します。デフォルト値は 4 分です。最大 30 分に設定できます。 詳細については、「ロード バランサーの伝送制御プロトコル (TCP) のリセットとアイドル タイムアウト」を参照してください。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "セキュリティを強化するために TLS ポリシーを設定します。常に利用可能な最新の TLS ポリシーバージョンを使用していることを確認してください。これにより、TLS 1.2 以上の暗号が適用されます。",
- "guid": "9e5ba3b9-3512-425b-95e3-d5009e7630f3",
+ "description": "最新の TLS ポリシーを使用して、TLS 1.2 以上の暗号の使用を強制します。TLS ポリシーには、TLS プロトコルのバージョンと暗号スイートの制御、および TLS ハンドシェイクで暗号を使用する順序の制御が含まれます。",
+ "guid": "8e0ffc7d-aecb-456f-8a8a-6cbd5743e076",
"service": "Azure Application Gateway",
- "text": "セキュリティを強化するための TLS ポリシーの設定",
+ "text": "セキュリティを強化するために TLS ポリシーを設定します。最新の TLS ポリシーバージョンを使用していることを確認してください。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "TLS 終了に Application Gateway を使用することには、次のような利点があります。- 異なるバックエンドに送信される要求が各バックエンドに対して再認証を必要とするため、パフォーマンスが向上します。- TLS 処理を実行する必要がないため、バックエンド サーバーの使用率が向上します。- 要求コンテンツへのアクセスによるインテリジェントなルーティング - 証明書を Application Gateway にインストールするだけで済むため、証明書の管理が容易になります。",
- "guid": "5cbd84eb-56a7-4d18-9f50-de47d3b29a8f",
+ "description": "異なるバックエンドに送信される要求が各バックエンドに対して再認証する必要がないため、パフォーマンスが向上します。ゲートウェイは、要求コンテンツにアクセスし、インテリジェントなルーティング決定を行うことができます。Application Gateway に証明書をインストールするだけで、証明書の管理が簡単になります。",
+ "guid": "0534341b-03de-4eb4-9fbb-47806be1958d",
"service": "Azure Application Gateway",
- "text": "AppGateway を TLS ターミネーションに使用する",
+ "text": "TLS 終了には Application Gateway を使用します。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "Application Gateway は Key Vault と統合できます。これにより、セキュリティが強化され、役割と責任の分離が容易になり、管理された証明書のサポート、証明書の更新とローテーションのプロセスが容易になります。",
- "guid": "c1e7b351-a459-49d1-b473-a1f663310205",
+ "description": "このアプローチにより、セキュリティが強化され、役割と責任の分離が容易になり、管理された証明書のサポートが実現し、証明書の更新とローテーションのプロセスが容易になります。",
+ "guid": "14551ef6-ea58-410f-bb9b-08a0c10381a8",
"service": "Azure Application Gateway",
- "text": "Azure Key Vault を使用して TLS 証明書を格納する",
+ "text": "Application Gateway を Key Vault と統合して、TLS 証明書を格納します。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "バックエンド サーバーの TLS 証明書は、既知の CA によって発行される必要があります。証明書が信頼された CA によって発行されていない場合、Application Gateway は、信頼された CA 証明書が見つかるまで、証明書が信頼された CA によって発行されたかどうかなどを確認します。その後、安全な接続が確立されます。それ以外の場合、Application Gateway はバックエンドを異常としてマークします。",
- "guid": "1f53df88-090e-4f67-8a41-866ea4938cb1",
+ "description": "Application Gateway サブネットは NSG をサポートしていますが、いくつかの制限があります。たとえば、特定のポート範囲との一部の通信は禁止されています。これらの制限の影響を理解していることを確認してください。",
+ "guid": "6febf0db-32d2-4e89-a3fd-debec3a426dd",
"service": "Azure Application Gateway",
- "text": "バックエンド トラフィックを再暗号化する場合は、バックエンド サーバー証明書にルート認証局 (CA) と中間認証局 (CA) の両方が含まれていることを確認します",
+ "text": "Application Gateway のすべての NSG 制限に準拠します。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "バックエンド プールに解決可能な FQDN が含まれている場合、DNS 解決はプライベート DNS ゾーンまたはカスタム DNS サーバー (VNet で構成されている場合) に基づいているか、Azure が提供する既定の DNS を使用します。",
- "guid": "0e1af02a-017b-4a41-a7e5-98b47d7b1fd7",
+ "description": "停止した Application Gateway インスタンスにはコストは発生しません。継続的に実行される Application Gateway インスタンスでは、不要なコストが発生する可能性があります。使用パターンを評価し、不要な場合はインスタンスを停止します。たとえば、開発/テスト環境では、営業時間後の使用量が少なくなることが予想されます。",
+ "guid": "147308ab-aa3c-4724-b314-5820ebe6a0ee",
"service": "Azure Application Gateway",
- "text": "バックエンド プール リソースに適切な DNS サーバーを使用する",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "NSG は Application Gateway サブネットでサポートされていますが、いくつかの制限があります。たとえば、特定のポート範囲との一部の通信は禁止されています。これらの制限の影響を理解していることを確認してください。詳細については、「ネットワーク セキュリティ グループ」を参照してください。",
- "guid": "75da1adb-f8a2-4ad5-879a-a8552d1c836a",
- "service": "Azure Application Gateway",
- "text": "Application Gateway のすべての NSG 制限に準拠する",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "Application Gateway サブネットでユーザー定義ルート (UDR) を使用すると、いくつかの問題が発生する可能性があります。バックエンドの正常性状態が不明な場合があります。Application Gateway のログとメトリックが生成されない場合があります。バックエンドの正常性、ログ、メトリックを表示できるように、Application Gateway サブネットで UDR を使用しないことをお勧めします。組織で Application Gateway サブネットで UDR を使用する必要がある場合は、サポートされているシナリオを確認してください。詳細については、「サポートされているユーザー定義ルート」を参照してください。",
- "guid": "7776e1c9-a0a7-4fd5-8fe9-1b2b9c56cf31",
- "service": "Azure Application Gateway",
- "text": "Application Gateway サブネットで UDR を使用しないようにする",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "WAF が有効になっている場合、すべての要求は、完全に到着するまで Application Gateway によってバッファーに格納され、要求がコア ルール セットのルール違反と一致するかどうかを確認してから、パケットをバックエンド インスタンスに転送する必要があります。大きなファイル(サイズが30MB+)のアップロードがある場合、大幅な遅延が発生する可能性があります。Application Gateway の容量要件は WAF によって異なるため、適切なテストと検証を行わずに Application Gateway で WAF を有効にすることはお勧めしません。",
- "guid": "7c173790-6fac-43bc-b1b4-e787fdbb904f",
- "service": "Azure Application Gateway",
- "text": "WAF を有効にするときは、Application Gateway の容量の変更に注意してください",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "Application Gateway の価格については、「Azure Application Gateway と Web Application Firewall の価格について」を参照してください。また、料金計算ツールを活用することもできます。オプションが容量の需要を満たすために適切なサイズに設定され、リソースを無駄にすることなく期待されるパフォーマンスを提供することを確認します。",
- "guid": "13adc786-048a-4720-9aad-610419507199",
- "service": "Azure Application Gateway",
- "text": "Application Gateway の価格について理解する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "不要なコストを回避するために、空のバックエンド プールを持つ Application Gateway インスタンスを特定して削除します。",
- "guid": "8d3979f9-bd25-4455-9e2f-2cc7e0deaf5e",
- "service": "Azure Application Gateway",
- "text": "十分に活用されていないリソースを確認する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "Application Gateway が停止状態の場合、課金されません。Application Gateway インスタンスを継続的に実行すると、余分なコストが発生する可能性があります。使用パターンを評価し、不要なインスタンスを停止します。たとえば、Dev/Test 環境での営業時間後の使用量は低いと予想されます。インスタンスを停止および開始する方法については、次の記事を参照してください。",
- "guid": "fc01794b-1808-4152-a82c-95b43b2a4c45",
- "service": "Azure Application Gateway",
- "text": "使用していないときに Application Gateway インスタンスを停止する",
+ "text": "Application Gateway インスタンスは、使用されていないときに停止します。詳細については、「Stop-AzApplicationGateway」と「Start-AzApplicationGateway」を参照してください。",
"type": "recommendation",
"waf": "費用"
},
{
- "description": "スケールアウトポリシーにより、受信トラフィックとスパイクを処理するのに十分なインスタンスが確保されます。また、需要が減少したときにインスタンスの数が減るようにするスケールインポリシーがあります。インスタンスサイズの選択を検討してください。サイズはコストに大きな影響を与える可能性があります。いくつかの考慮事項については、「Application Gateway インスタンス数の見積もり」で説明されています。詳細については、「Azure Application Gateway v2 とは」を参照してください。",
- "guid": "4e5743d9-44ec-4a09-9c80-d77056109fc6",
+ "description": "これらのメトリクスを使用して、プロビジョニングされたインスタンス数が受信トラフィックの量と一致するかどうかを検証し、割り当てられたリソースを完全に活用していることを確認します。",
+ "guid": "1946aefd-0576-40b2-a8ed-58265dc9dcf0",
"service": "Azure Application Gateway",
- "text": "スケールインとスケールアウトのポリシーがある",
+ "text": "主要なコスト ドライバーである Application Gateway のメトリックを監視します: - 請求される容量ユニットの見積もり。 - 固定請求可能な容量ユニット。- 現在の容量ユニット。 帯域幅のコストを考慮してください。",
"type": "recommendation",
"waf": "費用"
},
{
- "description": "Azure によって追跡されるメトリックに基づく Application Gateway の従量制課金インスタンスに基づいて課金されます。さまざまなメトリクスとキャパシティーユニットを評価し、コストドライバーを決定します。詳細については、「Microsoft Cost Management and Billing」を参照してください。次のメトリックは、Application Gateway のキーです。この情報は、プロビジョニングされたインスタンス数が受信トラフィックの量と一致することを検証するために使用できます。- 推定請求キャパシティ ユニット- 固定請求可能キャパシティ ユニット- 現在のキャパシティ ユニット詳細については、「Application Gateway メトリック」を参照してください。帯域幅のコストを考慮してください。",
- "guid": "30129a61-cd84-4085-9533-5d42f89372d9",
+ "description": "メトリックがしきい値を超えたときにアラートを設定して、使用量が増加したときに把握できるようにします。このアプローチにより、ワークロードに必要な変更を実装するのに十分な時間を確保し、パフォーマンスの低下や停止を防ぐことができます。",
+ "guid": "aa1eacb3-ef9f-4e69-bc98-784ec67d1192",
"service": "Azure Application Gateway",
- "text": "さまざまなパラメーターにわたる消費メトリックを確認する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "これらのメトリックは、プロビジョニングされた Application Gateway 容量の使用率の指標として使用します。容量に関するアラートを設定することを強くお勧めします。詳細については、「Application Gateway の高トラフィックのサポート」を参照してください。",
- "guid": "57cc0c49-939f-46d9-864e-d7ce31733771",
- "service": "Azure Application Gateway",
- "text": "容量メトリックの監視",
+ "text": "CPU 使用率やコンピューティング ユニットの使用量などの容量メトリックが推奨されるしきい値を超えたときにチームに通知するアラートを構成します。 容量メトリックに基づいてアラートの包括的なセットを構成するには、「Application Gateway の高トラフィックのサポート」を参照してください。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "Application Gateway またはバックエンドの問題を示す可能性のあるメトリックは他にもあります。次のアラートを評価することをお勧めします:- 異常なホスト数- 応答状態 (ディメンション 4xx と 5xx)- バックエンド応答状態 (ディメンション 4xx と 5xx)- バックエンドの最終バイト応答時間 - Application Gateway 合計時間詳細については、「Application Gateway のメトリック」を参照してください。",
- "guid": "071e5241-c008-41a2-9e62-c056081158d2",
+ "description": "アラートを使用すると、チームが問題にタイムリーに対応し、トラブルシューティングを容易に行うことができます。",
+ "guid": "91992f80-fca7-48ad-85bc-3bad00352475",
"service": "Azure Application Gateway",
- "text": "メトリクスを使用したトラブルシューティング",
+ "text": "アラートを構成して、Application Gateway またはバックエンドの問題を示すメトリックについてチームに通知します。- 異常なホスト数 - 応答状態 (4xx エラーや 5xx エラーなど) - バックエンド応答状態 (4xx エラーや 5xx エラーなど) - バックエンドの最終バイト応答時間 - Application Gateway の合計時間詳細については、「Application Gateway のメトリック」を参照してください。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "診断ログを使用すると、ファイアウォール ログ、パフォーマンス ログ、およびアクセス ログを表示できます。これらのログを使用して、Application Gateway インスタンスの問題を管理およびトラブルシューティングします。詳細については、「Application Gateway のバックエンドの正常性ログと診断ログ」を参照してください。",
- "guid": "7e160588-dc1c-48d5-9a56-4ddc6aeb8fc2",
+ "description": "ログを使用して、Application Gateway インスタンスとワークロードの問題を検出、調査、トラブルシューティングします。",
+ "guid": "59ddc80c-f93b-488b-814d-270a4ad7786d",
"service": "Azure Application Gateway",
- "text": "Application Gateway と Web アプリケーション ファイアウォール (WAF) で診断を有効にする",
+ "text": "Application Gateway と WAF で診断ログを有効にして、ファイアウォール ログ、パフォーマンス ログ、アクセス ログを収集します。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "Azure Monitor Network Insights は、Application Gateway を含むネットワーク リソースの正常性とメトリックの包括的なビューを提供します。Application Gateway の詳細とサポートされている機能については、「Azure Monitor ネットワーク分析情報」を参照してください。",
- "guid": "260dc49f-05b9-4c43-9cda-afc5b1923c89",
+ "description": "Advisor アラートを使用して、常に最新の情報を入手し、問題を迅速に修正します。コントロールプレーンまたはデータプレーン関連の問題を防止します。 Application Gateway は、リンクされた Key Vault インスタンス内の更新された証明書のバージョンを 4 時間ごとに確認します。Key Vault の構成が正しくないために証明書のバージョンにアクセスできない場合は、そのエラーをログに記録し、対応する Advisor の推奨事項をプッシュします。",
+ "guid": "88daf0df-5324-450c-ae59-e8d3f12f697a",
"service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights を使用する",
+ "text": "Advisor を使用して、Key Vault の構成の問題を監視します。Application Gateway の Azure Key Vault の問題を解決するという推奨事項を受け取ったときにチームに通知するアラートを設定します。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "バックエンド・アプリケーションのリスナーおよびトラフィック特性と一致するようにIdleTimeout設定が構成されていることを確認します。デフォルト値は 4 分に設定され、最大 30 に設定できます。詳細については、Load Balancer の TCP リセットとアイドル・タイムアウトを参照してください。ワークロードに関する考慮事項については、信頼性のためのアプリケーション・ヘルスのモニタリングを参照してください。",
- "guid": "8c5e5e8f-44d7-4494-8819-c1d765838fec",
+ "description": "Application Gateway v2 の場合、自動スケールは、追加のインスタンス セットがトラフィックを処理する準備が整うまでに約 6 分から 7 分かかります。その間、Application Gateway のトラフィックの急増が短い場合は、一時的な待機時間またはトラフィックの損失が予想されます。",
+ "guid": "1c9a7b2a-0e95-4416-8af5-4d173c48870e",
"service": "Azure Application Gateway",
- "text": "タイムアウト設定をバックエンドアプリケーションと一致させる",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "Application Gateway は、リンクされた Key Vault で更新された証明書のバージョンを 4 時間間隔で確認します。Key Vault の構成が正しくないためにアクセスできない場合は、そのエラーをログに記録し、対応する Advisor の推奨事項をプッシュします。Advisor アラートは、常に最新の状態を維持し、このような問題をすぐに修正するように構成して、コントロールプレーンまたはデータプレーン関連の問題を回避する必要があります。詳細については、「キー コンテナーのエラーの調査と解決」を参照してください。この特定のケースのアラートを設定するには、Application Gateway の [推奨事項の種類] を [Azure Key Vault の問題を解決する] として使用します。",
- "guid": "4123369e-cbd7-472d-9879-e155476c2595",
- "service": "Azure Application Gateway",
- "text": "Azure Advisor を使用して Key Vault の構成の問題を監視する",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "SNAT ポートの制限は、Application Gateway でのバックエンド接続にとって重要です。Application Gateway が SNAT ポートの制限に達する方法に影響を与える要因は別々です。たとえば、バックエンドがパブリック IP アドレスの場合、独自の SNAT ポートが必要になります。SNAT ポートの制限を回避するために、Application Gateway あたりのインスタンス数を増やすか、バックエンドをスケールアウトしてより多くの IP アドレスを持つようにするか、バックエンドを同じ仮想ネットワークに移動してバックエンドにプライベート IP アドレスを使用できます。Application Gateway の 1 秒あたりの要求数 (RPS) は、SNAT ポートの制限に達した場合に影響を受けます。たとえば、Application Gateway が SNAT ポートの制限に達した場合、バックエンドへの新しい接続を開くことができず、要求は失敗します。",
- "guid": "d2713c48-1e6f-4ee8-b91c-8499e7146945",
- "service": "Azure Application Gateway",
- "text": "設計では SNAT ポートの制限を考慮してください",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "Application Gateway v2 SKU の場合、自動スケールは、追加のインスタンス セットがトラフィックを処理する準備が整うまでに、ある程度の時間 (約 6 分から 7 分) かかります。その間、トラフィックが急増する場合は、一時的な遅延またはトラフィックの損失が予想されます。最小インスタンス数を最適なレベルに設定することをお勧めします。平均インスタンス数を見積もり、Application Gateway の自動スケールの傾向を決定したら、アプリケーション パターンに基づいて最小インスタンス数を定義します。詳細については、「Application Gateway の高トラフィックのサポート」を参照してください。過去 1 か月の現在のコンピューティング ユニットを確認します。このメトリクスは、ゲートウェイの CPU 使用率を表します。最小インスタンス数を定義するには、ピーク使用量を 10 で割ります。たとえば、過去 1 か月の平均 Current Compute Units が 50 の場合は、最小インスタンス数を 5 に設定します。",
- "guid": "8bba115b-e086-458e-beca-ae9d8144a1f6",
- "service": "Azure Application Gateway",
- "text": "最小インスタンス数の定義",
+ "text": "最小インスタンス数は、推定インスタンス数、実際の Application Gateway 自動スケールの傾向、およびアプリケーション パターンに基づいて最適なレベルに設定します。 過去 1 か月の現在のコンピューティング ユニットを確認します。このメトリクスは、ゲートウェイの CPU 使用率を表します。最小インスタンス数を定義するには、ピーク使用量を 10 で割ります。たとえば、過去 1 か月の現在の平均コンピューティング ユニットが 50 の場合は、最小インスタンス数を 5 に設定します。",
"type": "recommendation",
"waf": "パフォーマンス"
},
{
- "description": "自動スケーリング インスタンスの最大数として 125 をお勧めします。Application Gateway を持つサブネットに、インスタンスのスケールアップ セットをサポートするのに十分な使用可能な IP アドレスがあることを確認します。最大インスタンス数を 125 に設定しても、消費された容量に対してのみ請求されるため、コストへの影響はありません。",
- "guid": "1250aa80-2761-4138-9565-57735472779b",
+ "description": "Application Gateway は、アプリケーションへのトラフィックの増加を処理するために、必要に応じてスケールアウトできます。この設定では、消費された容量に対してのみ支払うため、コストは増加しません。",
+ "guid": "2b1242f0-cf07-48fa-8567-63a11efd6d13",
"service": "Azure Application Gateway",
- "text": "最大インスタンス数の定義",
+ "text": "自動スケーリング インスタンスの最大数を、可能な最大数 (125 インスタンス) に設定します。Application Gateway 専用サブネットに、増加したインスタンスのセットをサポートするのに十分な使用可能な IP アドレスがあることを確認します。",
"type": "recommendation",
"waf": "パフォーマンス"
},
{
- "description": "Application Gateway には、仮想ネットワーク内に専用のサブネットが必要です。サブネットには、デプロイされた Application Gateway リソースの複数のインスタンスを含めることができます。また、そのサブネット (v1 または v2 SKU) に他の Application Gateway リソースをデプロイすることもできます。サブネット サイズの定義に関する考慮事項を次に示します。- Application Gateway は、インスタンスごとに 1 つのプライベート IP アドレスを使用し、プライベート フロントエンド IP が構成されている場合は別のプライベート IP アドレスを使用します。- Azure では、各サブネットに 5 つの IP アドレスが内部使用のために予約されています。- Application Gateway (Standard または WAF SKU) は、最大 32 個のインスタンスをサポートできます。32 個のインスタンス IP アドレス + 1 個のプライベート フロントエンド IP + 5 個の Azure 予約済みの場合、最小サブネット サイズは /26 にすることをお勧めします。Standard_v2 SKU または WAF_v2 SKU は最大 125 個のインスタンスをサポートできるため、同じ計算を使用して、サブネット サイズ /24 をお勧めします。- 同じサブネットに追加の Application Gateway リソースをデプロイする場合は、Standard と Standard v2 の両方の最大インスタンス数に必要な追加の IP アドレスを検討してください。",
- "guid": "dbf3ca82-d3a8-431e-a86e-65df49c72032",
+ "description": "/24 サブネットを使用して、Application Gateway v2 のデプロイに必要なすべての IP アドレスをサポートします。 Application Gateway では、インスタンスごとに 1 つのプライベート IP アドレスが使用され、プライベート フロントエンド IP を構成する場合は別のプライベート IP アドレスが使用されます。Standard_v2 SKU または WAF_v2 SKU は、最大 125 個のインスタンスをサポートできます。Azure では、内部使用のために各サブネットに 5 つの IP アドレスが予約されています。",
+ "guid": "bd29ba93-56b6-43cc-9546-8aace18d45e5",
"service": "Azure Application Gateway",
- "text": "Application Gateway サブネット サイズを定義する",
- "type": "recommendation",
- "waf": "パフォーマンス"
- },
- {
- "description": "v2 SKU には、トラフィックの増加に合わせて Application Gateway をスケールアップできるように、自動スケーリングが用意されています。v1 SKU と比較すると、v2 にはワークロードのパフォーマンスを向上させる機能があります。たとえば、TLS オフロード パフォーマンスの向上、デプロイと更新時間の短縮、ゾーン冗長性などです。自動スケール機能の詳細については、「Application Gateway v2 と WAF v2 のスケーリング」を参照してください。v1 SKU Application gateway を実行している場合は、Application gateway v2 SKU への移行を検討してください。詳細については、「Azure Application Gateway と Web アプリケーション ファイアウォールを v1 から v2 に移行する」を参照してください。",
- "guid": "dffdc8e9-9139-46c1-93df-638e00cb3657",
- "service": "Azure Application Gateway",
- "text": "自動スケーリングとパフォーマンス上の利点のための機能を活用する",
+ "text": "Application Gateway 専用サブネットのサイズを適切に設定します。Application Gateway v2 のデプロイには /24 サブネットを使用することを強くお勧めします。 同じサブネットに他の Application Gateway リソースをデプロイする場合は、最大インスタンス数に必要な追加の IP アドレスを検討してください。 サブネットのサイズ設定に関するその他の考慮事項については、「Application Gateway インフラストラクチャの構成」を参照してください。",
"type": "recommendation",
"waf": "パフォーマンス"
}
@@ -238,7 +150,7 @@
"metadata": {
"name": "Azure Application Gateway Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +177,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.ko.json b/checklists-ext/azureapplicationgateway_sg_checklist.ko.json
index 36432d9c7..9001f733e 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.ko.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.ko.json
@@ -3,234 +3,146 @@
"categories": [],
"items": [
{
- "description": "Application Gateway에 액세스하거나 추가로 변경하기 전에 업데이트를 위한 충분한 시간을 계획합니다. 예를 들어 백 엔드 풀에서 서버를 제거하려면 기존 연결을 드레이닝해야 하기 때문에 시간이 걸릴 수 있습니다.",
- "guid": "9a17eb2b-c5e3-428b-9e45-73dead45c4f9",
+ "description": "여러 인스턴스를 여러 영역에 분산하면 워크로드가 단일 영역에서 장애를 견딜 수 있습니다. 사용할 수 없는 영역이 있는 경우 트래픽이 자동으로 다른 영역의 정상 인스턴스로 전환되어 애플리케이션 안정성이 유지됩니다.",
+ "guid": "a36e2517-aa81-4e4b-9962-e78144b18ac7",
"service": "Azure Application Gateway",
- "text": "규칙 업데이트 계획",
+ "text": "영역 인식 구성에서 Application Gateway 인스턴스를 배포합니다. 모든 지역에서 이 기능을 제공하는 것은 아니므로 영역 중복에 대한 지역 지원을 확인합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "Application Gateway를 사용하여 여러 백 엔드 인스턴스를 통해 들어오는 트래픽의 부하를 분산하는 경우 상태 프로브를 사용하는 것이 좋습니다. 이렇게 하면 트래픽을 처리할 수 없는 백엔드로 트래픽이 라우팅되지 않습니다.",
- "guid": "5bfa95df-20d8-4452-a6c1-79c88b07d4cc",
+ "description": "상태 프로브는 트래픽이 트래픽을 처리할 수 있는 백 엔드로만 라우팅되도록 합니다. Application Gateway는 백 엔드 풀에 있는 모든 서버의 상태를 모니터링하고 비정상으로 간주되는 모든 서버로의 트래픽 전송을 자동으로 중지합니다.",
+ "guid": "9afcdcea-4d65-4d51-9008-297c2c363625",
"service": "Azure Application Gateway",
- "text": "상태 프로브를 사용하여 백 엔드 사용 불가 감지Use health probes to detect backend unavailability",
+ "text": "Application Gateway 상태 프로브를 사용하여 백 엔드 사용 불가를 검색합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "상태 프로브는 설정된 간격으로 구성된 엔드포인트로 요청을 보냅니다. 또한 백 엔드가 비정상으로 표시되기 전에 허용되는 실패한 요청의 임계값이 있습니다. 이러한 숫자는 절충안을 제시합니다.- 더 높은 간격을 설정하면 서비스에 더 많은 부하가 걸립니다. 각 Application Gateway 인스턴스는 자체 상태 프로브를 보내므로 30초마다 100개의 인스턴스는 30초당 100개의 요청을 의미합니다.- 간격을 낮게 설정하면 중단이 감지되기 전에 더 많은 시간이 남습니다.- 비정상 임계값을 낮게 설정하면 짧은 일시적인 오류로 인해 백 엔드가 중단될 수 있습니다. - 임계값을 높게 설정하면 백엔드를 회전에서 제외하는 데 시간이 더 오래 걸릴 수 있습니다.",
- "guid": "ec5bc6c4-6176-44a2-860e-8654f588effd",
+ "description": "속도 제한을 사용하여 재시도 폭풍과 같은 문제를 방지합니다.",
+ "guid": "7bcec0ab-ea83-427d-ae8c-946bf662ece6",
"service": "Azure Application Gateway",
- "text": "간격 및 임계값 설정이 상태 프로브에 미치는 영향을 검토합니다.",
+ "text": "클라이언트가 애플리케이션에 너무 많은 트래픽을 보낼 수 없도록 Azure WAF에 대한 속도 제한 규칙을 구성합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "각 백엔드에 실패를 격리하기 위해 자체 종속성이 있다고 가정합니다. 예를 들어 Application Gateway 뒤에서 호스트되는 애플리케이션에는 각각 다른 데이터베이스(복제본)에 연결된 여러 백 엔드가 있을 수 있습니다. 이러한 종속성이 실패하면 애플리케이션이 작동할 수 있지만 유효한 결과를 반환하지 않을 수 있습니다. 이러한 이유로 상태 엔드포인트는 모든 종속성의 유효성을 검사하는 것이 좋습니다. 상태 엔드포인트에 대한 각 호출에 직접 종속성 호출이 있는 경우 해당 데이터베이스는 30초마다 1개가 아닌 100개의 쿼리를 수신합니다. 이를 방지하려면 상태 엔드포인트가 짧은 기간 동안 종속성의 상태를 캐시해야 합니다.",
- "guid": "78bc5274-ca88-4e2a-8d3a-7b6a5ed1ccd6",
+ "description": "Application Gateway 서브넷의 UDR로 인해 몇 가지 문제가 발생할 수 있습니다. 백 엔드 상태, 로그 및 메트릭을 볼 수 있도록 Application Gateway 서브넷에서 UDR을 사용하지 마세요.",
+ "guid": "b2881b32-11c9-4bec-94d0-255ec577fdab",
"service": "Azure Application Gateway",
- "text": "상태 엔드포인트를 통해 다운스트림 종속성 확인Verify downstream dependencies through health endpoints",
+ "text": "백 엔드 상태 보고서가 제대로 작동하고 올바른 로그 및 메트릭을 생성하도록 Application Gateway에서 UDR을 사용하지 마세요. Application Gateway 서브넷에서 UDR을 사용해야 하는 경우 지원되는 UDR을 참조하세요.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "특정 시나리오에서는 Application Gateway에서 특별히 규칙을 구현해야 할 수 있습니다. 예를 들어 ModSec CRS 2.2.9, CRS 3.0 또는 CRS 3.1 규칙이 필요한 경우 이러한 규칙은 Application Gateway에서만 구현할 수 있습니다. 반대로, 속도 제한 및 지역 필터링은 AppGateway가 아닌 Azure Front Door에서만 사용할 수 있습니다.",
- "guid": "da7234f3-70a7-47d2-b685-3e47843003e9",
+ "description": "백 엔드와 일치하도록 IdleTimeout을 설정합니다. 이 설정은 백 엔드가 요청에 응답하는 데 4분 이상 걸리는 경우 Application Gateway와 클라이언트 간의 연결이 열린 상태로 유지되도록 합니다. 이 설정을 구성하지 않으면 연결이 닫히고 클라이언트에 백 엔드 응답이 표시되지 않습니다.",
+ "guid": "0719fb38-2436-415b-8db7-3d19a1e57bee",
"service": "Azure Application Gateway",
- "text": "Azure Front Door 및 Application Gateway를 사용하여 'HTTP/S' 애플리케이션을 보호하는 경우 Front Door에서 WAF 정책을 사용하고 Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "text": "백 엔드 애플리케이션의 수신기 및 트래픽 특성과 일치하도록 IdleTimeout 설정을 구성합니다. 기본값은 4분입니다. 최대 30분까지 구성할 수 있습니다. 자세한 내용은 로드 밸런서 TCP(Transmission Control Protocol) 재설정 및 유휴 시간 제한을 참조하세요.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "추가 보안을 위해 TLS 정책을 설정합니다. 항상 사용 가능한 최신 TLS 정책 버전을 사용하고 있는지 확인합니다. 이렇게 하면 TLS 1.2 및 더 강력한 암호가 적용됩니다.",
- "guid": "9e5ba3b9-3512-425b-95e3-d5009e7630f3",
+ "description": "최신 TLS 정책을 사용하여 TLS 1.2 및 더 강력한 암호의 사용을 적용합니다. TLS 정책에는 TLS 프로토콜 버전 및 암호 그룹에 대한 제어와 TLS 핸드셰이크에서 암호를 사용하는 순서가 포함됩니다.",
+ "guid": "8e0ffc7d-aecb-456f-8a8a-6cbd5743e076",
"service": "Azure Application Gateway",
- "text": "보안 강화를 위한 TLS 정책 설정",
+ "text": "보안 강화를 위해 TLS 정책을 설정합니다. 최신 TLS 정책 버전을 사용해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "TLS 종료에 Application Gateway를 사용하면 다음과 같은 이점이 있습니다.- 다른 백 엔드로 이동하는 요청이 각 백 엔드에 다시 인증해야 하기 때문에 성능이 향상됩니다.- TLS 처리를 수행할 필요가 없으므로 백 엔드 서버의 활용도가 향상됩니다.- 요청 콘텐츠에 액세스하여 지능형 라우팅.- 인증서를 Application Gateway에만 설치하면 되므로 인증서 관리가 더 쉽습니다.",
- "guid": "5cbd84eb-56a7-4d18-9f50-de47d3b29a8f",
+ "description": "다른 백 엔드로 이동하는 요청은 각 백 엔드에 다시 인증할 필요가 없기 때문에 성능이 향상됩니다. 게이트웨이는 요청 콘텐츠에 액세스하고 지능적인 라우팅 결정을 내릴 수 있습니다. Application Gateway에 인증서만 설치하면 인증서 관리가 간소화됩니다.",
+ "guid": "0534341b-03de-4eb4-9fbb-47806be1958d",
"service": "Azure Application Gateway",
- "text": "TLS 종료에 AppGateway 사용",
+ "text": "TLS 종료에 Application Gateway를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "Application Gateway는 Key Vault와 통합할 수 있습니다. 이를 통해 보안이 강화되고, 역할과 책임이 더 쉽게 분리되고, 관리형 인증서가 지원되고, 인증서 갱신 및 순환 프로세스가 더 쉬워집니다.",
- "guid": "c1e7b351-a459-49d1-b473-a1f663310205",
+ "description": "이 접근 방식은 더 강력한 보안, 더 쉬운 역할 및 책임 분리, 관리형 인증서에 대한 지원, 더 쉬운 인증서 갱신 및 순환 프로세스를 제공합니다.",
+ "guid": "14551ef6-ea58-410f-bb9b-08a0c10381a8",
"service": "Azure Application Gateway",
- "text": "Azure Key Vault를 사용하여 TLS 인증서 저장",
+ "text": "Application Gateway를 Key Vault와 통합하여 TLS 인증서를 저장합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "백엔드 서버의 TLS 인증서는 잘 알려진 CA에서 발급해야 합니다. 인증서가 신뢰할 수 있는 CA에서 발급되지 않은 경우 Application Gateway는 신뢰할 수 있는 CA 인증서를 찾을 때까지 인증서가 신뢰할 수 있는 CA에서 발급되었는지 확인합니다. 그런 다음에만 보안 연결이 설정됩니다. 그렇지 않으면 Application Gateway는 백 엔드를 비정상으로 표시합니다.",
- "guid": "1f53df88-090e-4f67-8a41-866ea4938cb1",
+ "description": "Application Gateway 서브넷은 NSG를 지원하지만 몇 가지 제한 사항이 있습니다. 예를 들어, 특정 포트 범위와의 일부 통신은 금지됩니다. 이러한 제한 사항의 의미를 이해해야 합니다.",
+ "guid": "6febf0db-32d2-4e89-a3fd-debec3a426dd",
"service": "Azure Application Gateway",
- "text": "백엔드 트래픽을 다시 암호화할 때 백엔드 서버 인증서에 루트 및 중간 CA(인증 기관)가 모두 포함되어 있는지 확인합니다",
+ "text": "Application Gateway에 대한 모든 NSG 제한 사항을 준수합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "백 엔드 풀에 확인 가능한 FQDN이 포함된 경우 DNS 확인은 프라이빗 DNS 영역 또는 사용자 지정 DNS 서버(VNet에 구성된 경우)를 기반으로 하거나 기본 Azure 제공 DNS를 사용합니다.",
- "guid": "0e1af02a-017b-4a41-a7e5-98b47d7b1fd7",
+ "description": "중지된 Application Gateway 인스턴스에는 비용이 발생하지 않습니다. 지속적으로 실행되는 Application Gateway 인스턴스는 불필요한 비용을 발생시킬 수 있습니다. 사용 패턴을 평가하고 필요하지 않을 때 인스턴스를 중지합니다. 예를 들어 개발/테스트 환경에서 업무 시간 이후 사용량이 낮을 것으로 예상됩니다.",
+ "guid": "147308ab-aa3c-4724-b314-5820ebe6a0ee",
"service": "Azure Application Gateway",
- "text": "백 엔드 풀 리소스에 적절한 DNS 서버를 사용합니다",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "NSG는 Application Gateway 서브넷에서 지원되지만 몇 가지 제한 사항이 있습니다. 예를 들어, 특정 포트 범위와의 일부 통신은 금지됩니다. 이러한 제한 사항의 의미를 이해해야 합니다. 자세한 내용은 네트워크 보안 그룹을 참조하세요.",
- "guid": "75da1adb-f8a2-4ad5-879a-a8552d1c836a",
- "service": "Azure Application Gateway",
- "text": "Application Gateway에 대한 모든 NSG 제한 사항 준수",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "Application Gateway 서브넷에서 UDR(사용자 정의 경로)을 사용하면 몇 가지 문제가 발생할 수 있습니다. 백 엔드의 상태는 알 수 없음일 수 있습니다. Application Gateway 로그 및 메트릭이 생성되지 않을 수 있습니다. 백 엔드 상태, 로그 및 메트릭을 볼 수 있도록 Application Gateway 서브넷에서 UDR을 사용하지 않는 것이 좋습니다. 조직에서 Application Gateway 서브넷에서 UDR을 사용해야 하는 경우 지원되는 시나리오를 검토해야 합니다. 자세한 내용은 지원되는 사용자 정의 경로를 참조하세요.",
- "guid": "7776e1c9-a0a7-4fd5-8fe9-1b2b9c56cf31",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷에서 UDR을 사용하지 마세요.",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "WAF를 사용하도록 설정하면 Application Gateway에서 모든 요청을 버퍼링해야 하며, 완전히 도착할 때까지 요청이 핵심 규칙 집합의 규칙 위반과 일치하는지 확인한 다음, 패킷을 백 엔드 인스턴스로 전달해야 합니다. 대용량 파일(30MB+ 크기)이 업로드되는 경우 상당한 대기 시간이 발생할 수 있습니다. Application Gateway 용량 요구 사항은 WAF와 다르기 때문에 적절한 테스트 및 유효성 검사 없이 Application Gateway에서 WAF를 사용하도록 설정하지 않는 것이 좋습니다.",
- "guid": "7c173790-6fac-43bc-b1b4-e787fdbb904f",
- "service": "Azure Application Gateway",
- "text": "WAF를 사용하도록 설정할 때 Application Gateway 용량 변경에 유의하세요.",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "Application Gateway 가격 책정에 대한 자세한 내용은 Azure Application Gateway 및 Web Application Firewall의 가격 이해를 참조하세요. 가격 계산기를 활용할 수도 있습니다. 용량 수요를 충족하고 리소스 낭비 없이 예상 성능을 제공할 수 있도록 옵션의 크기가 적절하게 조정되었는지 확인합니다.",
- "guid": "13adc786-048a-4720-9aad-610419507199",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 가격 책정을 숙지합니다.",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "빈 백 엔드 풀이 있는 Application Gateway 인스턴스를 식별하고 삭제하여 불필요한 비용을 방지합니다.",
- "guid": "8d3979f9-bd25-4455-9e2f-2cc7e0deaf5e",
- "service": "Azure Application Gateway",
- "text": "활용도가 낮은 리소스 검토",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "Application Gateway가 중지된 상태일 때는 요금이 청구되지 않습니다. Application Gateway 인스턴스를 지속적으로 실행하면 불필요한 비용이 발생할 수 있습니다. 사용 패턴을 평가하고 필요하지 않을 때 인스턴스를 중지합니다. 예를 들어 개발/테스트 환경에서 업무 시간 이후의 사용량은 낮을 것으로 예상됩니다. 인스턴스를 중지하고 시작하는 방법에 대한 자세한 내용은 다음 문서를 참조하세요.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "fc01794b-1808-4152-a82c-95b43b2a4c45",
- "service": "Azure Application Gateway",
- "text": "사용하지 않을 때 Application Gateway 인스턴스 중지Stop Application Gateway instances when not in use",
+ "text": "Application Gateway 인스턴스를 사용하지 않을 때 중지합니다. 자세한 내용은 Stop-AzApplicationGateway 및 Start-AzApplicationGateway를 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "확장 정책은 들어오는 트래픽과 급증을 처리할 수 있는 충분한 인스턴스가 있는지 확인합니다. 또한 수요가 감소할 때 인스턴스 수를 줄이는 축소 정책이 있어야 합니다. 인스턴스 크기 선택을 고려합니다. 크기는 비용에 큰 영향을 미칠 수 있습니다. 몇 가지 고려 사항은 Application Gateway 인스턴스 수 예측에 설명되어 있습니다. 자세한 내용은 Azure Application Gateway v2란?을 참조하세요.",
- "guid": "4e5743d9-44ec-4a09-9c80-d77056109fc6",
+ "description": "이러한 지표를 사용하여 프로비저닝된 인스턴스 수가 들어오는 트래픽의 양과 일치하는지 확인하고 할당된 리소스를 완전히 활용하는지 확인합니다.",
+ "guid": "1946aefd-0576-40b2-a8ed-58265dc9dcf0",
"service": "Azure Application Gateway",
- "text": "축소 및 확장 정책이 있습니다.",
+ "text": "다음과 같은 주요 비용 동인 Application Gateway 메트릭을 모니터링합니다. - 예상 청구된 용량 단위. - 고정 청구 가능 용량 단위. - 현재 용량 단위입니다. 대역폭 비용을 고려해야 합니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "Azure에서 추적한 메트릭을 기반으로 Application Gateway의 계량된 인스턴스를 기준으로 요금이 청구됩니다. 다양한 메트릭과 용량 단위를 평가하고 비용 동인을 결정합니다. 자세한 내용은 Microsoft Cost Management 및 청구를 참조하세요. 다음 메트릭은 Application Gateway의 핵심입니다. 이 정보는 프로비저닝된 인스턴스 수가 들어오는 트래픽의 양과 일치하는지 확인하는 데 사용할 수 있습니다.- 예상 청구 용량 단위 - 고정 청구 가능 용량 단위 - 현재 용량 단위자세한 내용은 Application Gateway 메트릭을 참조하세요. 대역폭 비용을 고려해야 합니다.",
- "guid": "30129a61-cd84-4085-9533-5d42f89372d9",
+ "description": "사용량이 증가하는 시점을 알 수 있도록 메트릭이 임계값을 초과할 때 경고를 설정합니다. 이 접근 방식을 사용하면 워크로드에 필요한 변경 사항을 구현할 수 있는 충분한 시간을 확보하고 성능 저하 또는 중단을 방지할 수 있습니다.",
+ "guid": "aa1eacb3-ef9f-4e69-bc98-784ec67d1192",
"service": "Azure Application Gateway",
- "text": "다양한 매개 변수에서 소비 메트릭을 검토합니다.",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "이러한 메트릭을 프로비전된 Application Gateway 용량의 사용률 지표로 사용합니다. 용량에 대한 경고를 설정하는 것이 좋습니다. 자세한 내용은 Application Gateway 높은 트래픽 지원을 참조하세요.",
- "guid": "57cc0c49-939f-46d9-864e-d7ce31733771",
- "service": "Azure Application Gateway",
- "text": "용량 메트릭 모니터링",
+ "text": "CPU 사용량 및 컴퓨팅 단위 사용량과 같은 용량 메트릭이 권장 임계값을 초과할 때 팀에 알리도록 경고를 구성합니다. 용량 메트릭을 기반으로 포괄적인 경고 집합을 구성하려면 Application Gateway 높은 트래픽 지원을 참조하세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "Application Gateway 또는 백 엔드에서 문제를 나타낼 수 있는 다른 메트릭이 있습니다. - 비정상 호스트 수- 응답 상태(차원 4xx 및 5xx)- 백 엔드 응답 상태(차원 4xx 및 5xx)- 백 엔드 마지막 바이트 응답 시간- Application Gateway 총 시간자세한 내용은 Application Gateway에 대한 메트릭을 참조하세요.",
- "guid": "071e5241-c008-41a2-9e62-c056081158d2",
+ "description": "경고를 사용하면 팀이 적시에 문제에 대응하고 문제 해결을 용이하게 할 수 있습니다.",
+ "guid": "91992f80-fca7-48ad-85bc-3bad00352475",
"service": "Azure Application Gateway",
- "text": "메트릭 사용 문제 해결",
+ "text": "Application Gateway 또는 백 엔드에서 문제를 나타내는 메트릭에 대해 팀에 알리도록 경고를 구성합니다. - 비정상 호스트 수 - 응답 상태(예: 4xx 및 5xx 오류) - 백 엔드 응답 상태(예: 4xx 및 5xx 오류) - 백 엔드 마지막 바이트 응답 시간 - Application Gateway 총 시간자세한 내용은 Application Gateway에 대한 메트릭을 참조하세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "진단 로그를 사용하면 방화벽 로그, 성능 로그 및 액세스 로그를 볼 수 있습니다. 이러한 로그를 사용하여 Application Gateway 인스턴스와 관련된 문제를 관리하고 해결합니다. 자세한 내용은 Application Gateway에 대한 백 엔드 상태 및 진단 로그를 참조하세요.",
- "guid": "7e160588-dc1c-48d5-9a56-4ddc6aeb8fc2",
+ "description": "로그를 사용하여 Application Gateway 인스턴스 및 워크로드와 관련된 문제를 감지, 조사 및 해결할 수 있습니다.",
+ "guid": "59ddc80c-f93b-488b-814d-270a4ad7786d",
"service": "Azure Application Gateway",
- "text": "Application Gateway 및 WAF(Web Application Firewall)에서 진단 사용Enable diagnostics on Application Gateway and WAF(Web Application Firewall)",
+ "text": "Application Gateway 및 WAF에서 진단 로그를 사용하도록 설정하여 방화벽 로그, 성능 로그 및 액세스 로그를 수집합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "Azure Monitor Network Insights는 Application Gateway를 포함한 네트워크 리소스의 상태 및 메트릭에 대한 포괄적인 보기를 제공합니다. Application Gateway에 대한 추가 세부 정보 및 지원되는 기능은 Azure Monitor 네트워크 인사이트를 참조하세요.",
- "guid": "260dc49f-05b9-4c43-9cda-afc5b1923c89",
+ "description": "Advisor 경고를 사용하여 최신 상태를 유지하고 문제를 즉시 해결합니다. 컨트롤 플레인 또는 데이터 플레인 관련 문제를 방지합니다. Application Gateway는 4시간마다 연결된 Key Vault 인스턴스에서 갱신된 인증서 버전을 확인합니다. 잘못된 Key Vault 구성으로 인해 인증서 버전에 액세스할 수 없는 경우 해당 오류를 기록하고 해당 Advisor 권장 사항을 푸시합니다.",
+ "guid": "88daf0df-5324-450c-ae59-e8d3f12f697a",
"service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights 사용",
+ "text": "Advisor를 사용하여 Key Vault 구성 문제를 모니터링합니다. Application Gateway에 대한 Azure Key Vault 문제 해결이라는 권장 사항을 받을 때 팀에 알리도록 경고를 설정합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "백 엔드 애플리케이션의 리스너 및 트래픽 특성과 일치하도록 IdleTimeout 설정을 구성했는지 확인합니다. 기본값은 4분으로 설정되며 최대 30분으로 구성할 수 있습니다. 자세한 내용은 Load Balancer TCP 재설정 및 유휴 시간 제한을 참조하세요.워크로드 고려 사항은 안정성을 위한 애플리케이션 상태 모니터링을 참조하세요.",
- "guid": "8c5e5e8f-44d7-4494-8819-c1d765838fec",
+ "description": "Application Gateway v2의 경우 추가 인스턴스 집합이 트래픽을 처리할 준비가 되기까지 약 6-7분 정도 걸립니다. 이 시간 동안 Application Gateway의 트래픽이 짧게 급증하는 경우 일시적인 대기 시간 또는 트래픽 손실이 예상됩니다.",
+ "guid": "1c9a7b2a-0e95-4416-8af5-4d173c48870e",
"service": "Azure Application Gateway",
- "text": "백 엔드 애플리케이션과 시간 제한 설정 일치Match timeout settings with the backend application",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "Application Gateway는 4시간 간격으로 연결된 Key Vault에서 갱신된 인증서 버전을 확인합니다. 잘못된 Key Vault 구성으로 인해 액세스할 수 없는 경우 해당 오류를 기록하고 해당 Advisor 권장 사항을 푸시합니다. 제어 또는 데이터 플레인 관련 문제를 방지하기 위해 최신 상태를 유지하고 이러한 문제를 즉시 해결하도록 Advisor 경고를 구성해야 합니다. 자세한 내용은 키 자격 증명 모음 오류 조사 및 해결을 참조하세요. 이 특정 사례에 대한 경고를 설정하려면 Application Gateway에 대한 Azure Key Vault 문제 해결로 권장 사항 유형을 사용합니다.",
- "guid": "4123369e-cbd7-472d-9879-e155476c2595",
- "service": "Azure Application Gateway",
- "text": "Azure Advisor를 사용하여 Key Vault 구성 문제 모니터링",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "SNAT 포트 제한은 Application Gateway의 백 엔드 연결에 중요합니다. Application Gateway가 SNAT 포트 제한에 도달하는 방법에 영향을 주는 별도의 요소가 있습니다. 예를 들어 백 엔드가 공용 IP 주소인 경우 자체 SNAT 포트가 필요합니다. SNAT 포트 제한을 피하기 위해 Application Gateway당 인스턴스 수를 늘리거나, 백 엔드를 스케일 아웃하여 더 많은 IP 주소를 갖도록 하거나, 백 엔드를 동일한 가상 네트워크로 이동하고 백 엔드에 개인 IP 주소를 사용할 수 있습니다. SNAT 포트 제한에 도달하면 Application Gateway의 RPS(초당 요청 수)가 영향을 받습니다. 예를 들어 Application Gateway가 SNAT 포트 제한에 도달하면 백 엔드에 대한 새 연결을 열 수 없으며 요청이 실패합니다.",
- "guid": "d2713c48-1e6f-4ee8-b91c-8499e7146945",
- "service": "Azure Application Gateway",
- "text": "디자인에서 SNAT 포트 제한 사항 고려",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "Application Gateway v2 SKU의 경우 추가 인스턴스 집합이 트래픽을 처리할 준비가 되기까지 자동 크기 조정에 약간의 시간(약 6-7분)이 걸립니다. 이 기간 동안 트래픽이 잠시 급증하는 경우 일시적인 대기 시간 또는 트래픽 손실이 예상됩니다. 최소 인스턴스 수를 최적의 수준으로 설정하는 것이 좋습니다. 평균 인스턴스 수를 예측하고 Application Gateway 자동 크기 조정 추세를 확인한 후 애플리케이션 패턴에 따라 최소 인스턴스 수를 정의합니다. 자세한 내용은 Application Gateway 높은 트래픽 지원을 참조하세요. 지난 1개월 동안의 현재 컴퓨팅 단위를 확인합니다. 이 메트릭은 게이트웨이의 CPU 사용률을 나타냅니다. 최소 인스턴스 수를 정의하려면 최대 사용량을 10으로 나눕니다. 예를 들어 지난 달의 평균 Current Compute 단위가 50인 경우 최소 인스턴스 수를 5로 설정합니다.",
- "guid": "8bba115b-e086-458e-beca-ae9d8144a1f6",
- "service": "Azure Application Gateway",
- "text": "최소 인스턴스 수를 정의합니다",
+ "text": "최소 인스턴스 수를 예상 인스턴스 수, 실제 Application Gateway 자동 크기 조정 추세 및 애플리케이션 패턴에 따라 최적의 수준으로 설정합니다. 지난 달의 현재 컴퓨팅 단위를 확인합니다. 이 메트릭은 게이트웨이의 CPU 사용량을 나타냅니다. 최소 인스턴스 수를 정의하려면 최대 사용량을 10으로 나눕니다. 예를 들어 지난 달의 평균 현재 컴퓨팅 단위가 50인 경우 최소 인스턴스 수를 5로 설정합니다.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "최대 자동 크기 조정 인스턴스 수로 125를 사용하는 것이 좋습니다. Application Gateway가 있는 서브넷에 스케일 업 인스턴스 집합을 지원할 수 있는 충분한 사용 가능한 IP 주소가 있는지 확인합니다. 최대 인스턴스 수를 125로 설정하면 사용된 용량에 대해서만 요금이 청구되므로 비용에는 영향을 주지 않습니다.",
- "guid": "1250aa80-2761-4138-9565-57735472779b",
+ "description": "Application Gateway는 애플리케이션에 대한 증가된 트래픽을 처리하기 위해 필요에 따라 확장할 수 있습니다. 이 설정은 사용된 용량에 대해서만 비용을 지불하기 때문에 비용을 증가시키지 않습니다.",
+ "guid": "2b1242f0-cf07-48fa-8567-63a11efd6d13",
"service": "Azure Application Gateway",
- "text": "최대 인스턴스 수를 정의합니다",
+ "text": "최대 자동 크기 조정 인스턴스 수를 가능한 최대값(125개 인스턴스)으로 설정합니다. Application Gateway 전용 서브넷에 증가된 인스턴스 집합을 지원할 수 있는 충분한 사용 가능한 IP 주소가 있는지 확인합니다.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "Application Gateway에는 가상 네트워크 내의 전용 서브넷이 필요합니다. 서브넷에는 배포된 Application Gateway 리소스의 여러 인스턴스가 있을 수 있습니다. 해당 서브넷, v1 또는 v2 SKU에 다른 Application Gateway 리소스를 배포할 수도 있습니다. 서브넷 크기를 정의하기 위한 몇 가지 고려 사항은 다음과 같습니다.- Application Gateway는 인스턴스당 하나의 개인 IP 주소를 사용하고, 개인 프런트 엔드 IP가 구성된 경우 다른 개인 IP 주소를 사용합니다.- Azure는 내부 사용을 위해 각 서브넷에서 5개의 IP 주소를 예약합니다.- Application Gateway(표준 또는 WAF SKU)는 최대 32개의 인스턴스를 지원할 수 있습니다. 인스턴스 IP 주소 32개 + 프라이빗 프런트 엔드 IP 1개 + Azure 예약 5개를 사용하는 경우 최소 서브넷 크기는 /26이 권장됩니다. Standard_v2 또는 WAF_v2 SKU는 최대 125개의 인스턴스를 지원할 수 있으므로 동일한 계산을 사용하여 서브넷 크기 /24를 사용하는 것이 좋습니다.- 동일한 서브넷에 추가 Application Gateway 리소스를 배포하려는 경우 표준 및 표준 v2 모두의 최대 인스턴스 수에 필요한 추가 IP 주소를 고려합니다.",
- "guid": "dbf3ca82-d3a8-431e-a86e-65df49c72032",
+ "description": "/24 서브넷을 사용하여 Application Gateway v2 배포에 필요한 모든 IP 주소에 대한 지원을 제공합니다. Application Gateway는 개인 프런트 엔드 IP를 구성하는 경우 각 인스턴스에 대해 하나의 개인 IP 주소와 다른 개인 IP 주소를 사용합니다. Standard_v2 또는 WAF_v2 SKU는 최대 125개의 인스턴스를 지원할 수 있습니다. Azure는 내부 사용을 위해 각 서브넷에서 5개의 IP 주소를 예약합니다.",
+ "guid": "bd29ba93-56b6-43cc-9546-8aace18d45e5",
"service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷 크기 정의",
- "type": "recommendation",
- "waf": "공연"
- },
- {
- "description": "v2 SKU는 트래픽이 증가함에 따라 Application Gateway를 확장할 수 있도록 자동 크기 조정을 제공합니다. v1 SKU와 비교할 때 v2에는 워크로드의 성능을 향상시키는 기능이 있습니다. 예를 들어 TLS 오프로드 성능 향상, 배포 및 업데이트 시간 단축, 영역 중복성 등이 있습니다. 자동 크기 조정 기능에 대한 자세한 내용은 Application Gateway v2 및 WAF v2 크기 조정을 참조하세요. v1 SKU Application gateway를 실행하는 경우 Application gateway v2 SKU로 마이그레이션하는 것이 좋습니다. 자세한 내용은 Azure Application Gateway 및 Web Application Firewall v1에서 v2로 마이그레이션을 참조하세요.",
- "guid": "dffdc8e9-9139-46c1-93df-638e00cb3657",
- "service": "Azure Application Gateway",
- "text": "자동 크기 조정 및 성능 이점을 위한 기능 활용",
+ "text": "Application Gateway 전용 서브넷의 크기를 적절하게 조정합니다. Application Gateway v2 배포에는 /24 서브넷을 사용하는 것이 좋습니다. 동일한 서브넷에 다른 Application Gateway 리소스를 배포하려는 경우 최대 인스턴스 수에 필요한 추가 IP 주소를 고려합니다. 서브넷 크기 조정에 대한 자세한 고려 사항은 Application Gateway 인프라 구성을 참조하세요.",
"type": "recommendation",
"waf": "공연"
}
@@ -238,7 +150,7 @@
"metadata": {
"name": "Azure Application Gateway Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +177,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.pt.json b/checklists-ext/azureapplicationgateway_sg_checklist.pt.json
index dbae61a77..bb7d428bd 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.pt.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.pt.json
@@ -3,234 +3,146 @@
"categories": [],
"items": [
{
- "description": "Planeje tempo suficiente para atualizações antes de acessar o Gateway de Aplicativo ou fazer mais alterações. Por exemplo, a remoção de servidores do pool de back-end pode levar algum tempo porque eles precisam drenar as conexões existentes.",
- "guid": "9a17eb2b-c5e3-428b-9e45-73dead45c4f9",
+ "description": "Quando você distribui várias instâncias entre zonas, sua carga de trabalho pode suportar falhas em uma única zona. Se você tiver uma zona indisponível, o tráfego mudará automaticamente para instâncias íntegras em outras zonas, o que mantém a confiabilidade do aplicativo.",
+ "guid": "a36e2517-aa81-4e4b-9962-e78144b18ac7",
"service": "Azure Application Gateway",
- "text": "Planejar atualizações de regras",
+ "text": "Implante instâncias do Gateway de Aplicativo em uma configuração com reconhecimento de zona. Verifique o suporte regional para redundância de zona porque nem todas as regiões oferecem esse recurso.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Se o Gateway de Aplicativo for usado para balancear a carga do tráfego de entrada em várias instâncias de back-end, recomendamos o uso de investigações de integridade. Isso garantirá que o tráfego não seja roteado para back-ends que não conseguem lidar com o tráfego.",
- "guid": "5bfa95df-20d8-4452-a6c1-79c88b07d4cc",
+ "description": "As investigações de integridade garantem que o tráfego seja roteado apenas para back-ends que possam lidar com o tráfego. O Gateway de Aplicativo monitora a integridade de todos os servidores em seu pool de back-end e interrompe automaticamente o envio de tráfego para qualquer servidor que considere não íntegro.",
+ "guid": "9afcdcea-4d65-4d51-9008-297c2c363625",
"service": "Azure Application Gateway",
- "text": "Usar investigações de integridade para detectar indisponibilidade de back-end",
+ "text": "Use investigações de integridade do Gateway de Aplicativo para detectar a indisponibilidade de back-end.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "A investigação de integridade envia solicitações para o ponto de extremidade configurado em um intervalo definido. Além disso, há um limite de solicitações com falha que serão toleradas antes que o back-end seja marcado como não íntegro. Esses números apresentam uma compensação.- Definir um intervalo maior coloca uma carga maior em seu serviço. Cada instância do Gateway de Aplicativo envia suas próprias investigações de integridade, portanto, 100 instâncias a cada 30 segundos significam 100 solicitações a cada 30 segundos.- Definir um intervalo menor deixa mais tempo antes que uma interrupção seja detectada.- Definir um limite baixo e não íntegro pode significar que falhas curtas e transitórias podem derrubar um back-end. - Definir um limite alto, pode levar mais tempo para tirar um back-end da rotação.",
- "guid": "ec5bc6c4-6176-44a2-860e-8654f588effd",
+ "description": "Use a limitação de taxa para evitar problemas como tempestades de repetição.",
+ "guid": "7bcec0ab-ea83-427d-ae8c-946bf662ece6",
"service": "Azure Application Gateway",
- "text": "Examinar o impacto das configurações de intervalo e limite nas investigações de integridade",
+ "text": "Configure regras de limitação de taxa para o WAF do Azure para que os clientes não possam enviar muito tráfego para seu aplicativo.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Suponha que cada back-end tenha suas próprias dependências para garantir que as falhas sejam isoladas. Por exemplo, um aplicativo hospedado por trás do Gateway de Aplicativo pode ter vários back-ends, cada um conectado a um banco de dados diferente (réplica). Quando essa dependência falha, o aplicativo pode estar funcionando, mas não retornará resultados válidos. Por esse motivo, o ponto de extremidade de integridade deve validar idealmente todas as dependências. Lembre-se de que, se cada chamada para o ponto de extremidade de integridade tiver uma chamada de dependência direta, esse banco de dados receberá 100 consultas a cada 30 segundos em vez de 1. Para evitar isso, o ponto de extremidade de integridade deve armazenar em cache o estado das dependências por um curto período de tempo.",
- "guid": "78bc5274-ca88-4e2a-8d3a-7b6a5ed1ccd6",
+ "description": "UDRs na sub-rede do Gateway de Aplicativo podem causar alguns problemas. Não use UDRs na sub-rede do Gateway de Aplicativo para que você possa exibir a integridade, os logs e as métricas de back-end.",
+ "guid": "b2881b32-11c9-4bec-94d0-255ec577fdab",
"service": "Azure Application Gateway",
- "text": "Verificar dependências downstream por meio de pontos de extremidade de integridade",
+ "text": "Não use UDRs no Gateway de Aplicativo para que o relatório de integridade de back-end funcione corretamente e gere os logs e as métricas corretos. Se você precisar usar uma UDR na sub-rede do Gateway de Aplicativo, consulte UDRs com suporte.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Determinados cenários podem forçá-lo a implementar regras especificamente no Gateway de Aplicativo. Por exemplo, se as regras ModSec CRS 2.2.9, CRS 3.0 ou CRS 3.1 forem necessárias, essas regras só poderão ser implementadas no Gateway de Aplicativo. Por outro lado, a limitação de taxa e a filtragem geográfica estão disponíveis apenas no Azure Front Door, não no AppGateway.",
- "guid": "da7234f3-70a7-47d2-b685-3e47843003e9",
+ "description": "Defina o IdleTimeout para corresponder ao back-end. Essa configuração garante que a conexão entre o Gateway de Aplicativo e o cliente permaneça aberta se o back-end levar mais de quatro minutos para responder à solicitação. Se você não definir essa configuração, a conexão será fechada e o cliente não verá a resposta de back-end.",
+ "guid": "0719fb38-2436-415b-8db7-3d19a1e57bee",
"service": "Azure Application Gateway",
- "text": "Ao usar o Azure Front Door e o Gateway de Aplicativo para proteger aplicativos 'HTTP/S', use políticas de WAF no Front Door e bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.",
+ "text": "Defina as configurações de IdleTimeout para corresponder às características de ouvinte e tráfego do aplicativo de back-end. O valor padrão é quatro minutos. Você pode configurá-lo para um máximo de 30 minutos. Para obter mais informações, consulte Redefinição do protocolo TCP (Protocolo de Controle de Transmissão) do balanceador de carga e tempo limite ocioso.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Configure uma política TLS para segurança extra. Verifique se você está sempre usando a versão mais recente da política TLS disponível. Isso impõe o TLS 1.2 e cifras mais fortes.",
- "guid": "9e5ba3b9-3512-425b-95e3-d5009e7630f3",
+ "description": "Use a política TLS mais recente para impor o uso do TLS 1.2 e cifras mais fortes. A política TLS inclui o controle da versão do protocolo TLS e dos conjuntos de criptografia, e também a ordem na qual um handshake TLS usa criptografias.",
+ "guid": "8e0ffc7d-aecb-456f-8a8a-6cbd5743e076",
"service": "Azure Application Gateway",
- "text": "Configurar uma política TLS para segurança aprimorada",
+ "text": "Configure uma política TLS para segurança aprimorada. Certifique-se de usar a versão mais recente da política TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "Há vantagens de usar o Gateway de Aplicativo para terminação TLS:- O desempenho melhora porque as solicitações que vão para back-ends diferentes precisam ser autenticadas novamente em cada back-end.- Melhor utilização dos servidores de back-end porque eles não precisam executar o processamento TLS- Roteamento inteligente acessando o conteúdo da solicitação.- Gerenciamento de certificados mais fácil porque o certificado só precisa ser instalado no Gateway de Aplicativo.",
- "guid": "5cbd84eb-56a7-4d18-9f50-de47d3b29a8f",
+ "description": "O desempenho melhora porque as solicitações que vão para back-ends diferentes não precisam ser autenticadas novamente em cada back-end. O gateway pode acessar o conteúdo da solicitação e tomar decisões de roteamento inteligentes. Você só precisa instalar o certificado no Gateway de Aplicativo, o que simplifica o gerenciamento de certificados.",
+ "guid": "0534341b-03de-4eb4-9fbb-47806be1958d",
"service": "Azure Application Gateway",
- "text": "Usar o AppGateway para terminação TLS",
+ "text": "Use o Gateway de Aplicativo para terminação TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "O Gateway de Aplicativo pode ser integrado ao Key Vault. Isso fornece segurança mais forte, separação mais fácil de funções e responsabilidades, suporte para certificados gerenciados e um processo de renovação e rotação de certificados mais fácil.",
- "guid": "c1e7b351-a459-49d1-b473-a1f663310205",
+ "description": "Essa abordagem fornece segurança mais forte, separação mais fácil de funções e responsabilidades, suporte para certificados gerenciados e um processo mais fácil de renovação e rotação de certificados.",
+ "guid": "14551ef6-ea58-410f-bb9b-08a0c10381a8",
"service": "Azure Application Gateway",
- "text": "Usar o Azure Key Vault para armazenar certificados TLS",
+ "text": "Integre o Gateway de Aplicativo ao Key Vault para armazenar certificados TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "Um certificado TLS do servidor back-end deve ser emitido por uma autoridade de certificação conhecida. Se o certificado não tiver sido emitido por uma autoridade de certificação confiável, o Gateway de Aplicativo verificará se o certificado foi emitido por uma autoridade de certificação confiável e assim por diante, até que um certificado de autoridade de certificação confiável seja encontrado. Só então uma conexão segura é estabelecida. Caso contrário, o Gateway de Aplicativo marcará o back-end como não íntegro.",
- "guid": "1f53df88-090e-4f67-8a41-866ea4938cb1",
+ "description": "A sub-rede do Gateway de Aplicativo dá suporte a NSGs, mas há algumas restrições. Por exemplo, alguma comunicação com determinados intervalos de portas é proibida. Certifique-se de entender as implicações dessas restrições.",
+ "guid": "6febf0db-32d2-4e89-a3fd-debec3a426dd",
"service": "Azure Application Gateway",
- "text": "Ao criptografar novamente o tráfego de back-end, verifique se o certificado do servidor de back-end contém as CAs (Autoridades de Certificação) raiz e intermediária",
+ "text": "Cumpra todas as restrições de NSG para Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "Quando o pool de back-end contém um FQDN resolvível, a resolução DNS é baseada em uma zona DNS privada ou servidor DNS personalizado (se configurado na VNet) ou usa o DNS padrão fornecido pelo Azure.",
- "guid": "0e1af02a-017b-4a41-a7e5-98b47d7b1fd7",
+ "description": "Uma instância do Gateway de Aplicativo interrompida não incorre em custos. As instâncias do Gateway de Aplicativo que são executadas continuamente podem incorrer em custos desnecessários. Avalie os padrões de uso e interrompa instâncias quando você não precisar deles. Por exemplo, espere baixo uso após o horário comercial em ambientes de desenvolvimento/teste.",
+ "guid": "147308ab-aa3c-4724-b314-5820ebe6a0ee",
"service": "Azure Application Gateway",
- "text": "Usar um servidor DNS apropriado para recursos do pool de back-end",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Os NSGs têm suporte na sub-rede do Gateway de Aplicativo, mas há algumas restrições. Por exemplo, alguma comunicação com determinados intervalos de portas é proibida. Certifique-se de entender as implicações dessas restrições. Para obter detalhes, consulte Grupos de segurança de rede.",
- "guid": "75da1adb-f8a2-4ad5-879a-a8552d1c836a",
- "service": "Azure Application Gateway",
- "text": "Cumprir todas as restrições de NSG para Gateway de Aplicativo",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "O uso de UDR (Rotas Definidas pelo Usuário) na sub-rede do Gateway de Aplicativo pode causar alguns problemas. O estado de integridade no back-end pode ser desconhecido. Os logs e métricas do Gateway de Aplicativo podem não ser gerados. Recomendamos que você não use UDRs na sub-rede do Gateway de Aplicativo para que possa exibir a integridade, os logs e as métricas de back-end. Se suas organizações precisarem usar a UDR na sub-rede do Gateway de Aplicativo, examine os cenários com suporte. Para obter mais informações, consulte Rotas definidas pelo usuário com suporte.",
- "guid": "7776e1c9-a0a7-4fd5-8fe9-1b2b9c56cf31",
- "service": "Azure Application Gateway",
- "text": "Abster-se de usar UDRs na sub-rede do gateway de aplicativo",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Quando o WAF está habilitado, cada solicitação deve ser armazenada em buffer pelo Gateway de Aplicativo até que chegue totalmente, verifica se a solicitação corresponde a qualquer violação de regra em seu conjunto de regras principal e, em seguida, encaminha o pacote para as instâncias de back-end. Quando há uploads de arquivos grandes (30 MB+ de tamanho), isso pode resultar em uma latência significativa. Como os requisitos de capacidade do Gateway de Aplicativo são diferentes com o WAF, não recomendamos habilitar o WAF no Gateway de Aplicativo sem teste e validação adequados.",
- "guid": "7c173790-6fac-43bc-b1b4-e787fdbb904f",
- "service": "Azure Application Gateway",
- "text": "Esteja ciente das alterações de capacidade do Gateway de Aplicativo ao habilitar o WAF",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Para obter informações sobre os preços do Gateway de Aplicativo, consulte Noções básicas sobre preços do Gateway de Aplicativo do Azure e do Firewall de Aplicativo Web. Você também pode aproveitar a calculadora de preços. Certifique-se de que as opções sejam dimensionadas adequadamente para atender à demanda de capacidade e fornecer o desempenho esperado sem desperdiçar recursos.",
- "guid": "13adc786-048a-4720-9aad-610419507199",
- "service": "Azure Application Gateway",
- "text": "Familiarize-se com os preços do Gateway de Aplicativo",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Identifique e exclua instâncias do Gateway de Aplicativo com pools de back-end vazios para evitar custos desnecessários.",
- "guid": "8d3979f9-bd25-4455-9e2f-2cc7e0deaf5e",
- "service": "Azure Application Gateway",
- "text": "Revise recursos subutilizados",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Você não é cobrado quando o Gateway de Aplicativo está no estado parado. A execução contínua de instâncias do Gateway de Aplicativo pode incorrer em custos irrelevantes. Avalie os padrões de uso e interrompa instâncias quando você não precisar deles. Por exemplo, espera-se que o uso após o horário comercial em ambientes de desenvolvimento/teste seja baixo. Consulte estes artigos para obter informações sobre como interromper e iniciar instâncias.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "fc01794b-1808-4152-a82c-95b43b2a4c45",
- "service": "Azure Application Gateway",
- "text": "Interromper instâncias do Gateway de Aplicativo quando não estiverem em uso",
+ "text": "Pare as instâncias do Gateway de Aplicativo quando elas não estiverem em uso. Para obter mais informações, consulte Stop-AzApplicationGateway e Start-AzApplicationGateway.",
"type": "recommendation",
"waf": "Custar"
},
{
- "description": "Uma política de expansão garante que haverá instâncias suficientes para lidar com o tráfego de entrada e picos. Além disso, tenha uma política de redução de escala que garanta que o número de instâncias seja reduzido quando a demanda cair. Considere a escolha do tamanho da instância. O tamanho pode afetar significativamente o custo. Algumas considerações são descritas em Estimar a contagem de instâncias do Gateway de Aplicativo. Para obter mais informações, consulte O que é o Gateway de Aplicativo do Azure v2?",
- "guid": "4e5743d9-44ec-4a09-9c80-d77056109fc6",
+ "description": "Use essas métricas para validar se a contagem de instâncias provisionadas corresponde à quantidade de tráfego de entrada e certifique-se de utilizar totalmente os recursos alocados.",
+ "guid": "1946aefd-0576-40b2-a8ed-58265dc9dcf0",
"service": "Azure Application Gateway",
- "text": "Ter uma política de redução e expansão",
+ "text": "Monitore as principais métricas do Gateway de Aplicativo do direcionador de custo, como: - Unidades de capacidade faturadas estimadas. - Unidades fixas de capacidade faturável. - Unidades de capacidade atual. Certifique-se de contabilizar os custos de largura de banda.",
"type": "recommendation",
"waf": "Custar"
},
{
- "description": "Você é cobrado com base em instâncias limitadas do Gateway de Aplicativo com base nas métricas rastreadas pelo Azure. Avalie as várias métricas e unidades de capacidade e determine os direcionadores de custo. Para obter mais informações, consulte Gerenciamento de Custos e Cobrança da Microsoft. As métricas a seguir são fundamentais para o Gateway de Aplicativo. Essas informações podem ser usadas para validar se a contagem de instâncias provisionadas corresponde à quantidade de tráfego de entrada.- Unidades de Capacidade Faturada Estimada- Unidades de Capacidade Faturáveis Fixas- Unidades de Capacidade AtuaisPara obter mais informações, consulte Métricas do Gateway de Aplicativo. Certifique-se de contabilizar os custos de largura de banda.",
- "guid": "30129a61-cd84-4085-9533-5d42f89372d9",
+ "description": "Defina alertas quando as métricas ultrapassarem os limites para que você saiba quando seu uso aumenta. Essa abordagem garante que você tenha tempo suficiente para implementar as alterações necessárias em sua carga de trabalho e evita degradação ou interrupções.",
+ "guid": "aa1eacb3-ef9f-4e69-bc98-784ec67d1192",
"service": "Azure Application Gateway",
- "text": "Analise as métricas de consumo em diferentes parâmetros",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Use essas métricas como indicadores de utilização da capacidade provisionada do Gateway de Aplicativo. É altamente recomendável configurar alertas sobre a capacidade. Para obter detalhes, consulte Suporte de alto tráfego do Gateway de Aplicativo.",
- "guid": "57cc0c49-939f-46d9-864e-d7ce31733771",
- "service": "Azure Application Gateway",
- "text": "Monitorar métricas de capacidade",
+ "text": "Configure alertas para notificar sua equipe quando as métricas de capacidade, como uso da CPU e uso da unidade de computação, ultrapassarem os limites recomendados. Para configurar um conjunto abrangente de alertas com base em métricas de capacidade, consulte Suporte de alto tráfego do Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "Há outras métricas que podem indicar problemas no Gateway de Aplicativo ou no back-end. Recomendamos avaliar os seguintes alertas:- Contagem de Hosts Não Íntegros- Status da Resposta (dimensão 4xx e 5xx)- Status da Resposta de Back-end (dimensão 4xx e 5xx)- Tempo de Resposta do Último Byte de Back-end- Tempo Total do Gateway de AplicativoPara obter mais informações, consulte Métricas do Gateway de Aplicativo.",
- "guid": "071e5241-c008-41a2-9e62-c056081158d2",
+ "description": "Use alertas para ajudar a garantir que sua equipe possa responder aos problemas em tempo hábil e facilitar a solução de problemas.",
+ "guid": "91992f80-fca7-48ad-85bc-3bad00352475",
"service": "Azure Application Gateway",
- "text": "Solucionar problemas usando métricas",
+ "text": "Configure alertas para notificar sua equipe sobre métricas que indicam problemas no Gateway de Aplicativo ou no back-end. Recomendamos que você avalie os seguintes alertas:- Contagem de hosts não íntegros- Status de resposta, como erros 4xx e 5xx - Status de resposta de back-end, como erros 4xx e 5xx - Tempo de resposta do último byte de back-end- Tempo total do Gateway de AplicativoPara obter mais informações, consulte Métricas para o Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "Os logs de diagnóstico permitem que você exiba logs de firewall, logs de desempenho e logs de acesso. Use esses logs para gerenciar e solucionar problemas com instâncias do Gateway de Aplicativo. Para obter mais informações, consulte Logs de diagnóstico e integridade de back-end para o Gateway de Aplicativo.",
- "guid": "7e160588-dc1c-48d5-9a56-4ddc6aeb8fc2",
+ "description": "Use logs para ajudar a detectar, investigar e solucionar problemas com instâncias do Gateway de Aplicativo e sua carga de trabalho.",
+ "guid": "59ddc80c-f93b-488b-814d-270a4ad7786d",
"service": "Azure Application Gateway",
- "text": "Habilitar o diagnóstico no Gateway de Aplicativo e no WAF (Firewall de Aplicativo Web)",
+ "text": "Habilite logs de diagnóstico no Gateway de Aplicativo e no WAF para coletar logs de firewall, logs de desempenho e logs de acesso.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "O Azure Monitor Network Insights fornece uma visão abrangente da integridade e das métricas para recursos de rede, incluindo o Gateway de Aplicativo. Para obter detalhes adicionais e recursos com suporte para o Gateway de Aplicativo, consulte Insights de rede do Azure Monitor.",
- "guid": "260dc49f-05b9-4c43-9cda-afc5b1923c89",
+ "description": "Use os alertas do Assistente para se manter atualizado e corrigir problemas imediatamente. Evite problemas relacionados ao plano de controle ou ao plano de dados. O Gateway de Aplicativo verifica a versão renovada do certificado na instância vinculada do Key Vault a cada 4 horas. Se a versão do certificado estiver inacessível devido a uma configuração incorreta do Key Vault, ele registrará esse erro e enviará uma recomendação do Assistente correspondente.",
+ "guid": "88daf0df-5324-450c-ae59-e8d3f12f697a",
"service": "Azure Application Gateway",
- "text": "Usar o Azure Monitor Network Insights",
+ "text": "Use o Assistente para monitorar problemas de configuração do Key Vault. Defina um alerta para notificar sua equipe quando você receber a recomendação que declara Resolver problema do Azure Key Vault para o Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "Verifique se você configurou as configurações de IdleTimeout para corresponder às características do ouvinte e do tráfego do aplicativo de back-end. O valor padrão é definido como quatro minutos e pode ser configurado para um máximo de 30. Para obter mais informações, consulte Redefinição de TCP do Balanceador de Carga e Tempo Limite Ocioso.Para considerações sobre carga de trabalho, consulte Monitorando a integridade do aplicativo para confiabilidade.",
- "guid": "8c5e5e8f-44d7-4494-8819-c1d765838fec",
+ "description": "Para o Gateway de Aplicativo v2, o dimensionamento automático leva aproximadamente seis a sete minutos antes que o conjunto extra de instâncias esteja pronto para atender ao tráfego. Durante esse tempo, se o Gateway de Aplicativo tiver picos curtos no tráfego, espere latência transitória ou perda de tráfego.",
+ "guid": "1c9a7b2a-0e95-4416-8af5-4d173c48870e",
"service": "Azure Application Gateway",
- "text": "Corresponder as configurações de tempo limite com o aplicativo de back-end",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "O Gateway de Aplicativo verifica a versão renovada do certificado no Key Vault vinculado a cada intervalo de 4 horas. Se ele estiver inacessível devido a qualquer configuração incorreta do Key Vault, ele registrará esse erro e enviará uma recomendação do Assistente correspondente. Você deve configurar os alertas do Advisor para se manter atualizado e corrigir esses problemas imediatamente para evitar problemas relacionados ao plano de controle ou de dados. Para obter mais informações, consulte Investigando e resolvendo erros do cofre de chaves. Para definir um alerta para esse caso específico, use o Tipo de Recomendação como Resolver problema do Azure Key Vault para o Gateway de Aplicativo.",
- "guid": "4123369e-cbd7-472d-9879-e155476c2595",
- "service": "Azure Application Gateway",
- "text": "Monitorar problemas de configuração do Key Vault usando o Assistente do Azure",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "As limitações de porta SNAT são importantes para conexões de back-end no Gateway de Aplicativo. Há fatores separados que afetam como o Gateway de Aplicativo atinge o limite de porta SNAT. Por exemplo, se o back-end for um endereço IP público, ele exigirá sua própria porta SNAT. Para evitar limitações de porta SNAT, você pode aumentar o número de instâncias por Gateway de Aplicativo, escalar horizontalmente os back-ends para ter mais endereços IP ou mover seus back-ends para a mesma rede virtual e usar endereços IP privados para os back-ends. As solicitações por segundo (RPS) no Gateway de Aplicativo serão afetadas se o limite de porta SNAT for atingido. Por exemplo, se um Gateway de Aplicativo atingir o limite de porta SNAT, ele não poderá abrir uma nova conexão com o back-end e a solicitação falhará.",
- "guid": "d2713c48-1e6f-4ee8-b91c-8499e7146945",
- "service": "Azure Application Gateway",
- "text": "Considere as limitações da porta SNAT em seu design",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "Para o SKU do Gateway de Aplicativo v2, o dimensionamento automático leva algum tempo (aproximadamente seis a sete minutos) antes que o conjunto adicional de instâncias esteja pronto para atender ao tráfego. Durante esse tempo, se houver picos curtos no tráfego, espere latência transitória ou perda de tráfego. Recomendamos que você defina sua contagem mínima de instâncias para um nível ideal. Depois de estimar a contagem média de instâncias e determinar as tendências de dimensionamento automático do Gateway de Aplicativo, defina a contagem mínima de instâncias com base nos padrões de aplicativo. Para obter informações, consulte Suporte de alto tráfego do Gateway de Aplicativo. Verifique as Unidades de Computação Atuais do último mês. Essa métrica representa a utilização da CPU do gateway. Para definir a contagem mínima de instâncias, divida o pico de uso por 10. Por exemplo, se a média de Unidades de Computação Atuais no mês passado for 50, defina a contagem mínima de instâncias como cinco.",
- "guid": "8bba115b-e086-458e-beca-ae9d8144a1f6",
- "service": "Azure Application Gateway",
- "text": "Definir a contagem mínima de instâncias",
+ "text": "Defina a contagem mínima de instâncias para um nível ideal com base na contagem de instâncias estimada, nas tendências reais de dimensionamento automático do Gateway de Aplicativo e nos padrões de aplicativo. Verifique as unidades de computação atuais do mês passado. Essa métrica representa o uso da CPU do gateway. Para definir a contagem mínima de instâncias, divida o pico de uso por 10. Por exemplo, se a média atual de unidades de computação no último mês for 50, defina a contagem mínima de instâncias como cinco.",
"type": "recommendation",
"waf": "Desempenho"
},
{
- "description": "Recomendamos 125 como a contagem máxima de instâncias de dimensionamento automático. Verifique se a sub-rede que tem o Gateway de Aplicativo tem endereços IP disponíveis suficientes para dar suporte ao conjunto de instâncias de expansão. Definir a contagem máxima de instâncias como 125 não tem implicações de custo porque você é cobrado apenas pela capacidade consumida.",
- "guid": "1250aa80-2761-4138-9565-57735472779b",
+ "description": "O Gateway de Aplicativo pode escalar horizontalmente conforme necessário para lidar com o aumento do tráfego para seus aplicativos. Essa configuração não aumenta o custo porque você paga apenas pela capacidade consumida.",
+ "guid": "2b1242f0-cf07-48fa-8567-63a11efd6d13",
"service": "Azure Application Gateway",
- "text": "Definir a contagem máxima de instâncias",
+ "text": "Defina a contagem máxima de instâncias de dimensionamento automático como o máximo possível, que é de 125 instâncias. Verifique se a sub-rede dedicada do Gateway de Aplicativo tem endereços IP disponíveis suficientes para dar suporte ao conjunto aumentado de instâncias.",
"type": "recommendation",
"waf": "Desempenho"
},
{
- "description": "O Gateway de Aplicativo precisa de uma sub-rede dedicada em uma rede virtual. A sub-rede pode ter várias instâncias do recurso de Gateway de Aplicativo implantado. Você também pode implantar outros recursos do Gateway de Aplicativo nessa sub-rede, SKU v1 ou v2. Aqui estão algumas considerações para definir o tamanho da sub-rede:- O Gateway de Aplicativo usa um endereço IP privado por instância e outro endereço IP privado se um IP de front-end privado estiver configurado.- O Azure reserva cinco endereços IP em cada sub-rede para uso interno.- O Gateway de Aplicativo (SKU Standard ou WAF) pode dar suporte a até 32 instâncias. Usando 32 endereços IP de instância + 1 IP de front-end privado + 5 Azure reservados, é recomendável um tamanho mínimo de sub-rede de /26. Como o SKU Standard_v2 ou WAF_v2 pode dar suporte a até 125 instâncias, usando o mesmo cálculo, é recomendável um tamanho de sub-rede de /24.- Se você quiser implantar recursos adicionais do Gateway de Aplicativo na mesma sub-rede, considere os endereços IP adicionais que serão necessários para a contagem máxima de instâncias para Standard e Standard v2.",
- "guid": "dbf3ca82-d3a8-431e-a86e-65df49c72032",
+ "description": "Use uma sub-rede /24 para fornecer suporte a todos os endereços IP necessários para a implantação do Gateway de Aplicativo v2. O Gateway de Aplicativo usará um endereço IP privado para cada instância e outro endereço IP privado se você configurar um IP de front-end privado. O SKU Standard_v2 ou WAF_v2 pode dar suporte a até 125 instâncias. O Azure reserva cinco endereços IP em cada sub-rede para uso interno.",
+ "guid": "bd29ba93-56b6-43cc-9546-8aace18d45e5",
"service": "Azure Application Gateway",
- "text": "Definir o tamanho da sub-rede do Gateway de Aplicativo",
- "type": "recommendation",
- "waf": "Desempenho"
- },
- {
- "description": "O SKU v2 oferece dimensionamento automático para garantir que o Gateway de Aplicativo possa escalar verticalmente à medida que o tráfego aumenta. Quando comparada ao SKU v1, a v2 tem recursos que aprimoram o desempenho da carga de trabalho. Por exemplo, melhor desempenho de descarregamento de TLS, tempos de implantação e atualização mais rápidos, redundância de zona e muito mais. Para obter mais informações sobre recursos de dimensionamento automático, consulte Dimensionando o Gateway de Aplicativo v2 e o WAF v2. Se você estiver executando o SKU v1 Gateway de aplicativo, considere migrar para o SKU do gateway de aplicativo v2. Para obter mais informações, consulte Migrar o Gateway de Aplicativo do Azure e o Firewall de Aplicativo Web da v1 para a v2.",
- "guid": "dffdc8e9-9139-46c1-93df-638e00cb3657",
- "service": "Azure Application Gateway",
- "text": "Aproveite os recursos para dimensionamento automático e benefícios de desempenho",
+ "text": "Dimensione adequadamente a sub-rede dedicada do Gateway de Aplicativo. É altamente recomendável uma sub-rede /24 para uma implantação do Gateway de Aplicativo v2. Se você quiser implantar outros recursos do Gateway de Aplicativo na mesma sub-rede, considere os endereços IP extras necessários para a contagem máxima de instâncias. Para obter mais considerações sobre como dimensionar a sub-rede, consulte Configuração de infraestrutura do Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Desempenho"
}
@@ -238,7 +150,7 @@
"metadata": {
"name": "Azure Application Gateway Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +177,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azureapplicationgateway_sg_checklist.zh-Hant.json b/checklists-ext/azureapplicationgateway_sg_checklist.zh-Hant.json
index 5e177c639..c64e87f13 100644
--- a/checklists-ext/azureapplicationgateway_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azureapplicationgateway_sg_checklist.zh-Hant.json
@@ -3,234 +3,146 @@
"categories": [],
"items": [
{
- "description": "在存取應用程式閘道或進行進一步更改之前，請計劃足夠的更新時間。例如，從後端池中刪除伺服器可能需要一些時間，因為它們必須耗盡現有連接。",
- "guid": "9a17eb2b-c5e3-428b-9e45-73dead45c4f9",
+ "description": "當您將多個實例分佈在多個區域中時，您的工作負載可以承受單個區域中的故障。如果您有不可用的可用區，流量會自動轉移到其他可用區中的運行狀況良好的實例，從而保持應用程式的可靠性。",
+ "guid": "a36e2517-aa81-4e4b-9962-e78144b18ac7",
"service": "Azure Application Gateway",
- "text": "規劃規則更新",
+ "text": "在區域感知配置中部署應用程式閘道實例。 檢查區域冗餘的區域支援，因為並非所有區域都提供此功能。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "如果使用應用程式閘道對多個後端實例上的傳入流量進行負載均衡，我們建議使用運行狀況探測。這將確保流量不會路由到無法處理流量的後端。",
- "guid": "5bfa95df-20d8-4452-a6c1-79c88b07d4cc",
+ "description": "運行狀況探測可確保流量僅路由到可以處理流量的後端。應用程式閘道會監視其後端池中所有伺服器的運行狀況，並自動停止向它認為運行狀況不佳的任何伺服器發送流量。",
+ "guid": "9afcdcea-4d65-4d51-9008-297c2c363625",
"service": "Azure Application Gateway",
- "text": "使用運行狀況探測檢測後端不可用",
+ "text": "使用應用程式閘道運行狀況探測來檢測後端不可用。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "運行狀況探測以設定的時間間隔向配置的終端節點發送請求。此外，在後端標記為運行狀況不佳之前，將容忍一個失敗請求的閾值。這些數位表示權衡。- 設置較高的間隔會給您的服務帶來更高的負載。每個應用程式閘道實例都會發送自己的運行狀況探測，因此每30秒100個實例意味著每30秒100個請求。- 設置較低的間隔會留出更多時間，然後才能檢測到中斷。- 設置較低的不正常閾值可能意味著短暫的暫時性故障可能會使後端癱瘓。- 設置較高的閾值，可能需要更長的時間才能使後端退出輪換。",
- "guid": "ec5bc6c4-6176-44a2-860e-8654f588effd",
+ "description": "使用速率限制來避免重試風暴等問題。",
+ "guid": "7bcec0ab-ea83-427d-ae8c-946bf662ece6",
"service": "Azure Application Gateway",
- "text": "查看間隔和閾值設置對運行狀況探測的影響",
+ "text": "為 Azure WAF 配置速率限制規則，以便客戶端無法向應用程式發送過多流量。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "假設每個後端都有自己的依賴項，以確保隔離故障。例如，託管在應用程式閘道後面的應用程式可能有多個後端，每個後端都連接到不同的資料庫（副本）。當此類依賴項失敗時，應用程式可能正在運行，但不會返回有效結果。因此，理想情況下，運行狀況終結點應驗證所有依賴項。請記住，如果對運行狀況終端節點的每次調用都有直接依賴項調用，則該資料庫將每 30 秒收到 100 個查詢，而不是 1 個查詢。為避免這種情況，運行狀況終端節點應將依賴項的狀態緩存一小段時間。",
- "guid": "78bc5274-ca88-4e2a-8d3a-7b6a5ed1ccd6",
+ "description": "應用程式閘道子網上的 UDR 可能會導致一些問題。不要在應用程式閘道子網上使用 UDR，以便可以查看後端運行狀況、日誌和指標。",
+ "guid": "b2881b32-11c9-4bec-94d0-255ec577fdab",
"service": "Azure Application Gateway",
- "text": "通過運行狀況終端節點驗證下游依賴項",
+ "text": "不要在應用程式閘道上使用 UDR，以便後端運行狀況報告正常運行並生成正確的日誌和指標。 如果必須在應用程式閘道子網中使用 UDR，請參閱支援的 UDR。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "某些方案可能會強制你專門在Application Gateway上實施規則。例如，如果需要ModSec CRS 2.2.9、CRS 3.0或 CRS 3.1 規則，則這些規則只能在應用程式閘道上實施。相反，速率限制和異地篩選僅在 Azure Front Door 上可用，在 AppGateway 上不可用。",
- "guid": "da7234f3-70a7-47d2-b685-3e47843003e9",
+ "description": "設置IdleTimeout以匹配後端。此設置可確保在後端回應請求的時間超過 4 分鐘時，應用程式閘道與客戶端之間的連接保持打開狀態。如果您未配置此設置，則連接將關閉，並且用戶端看不到後端回應。",
+ "guid": "0719fb38-2436-415b-8db7-3d19a1e57bee",
"service": "Azure Application Gateway",
- "text": "使用 Azure Front Door 和應用程式閘道保護 HTTP/S“應用程式時，請在 Front Door 中使用 WAF 策略並鎖定應用程式閘道以僅接收來自 Azure Front Door 的流量。",
+ "text": "配置 IdleTimeout 設定以匹配後端應用程式的偵聽器和流量特徵。預設值為 4 分鐘。您可以將其配置為最長 30 分鐘。 有關更多資訊，請參閱負載均衡器傳輸控制協定 （TCP） 重置和空閒超時。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "設置 TLS 策略以提高安全性。確保您始終使用可用的最新 TLS 策略版本。這將強制使用 TLS 1.2 和更強的密碼。",
- "guid": "9e5ba3b9-3512-425b-95e3-d5009e7630f3",
+ "description": "使用最新的 TLS 策略強制使用 TLS 1.2 和更強的密碼。TLS 策略包括對 TLS 協定版本和密碼套件的控制，以及 TLS 握手使用密碼的順序。",
+ "guid": "8e0ffc7d-aecb-456f-8a8a-6cbd5743e076",
"service": "Azure Application Gateway",
- "text": "設置 TLS 策略以增強安全性",
+ "text": "設置 TLS 策略以增強安全性。確保您使用最新的 TLS 策略版本。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "使用應用程式閘道進行 TLS 終止有以下優點：- 性能提高，因為請求發送到不同的後端必須重新進行身份驗證。- 更好地利用後端伺服器，因為它們不必執行 TLS 處理- 通過訪問請求內容實現智慧路由- 證書管理更輕鬆，因為證書只需要安裝在應用程式閘道上。",
- "guid": "5cbd84eb-56a7-4d18-9f50-de47d3b29a8f",
+ "description": "性能得到提高，因為發送到不同後端的請求不必對每個後端重新進行身份驗證。網關可以訪問請求內容並做出智慧路由決策。您只需在應用程式閘道上安裝證書，從而簡化證書管理。",
+ "guid": "0534341b-03de-4eb4-9fbb-47806be1958d",
"service": "Azure Application Gateway",
- "text": "使用 AppGateway 終止 TLS",
+ "text": "使用應用程式閘道進行 TLS 終止。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "應用程式閘道可以與 Key Vault 整合。這提供了更強的安全性、更輕鬆的角色和職責分離、對託管證書的支援以及更輕鬆的證書續訂和輪換過程。",
- "guid": "c1e7b351-a459-49d1-b473-a1f663310205",
+ "description": "這種方法提供了更強的安全性、更輕鬆的角色和職責分離、對託管證書的支援以及更輕鬆的證書續訂和輪換過程。",
+ "guid": "14551ef6-ea58-410f-bb9b-08a0c10381a8",
"service": "Azure Application Gateway",
- "text": "使用 Azure Key Vault 儲存 TLS 證書",
+ "text": "將應用程式閘道與 Key Vault 整合以儲存 TLS 證書。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "後端伺服器的 TLS 證書必須由知名 CA 頒發。如果證書不是由受信任的 CA 頒發的，則應用程式閘道會檢查證書是否由受信任的 CA 頒發，依此類推，直到找到受信任的 CA 證書。只有這樣，才會建立安全連接。否則，應用程式閘道會將後端標記為運行狀況不佳。",
- "guid": "1f53df88-090e-4f67-8a41-866ea4938cb1",
+ "description": "應用程式閘道子網支援 NSG，但存在一些限制。例如，禁止與某些埠範圍進行某些通信。確保您了解這些限制的含義。",
+ "guid": "6febf0db-32d2-4e89-a3fd-debec3a426dd",
"service": "Azure Application Gateway",
- "text": "重新加密後端流量時，請確保後端伺服器證書同時包含根證書頒發機構 （CA） 和中間證書頒發機構 （CA）",
+ "text": "遵守應用程式閘道的所有 NSG 限制。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "當後端池包含可解析的 FQDN 時，DNS 解析基於專用 DNS 區域或自定義 DNS 伺服器（如果在 VNet 上配置），或者它使用 Azure 提供的預設 DNS。",
- "guid": "0e1af02a-017b-4a41-a7e5-98b47d7b1fd7",
+ "description": "已停止的應用程式閘道實例不會產生費用。持續運行的應用程式閘道實例可能會產生不必要的成本。評估使用模式，並在不需要實例時停止實例。例如，在開發/測試環境中，下班后預計使用率較低。",
+ "guid": "147308ab-aa3c-4724-b314-5820ebe6a0ee",
"service": "Azure Application Gateway",
- "text": "對後端池資源使用適當的 DNS 伺服器",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "應用程式閘道子網支援 NSG，但存在一些限制。例如，禁止與某些埠範圍進行某些通信。確保您了解這些限制的含義。有關詳細資訊，請參閱網路安全組。",
- "guid": "75da1adb-f8a2-4ad5-879a-a8552d1c836a",
- "service": "Azure Application Gateway",
- "text": "遵守應用程式閘道的所有 NSG 限制",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "在應用程式閘道子網上使用使用者定義的路由 （UDR） 可能會導致一些問題。後端的運行狀況可能未知。應用程式網關日誌和指標可能無法生成。建議不要在應用程式閘道子網上使用UDR，以便查看後端運行狀況、日誌和指標。如果您的組織需要在應用程式閘道子網中使用 UDR，請確保查看支援的方案。有關更多資訊，請參閱支援的使用者自定義路由。",
- "guid": "7776e1c9-a0a7-4fd5-8fe9-1b2b9c56cf31",
- "service": "Azure Application Gateway",
- "text": "避免在應用程式閘道子網上使用UDR",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "啟用WAF后，應用程式閘道必須緩衝每個請求，直到它完全到達，檢查請求是否與其核心規則集中的任何規則衝突匹配，然後將數據包轉發到後端實例。當有大檔上傳（大小為 30MB+）時，可能會導致明顯的延遲。由於應用程式閘道容量要求與 WAF 不同，因此我們不建議在未進行適當測試和驗證的情況下在應用程式閘道上啟用 WAF。",
- "guid": "7c173790-6fac-43bc-b1b4-e787fdbb904f",
- "service": "Azure Application Gateway",
- "text": "啟用 WAF 時請注意應用程式閘道容量的變化",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "有關應用程式閘道定價的資訊，請參閱瞭解 Azure 應用程式閘道和 Web 應用程式防火牆的定價。您還可以利用定價計算機。確保選項的大小足以滿足容量需求，並在不浪費資源的情況下提供預期的性能。",
- "guid": "13adc786-048a-4720-9aad-610419507199",
- "service": "Azure Application Gateway",
- "text": "熟悉應用程式閘道定價",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "識別並刪除具有空後端池的應用程式閘道實例，以避免不必要的成本。",
- "guid": "8d3979f9-bd25-4455-9e2f-2cc7e0deaf5e",
- "service": "Azure Application Gateway",
- "text": "查看未充分利用的資源",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "當應用程式閘道處於 stopped 狀態時，不會向你收費。持續運行應用程式閘道實例可能會產生額外成本。評估使用模式並在不需要實例時停止實例。例如，在Dev/Test環境中，下班後的使用率預計會很低。有關如何停止和啟動實例的資訊，請參閱以下文章。- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "fc01794b-1808-4152-a82c-95b43b2a4c45",
- "service": "Azure Application Gateway",
- "text": "在不使用時停止應用程式閘道實例",
+ "text": "在應用程式閘道實例不使用時停止這些實例。有關更多資訊，請參閱 Stop-AzApplicationGateway 和 Start-AzApplicationGateway。",
"type": "recommendation",
"waf": "成本"
},
{
- "description": "橫向擴展策略可確保有足夠的實例來處理傳入流量和峰值。此外，制定縮減策略，確保在需求下降時減少實例數量。考慮實例大小的選擇。大小會顯著影響成本。估計應用程式閘道實例計數中介紹了一些注意事項。有關詳細資訊，請參閱什麼是 Azure 應用程式閘道 v2？",
- "guid": "4e5743d9-44ec-4a09-9c80-d77056109fc6",
+ "description": "使用這些指標來驗證預置的實例計數是否與傳入流量匹配，並確保您充分利用分配的資源。",
+ "guid": "1946aefd-0576-40b2-a8ed-58265dc9dcf0",
"service": "Azure Application Gateway",
- "text": "具有橫向縮減和橫向擴展策略",
+ "text": "監控關鍵成本驅動因素 Application Gateway 指標，例如：- 估計的計費容量單位。 - 固定的可計費容量單位。- 當前容量單位。 確保考慮頻寬成本。",
"type": "recommendation",
"waf": "成本"
},
{
- "description": "根據 Azure 跟蹤的指標，根據應用程式閘道的計量實例向你收費。評估各種指標和容量單位，並確定成本驅動因素。有關更多資訊，請參閱 Microsoft 成本管理和計費。以下指標是應用程式閘道的關鍵。此資訊可用於驗證預配的實例計數是否與傳入流量量匹配。- 估計的計費容量單位 - 固定的計費容量單位 - 當前容量單位有關詳細資訊，請參閱應用程式網關指標。確保考慮頻寬成本。",
- "guid": "30129a61-cd84-4085-9533-5d42f89372d9",
+ "description": "在指標超過閾值時設置警報，以便您知道使用量何時增加。此方法可確保您有足夠的時間對工作負載實施必要的更改，並防止性能下降或中斷。",
+ "guid": "aa1eacb3-ef9f-4e69-bc98-784ec67d1192",
"service": "Azure Application Gateway",
- "text": "查看不同參數的消耗量指標",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "使用這些指標作為預配的應用程式閘道容量利用率的指標。我們強烈建議您設置容量警報。有關詳細資訊，請參閱應用程式網關高流量支援。",
- "guid": "57cc0c49-939f-46d9-864e-d7ce31733771",
- "service": "Azure Application Gateway",
- "text": "監控容量指標",
+ "text": "配置警報，以便在容量指標（如 CPU 使用率和計算單位使用率）超過建議的閾值時通知您的團隊。 若要根據容量指標配置一組全面的警報，請參閱應用程式網關高流量支援。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "還有其他指標可以指示應用程式閘道或後端存在問題。我們建議評估以下警報：- 不正常的主機計數 - 回應狀態（維度 4xx 和 5xx）- 後端回應狀態（維度 4xx 和 5xx）- 後端最後一個字節回應時間 - 應用程式網關總時間有關詳細資訊，請參閱應用程式閘道的指標。",
- "guid": "071e5241-c008-41a2-9e62-c056081158d2",
+ "description": "使用警報有助於確保您的團隊能夠及時響應問題並促進故障排除。",
+ "guid": "91992f80-fca7-48ad-85bc-3bad00352475",
"service": "Azure Application Gateway",
- "text": "使用指標進行故障排除",
+ "text": "配置警報以通知團隊有關指示應用程式閘道或後端問題的指標。建議評估以下警報：- 運行狀況不佳的主機計數 - 回應狀態，例如 4xx 和 5xx 錯誤 - 後端回應狀態，例如 4xx 和 5xx 錯誤 - 後端最後一個字節回應時間 - 應用程式網關總時間有關詳細資訊，請參閱應用程式網關的指標。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "診斷日誌允許您查看防火牆日誌、性能日誌和訪問日誌。使用這些日誌來管理和排查應用程式閘道實例的問題。有關詳細資訊，請參閱應用程式網關的後端運行狀況和診斷日誌。",
- "guid": "7e160588-dc1c-48d5-9a56-4ddc6aeb8fc2",
+ "description": "使用日誌來幫助檢測、調查和排查應用程式閘道實例和工作負載的問題。",
+ "guid": "59ddc80c-f93b-488b-814d-270a4ad7786d",
"service": "Azure Application Gateway",
- "text": "在應用程式閘道和 Web 應用程式防火牆 （WAF） 上啟用診斷",
+ "text": "在應用程式閘道和 WAF 上啟用診斷日誌，以收集防火牆日誌、性能日誌和訪問日誌。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "Azure Monitor 網路見解提供網路資源（包括應用程式閘道）的運行狀況和指標的全面檢視。有關應用程式閘道的其他詳細資訊和支援的功能，請參閱 Azure Monitor 網路見解。",
- "guid": "260dc49f-05b9-4c43-9cda-afc5b1923c89",
+ "description": "使用 Advisor 警報保持最新狀態並立即解決問題。防止任何與控制平面或數據平面相關的問題。 應用程式閘道每 4 小時檢查一次連結的 Key Vault 實例中的續訂證書版本。如果證書版本由於 Key Vault 配置不正確而無法訪問，它會記錄該錯誤並推送相應的 Advisor 建議。",
+ "guid": "88daf0df-5324-450c-ae59-e8d3f12f697a",
"service": "Azure Application Gateway",
- "text": "使用 Azure Monitor 網路見解",
+ "text": "使用 Advisor 監視 Key Vault 配置問題。設置警報，以便在收到指出 Resolve Azure Key Vault issue for your Application Gateway 的建議時通知你的團隊。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "確保您已配置 IdleTimeout 設定以符合後端應用程式的偵聽器和流量特徵。默認值設置為 4 分鐘，最多可配置為 30。有關更多資訊，請參閱負載均衡器 TCP 重置和空閒超時。有關工作負載注意事項，請參閱監控應用程式運行狀況的可靠性。",
- "guid": "8c5e5e8f-44d7-4494-8819-c1d765838fec",
+ "description": "對於應用程式閘道 v2，自動縮放大約需要 6 到 7 分鐘，然後額外的實例集才能準備好提供流量。在此期間，如果應用程式閘道的流量峰值較短，則預計會出現暫時性延遲或流量丟失。",
+ "guid": "1c9a7b2a-0e95-4416-8af5-4d173c48870e",
"service": "Azure Application Gateway",
- "text": "將超時設置與後端應用程式匹配",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "應用程式閘道每隔 4 小時檢查一次連結的 Key Vault 中續訂的證書版本。如果由於任何不正確的 Key Vault 配置而無法訪問它，它會記錄該錯誤並推送相應的顧問建議。您必須將 Advisor 警報配置為保持更新並立即修復此類問題，以避免任何與控制或數據平面相關的問題。有關更多資訊，請參閱調查和解決 Key Vault 錯誤。要針對此特定情況設置警報，請使用 Recommendation Type （建議類型） 作為 Resolve Azure Key Vault issue （解決應用程式閘道的 Azure Key Vault 問題）。",
- "guid": "4123369e-cbd7-472d-9879-e155476c2595",
- "service": "Azure Application Gateway",
- "text": "使用 Azure 顧問監視 Key Vault 配置問題",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "SNAT 埠限制對於應用程式閘道上的後端連接非常重要。有單獨的因素會影響應用程式閘道達到 SNAT 埠限制的方式。例如，如果後端是公有IP位址，則需要自己的SNAT埠。為了避免 SNAT 埠限制，可以增加每個應用程式閘道的實例數，橫向擴展後端以擁有更多 IP 位址，或者將後端移動到同一虛擬網路中，並將專用 IP 位址用於後端。如果達到 SNAT 埠限制，應用程式閘道上的每秒請求數 （RPS） 將受到影響。例如，如果應用程式閘道達到 SNAT 埠限制，則它將無法打開與後端的新連接，並且請求將失敗。",
- "guid": "d2713c48-1e6f-4ee8-b91c-8499e7146945",
- "service": "Azure Application Gateway",
- "text": "在設計中考慮 SNAT 埠限制",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "對於應用程式閘道 v2 SKU，自動縮放需要一些時間（大約 6 到 7 分鐘），然後額外的實例集才能準備好提供流量。在此期間，如果流量出現短暫的峰值，則預計會出現暫時性延遲或流量丟失。我們建議您將最小實例計數設置為最佳水準。估計平均實例計數並確定應用程式閘道自動縮放趨勢後，請根據應用程式模式定義最小實例計數。有關資訊，請參閱應用程式閘道高流量支援。檢查過去一個月的 Current Compute Units（當前計算單位）。此指標表示閘道的CPU利用率。要定義最小實例計數，請將峰值使用量除以 10。例如，如果您在過去一個月的平均當前計算單位數為50，請將最小實例計數設置為5。",
- "guid": "8bba115b-e086-458e-beca-ae9d8144a1f6",
- "service": "Azure Application Gateway",
- "text": "定義最小實例計數",
+ "text": "根據估計的實例計數、實際應用程式閘道自動縮放趨勢和應用程式模式，將最小實例計數設置為最佳級別。 檢查過去一個月的當前計算單位。此指標表示閘道的CPU使用率。要定義最小實例計數，請將峰值使用量除以 10。例如，如果您在過去一個月的平均當前計算單位數為50，請將最小實例計數設置為5。",
"type": "recommendation",
"waf": "性能"
},
{
- "description": "我們建議將 125 作為最大自動縮放實例計數。確保具有應用程式閘道的子網具有足夠的可用IP位址來支援縱向擴展的實例集。將最大實例計數設置為125不會影響成本，因為您只需為使用的容量付費。",
- "guid": "1250aa80-2761-4138-9565-57735472779b",
+ "description": "應用程式閘道可以根據需要橫向擴展，以處理應用程式增加的流量。此設置不會增加成本，因為您只需為使用的容量付費。",
+ "guid": "2b1242f0-cf07-48fa-8567-63a11efd6d13",
"service": "Azure Application Gateway",
- "text": "定義最大實例計數",
+ "text": "將最大自動縮放實例計數設置為可能的最大值，即125個實例。確保應用程式閘道專用子網具有足夠的可用IP位址來支援增加的實例集。",
"type": "recommendation",
"waf": "性能"
},
{
- "description": "應用程式閘道需要在虛擬網路中有一個專用子網。子網可以包含已部署的應用程式閘道資源的多個實例。還可以在該子網、v1 或 v2 SKU 中部署其他應用程式閘道資源。下面是定義子網大小的一些注意事項：- 應用程式閘道為每個實例使用一個專用IP位址，如果配置了專用前端IP，則使用另一個專用IP位址。- Azure 在每個子網中保留5個IP位址供內部使用。- 應用程式閘道（標準或 WAF SKU）最多可支援 32 個實例。以 32 個實例 IP 位址 + 1 個專用前端 IP + 5 個 Azure 預留位址為例，建議最小子網大小為 /26。由於 Standard_v2 SKU 或 WAF_v2 SKU 最多可以支援 125 個實例，因此使用相同的計算方法，建議使用 /24 的子網大小。如果要在同一子網中部署其他應用程式網關資源，請考慮標準和標準 v2 的最大實例計數所需的其他 IP 位址。",
- "guid": "dbf3ca82-d3a8-431e-a86e-65df49c72032",
+ "description": "使用 /24 子網為應用程式閘道 v2 部署所需的所有IP位址提供支援。 應用程式閘道為每個實例使用一個專用IP位址，如果配置了專用前端IP，則使用另一個專用IP位址。Standard_v2 SKU 或 WAF_v2 SKU 最多可支援 125 個實例。Azure 在每個子網中保留 5 個 IP 位址供內部使用。",
+ "guid": "bd29ba93-56b6-43cc-9546-8aace18d45e5",
"service": "Azure Application Gateway",
- "text": "定義應用程式閘道子網大小",
- "type": "recommendation",
- "waf": "性能"
- },
- {
- "description": "v2 SKU 提供自動縮放功能，以確保應用程式閘道可以隨著流量的增加而縱向擴展。與 v1 SKU 相比，v2 具有增強工作負載性能的功能。例如，更好的 TLS 卸載性能、更快的部署和更新時間、區域冗餘等。有關自動縮放功能的更多資訊，請參閱擴展應用程式閘道 v2 和 WAF v2。如果運行的是 v1 SKU 應用程式閘道，請考慮遷移到應用程式閘道 v2 SKU。有關詳細資訊，請參閱將 Azure 應用程式閘道和 Web 應用程式防火牆從 v1 遷移到 v2。",
- "guid": "dffdc8e9-9139-46c1-93df-638e00cb3657",
- "service": "Azure Application Gateway",
- "text": "利用自動擴展和性能優勢",
+ "text": "適當調整應用程式閘道專用子網的大小。強烈建議將 /24 子網用於應用程式閘道 v2 部署。 如果要在同一子網中部署其他應用程式閘道資源，請考慮最大實例計數所需的額外IP位址。 有關調整子網大小的更多注意事項，請參閱應用程式網關基礎結構配置。",
"type": "recommendation",
"waf": "性能"
}
@@ -238,7 +150,7 @@
"metadata": {
"name": "Azure Application Gateway Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +177,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azureblobstorage_sg_checklist.en.json b/checklists-ext/azureblobstorage_sg_checklist.en.json
index 6ad0b3896..49ab0c7a0 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.en.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.en.json
@@ -277,6 +277,6 @@
"name": "Azure Blob Storage Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azureblobstorage_sg_checklist.es.json b/checklists-ext/azureblobstorage_sg_checklist.es.json
index 5ceb04cc3..d861f3b01 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.es.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.es.json
@@ -19,10 +19,10 @@
"waf": "Fiabilidad"
},
{
- "description": "La opción de eliminación temporal permite que una cuenta de almacenamiento recupere contenedores y blobs eliminados. La opción de control de versiones realiza automáticamente un seguimiento de los cambios realizados en los blobs. Esta opción permite restaurar un blob a un estado anterior. La opción de restauración a un momento dado protege contra la eliminación accidental o los daños de blobs y permite restaurar los datos de blobs en bloques a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
+ "description": "La opción de eliminación temporal permite que una cuenta de almacenamiento recupere contenedores y blobs eliminados. La opción de control de versiones realiza automáticamente un seguimiento de los cambios realizados en los blobs. Esta opción permite restaurar un blob a un estado anterior. La opción de restauración a un momento dado protege contra la eliminación accidental de blobs o daños y permite restaurar los datos de blobs en bloques a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
"guid": "d095b8f1-86f8-4345-a730-c079330d8a19",
"service": "Azure Blob Storage",
- "text": "Como parte de la estrategia de copia de seguridad y recuperación, habilite las opciones de eliminación temporal de contenedores, eliminación temporal de blobs, control de versiones y restauración a un momento dado.",
+ "text": "Como parte de la estrategia de copia de seguridad y recuperación, habilite las opciones de eliminación temporal de contenedor, eliminación temporal de blobs, control de versiones y restauración a un momento dado.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -59,10 +59,10 @@
"waf": "Seguridad"
},
{
- "description": "Solo se permiten las solicitudes protegidas autorizadas con el identificador de Microsoft Entra.",
+ "description": "Solo se permiten las solicitudes protegidas que están autorizadas con el identificador de Microsoft Entra.",
"guid": "9b699609-816c-4658-af6d-dc939f1edd51",
"service": "Azure Blob Storage",
- "text": "No permitir la autorización de clave compartida. Esto deshabilita no solo el acceso a la clave de cuenta, sino también a los tokens de firma de acceso compartido de cuenta y servicio, ya que se basan en claves de cuenta.",
+ "text": "No permitir la autorización de clave compartida. Esto deshabilita no solo el acceso a la clave de cuenta, sino también los tokens de firma de acceso compartido de cuenta y servicio, ya que se basan en claves de cuenta.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -78,7 +78,7 @@
"description": "Las prácticas recomendadas pueden ayudarle a evitar que se filtre un token de firma de acceso compartido y a recuperarse rápidamente si se produce una fuga.",
"guid": "1432d7ef-8818-4563-86fe-eead1fc727b9",
"service": "Azure Blob Storage",
- "text": "Se recomienda no usar tokens de firma de acceso compartido. Evalúe si necesita tokens de firma de acceso compartido para proteger el acceso a los recursos de Blob Storage. Si debe crear una, revise esta lista de prácticas recomendadas para firmas de acceso compartido antes de crearla y distribuirla.",
+ "text": "Se recomienda no usar tokens de firma de acceso compartido. Evalúe si necesita tokens de firma de acceso compartido para proteger el acceso a los recursos de Blob Storage. Si debe crear una, revise esta lista de prácticas recomendadas para la firma de acceso compartido antes de crearla y distribuirla.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -91,7 +91,7 @@
"waf": "Seguridad"
},
{
- "description": "Las claves administradas por el cliente proporcionan una mayor flexibilidad y control. Por ejemplo, puede almacenar claves de cifrado en Key Vault y rotarlas automáticamente.",
+ "description": "Las claves administradas por el cliente proporcionan mayor flexibilidad y control. Por ejemplo, puede almacenar claves de cifrado en Key Vault y rotarlas automáticamente.",
"guid": "82c9cd68-5f8f-496a-a84f-abbf6ce339c3",
"service": "Azure Blob Storage",
"text": "Considere la posibilidad de usar su propia clave de cifrado para proteger los datos de la cuenta de almacenamiento. Para más información, consulte Claves administradas por el cliente para el cifrado de Azure Storage.",
@@ -99,7 +99,7 @@
"waf": "Seguridad"
},
{
- "description": "Los niveles más esporádicos tienen costos de transferencia de datos más altos. Al tener menos archivos grandes, puede reducir el número de operaciones necesarias para transferir datos.",
+ "description": "Los niveles de esporádico tienen costos de transferencia de datos más altos. Al tener menos archivos grandes, puede reducir el número de operaciones necesarias para transferir datos.",
"guid": "d7f07d9a-eff1-48c0-85c1-31c641051313",
"service": "Azure Blob Storage",
"text": "Empaqueta archivos pequeños en archivos más grandes antes de moverlos a niveles más esporádicos. Puede utilizar formatos de archivo como TAR o ZIP.",
@@ -118,7 +118,7 @@
"description": "Almacenar registros de recursos en una cuenta de almacenamiento para su posterior análisis puede ser una opción más económica. El uso de directivas de administración del ciclo de vida para administrar la retención de registros en una cuenta de almacenamiento evita que se acumule un gran número de archivos de registros con el tiempo, lo que puede provocar cargos de capacidad innecesarios.",
"guid": "0393ace4-ae00-4510-a626-24fd6c331e91",
"service": "Azure Blob Storage",
- "text": "Reduzca el costo del uso de registros de recursos eligiendo la ubicación de almacenamiento de registros adecuada y administrando los períodos de retención de registros. Si solo planea consultar registros ocasionalmente (por ejemplo, consultar registros para auditoría de cumplimiento), considere la posibilidad de enviar registros de recursos a una cuenta de almacenamiento en lugar de enviarlos a un área de trabajo de registros de Azure Monitor. Puede usar una solución de consulta sin servidor, como Azure Synapse Analytics, para analizar los registros. Para obtener más información, consulte Optimización del costo para consultas poco frecuentes. Utilice políticas de administración del ciclo de vida para eliminar o archivar registros.",
+ "text": "Reduzca el costo del uso de registros de recursos eligiendo la ubicación de almacenamiento de registros adecuada y administrando los períodos de retención de registros. Si solo planea consultar registros ocasionalmente (por ejemplo, consultar registros para auditoría de cumplimiento), considere la posibilidad de enviar registros de recursos a una cuenta de almacenamiento en lugar de enviarlos a un área de trabajo de registros de Azure Monitor. Puede usar una solución de consulta sin servidor, como Azure Synapse Analytics, para analizar los registros. Para obtener más información, consulte Optimizar el costo de las consultas poco frecuentes. Utilice las políticas de administración del ciclo de vida para eliminar o archivar registros.",
"type": "recommendation",
"waf": "Costar"
},
@@ -131,7 +131,7 @@
"waf": "Costar"
},
{
- "description": "Cada vez que se sobrescribe un blob, se agrega una nueva versión, lo que aumenta los cargos por capacidad de almacenamiento. Para reducir los cargos de capacidad, almacene los datos sobrescritos con frecuencia en una cuenta de almacenamiento independiente con el control de versiones deshabilitado.",
+ "description": "Cada vez que se sobrescribe un blob, se agrega una nueva versión, lo que provoca un aumento de los cargos por capacidad de almacenamiento. Para reducir los cargos de capacidad, almacene los datos que se sobrescriben con frecuencia en una cuenta de almacenamiento independiente con el control de versiones deshabilitado.",
"guid": "c33bbf5b-3635-4aed-acb1-0a0b697cff0a",
"service": "Azure Blob Storage",
"text": "Si habilita el control de versiones, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitado el control de versiones.",
@@ -139,10 +139,10 @@
"waf": "Costar"
},
{
- "description": "Cada vez que se sobrescribe un blob, se crea una nueva instantánea. La causa del aumento de los cargos por capacidad puede ser difícil de acceder porque la creación de estas instantáneas no aparece en los registros. Para reducir los cargos de capacidad, almacene los datos sobrescritos con frecuencia en una cuenta de almacenamiento independiente con la eliminación temporal deshabilitada. Un período de retención evita que los blobs eliminados temporalmente se acumulen y aumenten el costo de la capacidad.",
+ "description": "Cada vez que se sobrescribe un blob, se crea una nueva instantánea. Es posible que sea difícil acceder a la causa del aumento de los cargos por capacidad, ya que la creación de estas instantáneas no aparece en los registros. Para reducir los cargos de capacidad, almacene los datos que se sobrescriben con frecuencia en una cuenta de almacenamiento independiente con la eliminación temporal deshabilitada. Un período de retención evita que los blobs eliminados temporalmente se acumulen y aumenten el costo de la capacidad.",
"guid": "0d4d5fa0-eff6-4fff-88b1-17b542978ea1",
"service": "Azure Blob Storage",
- "text": "Si habilita la eliminación temporal, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitada la eliminación temporal. Establecer períodos de retención. Considere comenzar con un período de retención corto para comprender mejor cómo afecta la función a su factura. El período de retención mínimo recomendado es de siete días.",
+ "text": "Si habilita la eliminación temporal, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitada la eliminación temporal. Establezca períodos de retención. Considere comenzar con un período de retención corto para comprender mejor cómo la función afecta su factura. El período de retención mínimo recomendado es de siete días.",
"type": "recommendation",
"waf": "Costar"
},
@@ -182,7 +182,7 @@
"description": "La reducción de la distancia física entre la cuenta de almacenamiento y las máquinas virtuales, los servicios y los clientes locales puede mejorar el rendimiento y reducir la latencia de la red. La reducción de la distancia física también reduce el costo de las aplicaciones hospedadas en Azure, ya que el uso del ancho de banda dentro de una sola región es gratuito.",
"guid": "5e724a0a-d268-47ae-9dcf-7ef18d870d1d",
"service": "Azure Blob Storage",
- "text": "Aprovisione cuentas de almacenamiento en la misma región donde se colocan los recursos dependientes. En el caso de las aplicaciones que no están hospedadas en Azure, como las aplicaciones de dispositivos móviles o los servicios empresariales locales, ubique la cuenta de almacenamiento en una región más cercana a esos clientes. Para más información, consulte Geografías de Azure. Si los clientes de una región diferente no requieren los mismos datos, cree una cuenta independiente en cada región. Si los clientes de una región diferente solo requieren algunos datos, considere la posibilidad de usar una directiva de replicación de objetos para copiar de forma asincrónica los objetos relevantes en una cuenta de almacenamiento de la otra región.",
+ "text": "Aprovisione cuentas de almacenamiento en la misma región donde se colocan los recursos dependientes. En el caso de las aplicaciones que no están hospedadas en Azure, como aplicaciones de dispositivos móviles o servicios empresariales locales, busque la cuenta de almacenamiento en una región más cercana a esos clientes. Para obtener más información, consulte Geografías de Azure. Si los clientes de una región diferente no requieren los mismos datos, cree una cuenta independiente en cada región. Si los clientes de una región diferente solo requieren algunos datos, considere la posibilidad de usar una directiva de replicación de objetos para copiar objetos relevantes de forma asincrónica en una cuenta de almacenamiento de la otra región.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -203,10 +203,10 @@
"waf": "Rendimiento"
},
{
- "description": "Los tamaños de blob o bloque superiores a 256 KB aprovechan las mejoras de rendimiento de la plataforma, creadas específicamente para blobs y tamaños de bloque más grandes.",
+ "description": "Los tamaños de blob o bloque superiores a 256 KiB aprovechan las mejoras de rendimiento de la plataforma, creadas específicamente para blobs y tamaños de bloque más grandes.",
"guid": "a0addee3-cb0e-4235-b93c-8d5a8ddfbab2",
"service": "Azure Blob Storage",
- "text": "Al cargar blobs o bloques, use un tamaño de blob o bloque superior a 256 KB.",
+ "text": "Al cargar blobs o bloques, use un tamaño de blob o bloque superior a 256 KiB.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -214,7 +214,7 @@
"metadata": {
"name": "Azure Blob Storage Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -241,31 +241,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azureblobstorage_sg_checklist.ja.json b/checklists-ext/azureblobstorage_sg_checklist.ja.json
index 05d1f50bb..0862d86da 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.ja.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.ja.json
@@ -214,7 +214,7 @@
"metadata": {
"name": "Azure Blob Storage Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -241,31 +241,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azureblobstorage_sg_checklist.ko.json b/checklists-ext/azureblobstorage_sg_checklist.ko.json
index e211171b4..51d3d904a 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.ko.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.ko.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "이중화는 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 서로 다른 가용성 영역에 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
+ "description": "중복성은 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 서로 다른 가용성 영역에 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
"guid": "561e09d2-403f-42d4-9d64-dcf0c8845a7b",
"service": "Azure Blob Storage",
"text": "중복을 위해 계정을 구성합니다. 최대 가용성 및 내구성을 위해 ZRS(영역 중복 스토리지) 또는 GZRS를 사용하여 계정을 구성합니다.",
@@ -22,7 +22,7 @@
"description": "일시 삭제 옵션을 사용하면 스토리지 계정에서 삭제된 컨테이너 및 Blob을 복구할 수 있습니다. 버전 관리 옵션은 Blob에 대한 변경 내용을 자동으로 추적합니다. 이 옵션을 사용하면 Blob을 이전 상태로 복원할 수 있습니다. 특정 시점 복원 옵션을 사용하면 실수로 Blob이 삭제되거나 손상되는 것을 방지하고 블록 Blob 데이터를 이전 상태로 복원할 수 있습니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
"guid": "d095b8f1-86f8-4345-a730-c079330d8a19",
"service": "Azure Blob Storage",
- "text": "백업 및 복구 전략의 일환으로 컨테이너 일시 삭제, Blob 일시 삭제, 버전 관리 및 특정 시점 복원 옵션을 사용하도록 설정합니다.",
+ "text": "백업 및 복구 전략의 일부로 컨테이너 일시 삭제, Blob 일시 삭제, 버전 관리 및 특정 시점 복원 옵션을 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -43,10 +43,10 @@
"waf": "안전"
},
{
- "description": "제로 액세스부터 시작한 다음 클라이언트 및 서비스에 필요한 가장 낮은 수준의 액세스 권한을 점진적으로 부여하여 공격자에게 불필요한 틈을 만들 위험을 최소화합니다.",
+ "description": "제로 액세스로 시작한 다음 클라이언트 및 서비스에 필요한 가장 낮은 수준의 액세스 권한을 점진적으로 부여하여 공격자에게 불필요한 구멍을 만들 위험을 최소화합니다.",
"guid": "c8c2f2d2-3aca-4483-9092-c5e078bd7488",
"service": "Azure Blob Storage",
- "text": "스토리지 계정의 퍼블릭 엔드포인트에 대한 트래픽을 사용하지 않도록 설정합니다. Azure에서 실행되는 클라이언트에 대한 프라이빗 엔드포인트를 만듭니다. Azure 외부의 클라이언트 및 서비스가 스토리지 계정에 직접 액세스해야 하는 경우에만 퍼블릭 엔드포인트를 사용하도록 설정합니다. 특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다.",
+ "text": "스토리지 계정의 공용 엔드포인트에 대한 트래픽을 사용하지 않도록 설정합니다. Azure에서 실행되는 클라이언트에 대한 프라이빗 엔드포인트를 만듭니다. Azure 외부의 클라이언트 및 서비스가 스토리지 계정에 직접 액세스해야 하는 경우에만 퍼블릭 엔드포인트를 사용하도록 설정합니다. 특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -75,10 +75,10 @@
"waf": "안전"
},
{
- "description": "모범 사례는 공유 액세스 서명 토큰이 유출되는 것을 방지하고 누출이 발생할 경우 신속하게 복구하는 데 도움이 될 수 있습니다.",
+ "description": "모범 사례는 공유 액세스 서명 토큰이 유출되는 것을 방지하고 누수가 발생할 경우 신속하게 복구하는 데 도움이 될 수 있습니다.",
"guid": "1432d7ef-8818-4563-86fe-eead1fc727b9",
"service": "Azure Blob Storage",
- "text": "공유 액세스 서명 토큰을 사용하지 않는 것이 좋습니다. Blob Storage 리소스에 대한 액세스를 보호하기 위해 공유 액세스 서명 토큰이 필요한지 여부를 평가합니다. 공유 액세스 서명을 만들어야 하는 경우 공유 액세스 서명 모범 사례 목록을 검토하고 배포하기 전에 검토하세요.",
+ "text": "공유 액세스 서명 토큰을 사용하지 않는 것이 좋습니다. Blob Storage 리소스에 대한 액세스를 보호하기 위해 공유 액세스 서명 토큰이 필요한지 여부를 평가합니다. 공유 액세스 서명을 만들어야 하는 경우 공유 액세스 서명을 만들고 배포하기 전에 이 공유 액세스 서명 모범 사례 목록을 검토하세요.",
"type": "recommendation",
"waf": "안전"
},
@@ -99,10 +99,10 @@
"waf": "안전"
},
{
- "description": "쿨 계층은 데이터 전송 비용이 더 높습니다. 더 적은 수의 큰 파일을 보유함으로써 데이터를 전송하는 데 필요한 작업 수를 줄일 수 있습니다.",
+ "description": "쿨 계층은 데이터 전송 비용이 더 높습니다. 더 적은 수의 큰 파일을 보유하면 데이터를 전송하는 데 필요한 작업 수를 줄일 수 있습니다.",
"guid": "d7f07d9a-eff1-48c0-85c1-31c641051313",
"service": "Azure Blob Storage",
- "text": "쿨 계층으로 이동하기 전에 작은 파일을 더 큰 파일로 압축합니다. TAR 또는 ZIP과 같은 파일 형식을 사용할 수 있습니다.",
+ "text": "쿨 계층으로 이동하기 전에 작은 파일을 큰 파일로 압축합니다. TAR 또는 ZIP과 같은 파일 형식을 사용할 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -110,7 +110,7 @@
"description": "보관 계층에서 우선 순위가 높은 리하이드레이션으로 인해 정상보다 높은 청구가 발생할 수 있습니다.",
"guid": "c122df96-d477-4595-acf5-501023d8f002",
"service": "Azure Blob Storage",
- "text": "보관 스토리지에서 Blob을 리하이드레이션할 때 표준 우선 순위 리하이드레이션을 사용합니다. 우선 순위가 높은 리하이드레이션은 긴급 데이터 복원 상황에만 사용합니다. 자세한 내용은 보관된 Blob을 온라인 계층으로 리하이드레이션을 참조하세요.",
+ "text": "보관 스토리지에서 Blob을 리하이드레이션할 때 표준 우선 순위 리하이드레이션을 사용합니다. 응급 데이터 복원 상황에만 우선 순위가 높은 리하이드레이션을 사용합니다. 자세한 내용은 보관된 Blob을 온라인 계층으로 리하이드레이션을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -118,7 +118,7 @@
"description": "나중에 분석하기 위해 스토리지 계정에 리소스 로그를 저장하는 것이 더 저렴한 옵션일 수 있습니다. 수명 주기 관리 정책을 사용하여 스토리지 계정의 로그 보존을 관리하면 시간이 지남에 따라 많은 수의 로그 파일이 쌓이는 것을 방지할 수 있으며, 이로 인해 불필요한 용량 요금이 발생할 수 있습니다.",
"guid": "0393ace4-ae00-4510-a626-24fd6c331e91",
"service": "Azure Blob Storage",
- "text": "적절한 로그 저장 위치를 선택하고 로그 보존 기간을 관리하여 리소스 로그 사용 비용을 줄입니다. 가끔씩만 로그를 쿼리하려는 경우(예: 규정 준수 감사를 위한 로그 쿼리) 리소스 로그를 Azure Monitor 로그 작업 영역으로 보내는 대신 스토리지 계정으로 보내는 것이 좋습니다. Azure Synapse Analytics와 같은 서버리스 쿼리 솔루션을 사용하여 로그를 분석할 수 있습니다. 자세한 내용은 자주 발생하지 않는 쿼리에 대한 비용 최적화를 참조하세요. 수명 주기 관리 정책을 사용하여 로그를 삭제하거나 보관합니다.",
+ "text": "적절한 로그 저장 위치를 선택하고 로그 보존 기간을 관리하여 리소스 로그 사용 비용을 줄입니다. 가끔씩만 로그를 쿼리하려는 경우(예: 규정 준수 감사를 위해 로그를 쿼리하는 경우) 리소스 로그를 Azure Monitor 로그 작업 영역으로 보내는 대신 스토리지 계정으로 보내는 것이 좋습니다. Azure Synapse Analytics와 같은 서버리스 쿼리 솔루션을 사용하여 로그를 분석할 수 있습니다. 자세한 내용은 자주 발생하지 않는 쿼리에 대한 비용 최적화를 참조하세요. 수명 주기 관리 정책을 사용하여 로그를 삭제하거나 보관합니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -142,7 +142,7 @@
"description": "Blob을 덮어쓸 때마다 새 스냅샷이 만들어집니다. 용량 요금 증가의 원인은 이러한 스냅샷의 생성이 로그에 표시되지 않기 때문에 액세스하기 어려울 수 있습니다. 용량 요금을 줄이려면 자주 덮어쓰는 데이터를 일시 삭제를 사용하지 않도록 설정된 별도의 스토리지 계정에 저장합니다. 보존 기간은 일시 삭제된 Blob이 쌓여 용량 비용에 추가되는 것을 방지합니다.",
"guid": "0d4d5fa0-eff6-4fff-88b1-17b542978ea1",
"service": "Azure Blob Storage",
- "text": "일시 삭제를 사용하도록 설정하는 경우 자주 덮어쓰는 Blob을 일시 삭제를 사용하도록 설정하지 않은 계정에 배치합니다. 보존 기간을 설정합니다. 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다.",
+ "text": "일시 삭제를 사용하도록 설정하는 경우 자주 덮어쓰는 Blob을 일시 삭제를 사용하도록 설정되지 않은 계정에 배치합니다. 보존 기간을 설정합니다. 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -171,7 +171,7 @@
"waf": "작업"
},
{
- "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드와 보고서를 쉽게 만들 수 있습니다.",
+ "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드 및 보고서를 쉽게 만들 수 있습니다.",
"guid": "a06df82c-98fb-4219-9708-6cb27a3b9c71",
"service": "Azure Blob Storage",
"text": "Storage 인사이트를 사용하여 스토리지 계정의 상태와 성능을 추적합니다. Storage 인사이트는 모든 스토리지 계정에 대한 오류, 성능, 가용성 및 용량에 대한 통합 보기를 제공합니다.",
@@ -179,7 +179,7 @@
"waf": "작업"
},
{
- "description": "스토리지 계정과 VM, 서비스 및 온-프레미스 클라이언트 간의 물리적 거리를 줄이면 성능이 향상되고 네트워크 대기 시간이 줄어들 수 있습니다. 물리적 거리를 줄이면 단일 지역 내의 대역폭 사용량이 무료이기 때문에 Azure에서 호스트되는 애플리케이션의 비용도 절감됩니다.",
+ "description": "스토리지 계정과 VM, 서비스 및 온-프레미스 클라이언트 간의 물리적 거리를 줄이면 성능이 향상되고 네트워크 대기 시간이 줄어들 수 있습니다. 물리적 거리를 줄이면 단일 지역 내의 대역폭 사용량이 무료이기 때문에 Azure에서 호스팅되는 애플리케이션의 비용도 절감됩니다.",
"guid": "5e724a0a-d268-47ae-9dcf-7ef18d870d1d",
"service": "Azure Blob Storage",
"text": "종속 리소스가 배치된 동일한 지역에 저장소 계정을 프로비전합니다. 모바일 디바이스 앱 또는 온-프레미스 엔터프라이즈 서비스와 같이 Azure에서 호스트되지 않는 애플리케이션의 경우 해당 클라이언트에 더 가까운 지역에서 스토리지 계정을 찾습니다. 자세한 내용은 Azure 지역을 참조하세요. 다른 지역의 클라이언트에 동일한 데이터가 필요하지 않은 경우 각 지역에서 별도의 계정을 만듭니다. 다른 지역의 클라이언트에 일부 데이터만 필요한 경우 개체 복제 정책을 사용하여 관련 개체를 다른 지역의 스토리지 계정에 비동기적으로 복사하는 것이 좋습니다.",
@@ -187,7 +187,7 @@
"waf": "공연"
},
{
- "description": "콘텐츠는 전 세계 수백 개의 글로벌 및 로컬 접속 지점과 함께 Microsoft 글로벌 에지 네트워크를 사용하기 때문에 클라이언트에게 더 빠르게 배달됩니다.",
+ "description": "콘텐츠는 전 세계 수백 개의 글로벌 및 로컬 접속 지점이 있는 Microsoft 글로벌 에지 네트워크를 사용하기 때문에 클라이언트에게 더 빠르게 제공됩니다.",
"guid": "4dea9363-c277-4793-b9e2-e8737aeb619f",
"service": "Azure Blob Storage",
"text": "웹 클라이언트(스트리밍 비디오, 오디오 또는 정적 웹 사이트 콘텐츠)에서 광범위하게 사용하려면 Azure Front Door를 통해 콘텐츠 배달 네트워크를 사용하는 것이 좋습니다.",
@@ -198,7 +198,7 @@
"description": "파티션 키의 시작 부분에 가장 가까운 해시 코드 또는 초 값을 사용하면 Blob을 나열, 쿼리 및 읽는 데 필요한 시간이 줄어듭니다.",
"guid": "cc147319-67cb-4737-ba01-285f3ebddcea",
"service": "Azure Blob Storage",
- "text": "Blob의 파티션 키에 가능한 한 빨리 해시 문자 시퀀스(예: 3자리 숫자)를 추가합니다. 파티션 키는 계정 이름, 컨테이너 이름, 가상 디렉터리 이름 및 Blob 이름입니다. 이름에 타임스탬프를 사용하려는 경우 해당 스탬프의 시작 부분에 초 값을 추가하는 것이 좋습니다. 자세한 내용은 Partitioning을 참조하십시오.",
+ "text": "가능한 한 빨리 Blob의 파티션 키에 해시 문자 시퀀스(예: 3자리 숫자)를 추가합니다. 파티션 키는 계정 이름, 컨테이너 이름, 가상 디렉터리 이름 및 Blob 이름입니다. 이름에 타임스탬프를 사용할 계획이라면 해당 스탬프의 시작 부분에 초 값을 추가하는 것이 좋습니다. 자세한 내용은 Partitioning을 참조하십시오.",
"type": "recommendation",
"waf": "공연"
},
@@ -214,7 +214,7 @@
"metadata": {
"name": "Azure Blob Storage Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -241,31 +241,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azureblobstorage_sg_checklist.pt.json b/checklists-ext/azureblobstorage_sg_checklist.pt.json
index ae0dc1cd3..627874ed3 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.pt.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.pt.json
@@ -214,7 +214,7 @@
"metadata": {
"name": "Azure Blob Storage Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -241,31 +241,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azureblobstorage_sg_checklist.zh-Hant.json b/checklists-ext/azureblobstorage_sg_checklist.zh-Hant.json
index 5cb3a7d2e..07ed991e5 100644
--- a/checklists-ext/azureblobstorage_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azureblobstorage_sg_checklist.zh-Hant.json
@@ -214,7 +214,7 @@
"metadata": {
"name": "Azure Blob Storage Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -241,31 +241,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azureexpressroute_sg_checklist.en.json b/checklists-ext/azureexpressroute_sg_checklist.en.json
index c87889e44..4289a5e23 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.en.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.en.json
@@ -269,6 +269,6 @@
"name": "Azure Expressroute Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azureexpressroute_sg_checklist.es.json b/checklists-ext/azureexpressroute_sg_checklist.es.json
index 80986837b..3ca71da1a 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.es.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.es.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "Durante la fase de planeación inicial, debe decidir si desea configurar un circuito ExpressRoute o una conexión ExpressRoute Direct. Un circuito ExpressRoute permite una conexión privada dedicada a Azure con la ayuda de un proveedor de conectividad. ExpressRoute Direct permite ampliar la red local directamente a la red de Microsoft en una ubicación de emparejamiento. También debe identificar el requisito de ancho de banda y el requisito de tipo de SKU para las necesidades de su negocio.",
+ "description": "Durante la fase de planeación inicial, debe decidir si desea configurar un circuito ExpressRoute o una conexión ExpressRoute Direct. Un circuito ExpressRoute permite una conexión dedicada privada a Azure con la ayuda de un proveedor de conectividad. ExpressRoute Direct permite extender la red local directamente a la red de Microsoft en una ubicación de emparejamiento. También debe identificar el requisito de ancho de banda y el requisito de tipo de SKU para las necesidades de su negocio.",
"guid": "e89fb4a5-9cdd-4fd5-bb8b-388dee7bc217",
"service": "Azure Expressroute",
"text": "Planeación del circuito ExpressRoute o ExpressRoute Direct",
@@ -11,7 +11,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Para planear la recuperación ante desastres, configure circuitos ExpressRoute en más de una ubicación de emparejamiento. Puede crear circuitos en ubicaciones de emparejamiento en el mismo metro o en diferentes áreas metropolitanas y elegir trabajar con diferentes proveedores de servicios para diversas rutas a través de cada circuito. Para obtener más información, consulte Diseño para la recuperación ante desastres y Diseño para alta disponibilidad.",
+ "description": "Para planear la recuperación ante desastres, configure circuitos ExpressRoute en más de una ubicación de emparejamiento. Puede crear circuitos en ubicaciones de emparejamiento en el mismo metro o en diferentes metros y elegir trabajar con diferentes proveedores de servicios para diversas rutas a través de cada circuito. Para obtener más información, consulte Diseño para la recuperación ante desastres y Diseño para alta disponibilidad.",
"guid": "14b83764-dab1-4741-85ee-7b3cf55cde49",
"service": "Azure Expressroute",
"text": "Planeación de circuitos con redundancia geográfica",
@@ -19,10 +19,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Este modo proporciona una mayor disponibilidad de las conexiones de Expressroute. También se recomienda configurar BFD para una conmutación por error más rápida si hay un error de vínculo en una conexión.",
+ "description": "Este modo proporciona una mayor disponibilidad de las conexiones de ExpressRoute. También se recomienda configurar BFD para una conmutación por error más rápida si hay un error de vínculo en una conexión.",
"guid": "f28fea39-a9e2-45ef-a711-997456c3d42c",
"service": "Azure Expressroute",
- "text": "Planeación de la conectividad Activo-Activo",
+ "text": "Planeación de la conectividad activo-activo",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -59,7 +59,7 @@
"waf": "Seguridad"
},
{
- "description": "Use Azure RBAC para configurar roles para limitar las cuentas de usuario que pueden agregar, actualizar o eliminar la configuración de emparejamiento en un circuito ExpressRoute.",
+ "description": "Use Azure RBAC para configurar roles que limiten las cuentas de usuario que pueden agregar, actualizar o eliminar la configuración de emparejamiento en un circuito ExpressRoute.",
"guid": "61fced7c-71af-4061-a73a-b880e8ee4f78",
"service": "Azure Expressroute",
"text": "Mantener el inventario de las cuentas administrativas",
@@ -67,7 +67,7 @@
"waf": "Seguridad"
},
{
- "description": "Durante la configuración del emparejamiento privado o del emparejamiento de Microsoft, aplique un hash MD5 para proteger los mensajes entre la ruta local y los enrutadores MSEE.",
+ "description": "Durante la configuración del emparejamiento privado o el emparejamiento de Microsoft, aplique un hash MD5 para proteger los mensajes entre la ruta local y los enrutadores MSEE.",
"guid": "7091a086-8128-45f8-81e6-c93548433b87",
"service": "Azure Expressroute",
"text": "Configuración del hash MD5 en el circuito ExpressRoute",
@@ -75,7 +75,7 @@
"waf": "Seguridad"
},
{
- "description": "La seguridad de control de acceso a medios es una seguridad punto a punto en la capa de enlace de datos. ExpressRoute Direct admite la configuración de MACSec para evitar amenazas de seguridad a protocolos como ARP, DHCP, LACP que normalmente no están protegidos en el vínculo Ethernet. Para obtener más información sobre cómo configurar MACSec, consulte MACSec para puertos ExpressRoute Direct.",
+ "description": "La seguridad del control de acceso a medios es una seguridad punto a punto en la capa de enlace de datos. ExpressRoute Direct admite la configuración de MACSec para evitar amenazas de seguridad a protocolos como ARP, DHCP, LACP que normalmente no están protegidos en el vínculo Ethernet. Para obtener más información sobre cómo configurar MACSec, consulte MACSec para puertos ExpressRoute Direct.",
"guid": "90d32454-fcb9-496d-a411-166a2fe50b6b",
"service": "Azure Expressroute",
"text": "Configuración de MACSec para recursos de ExpressRoute Direct",
@@ -99,7 +99,7 @@
"waf": "Costar"
},
{
- "description": "La forma en que se le cobra por el uso de ExpressRoute varía entre los tres tipos de SKU diferentes. Con el SKU local, se te cobra automáticamente un plan de datos ilimitados. Con los SKU Estándar y Premium, puedes elegir entre un plan de datos medido o ilimitado. Todos los datos de entrada son gratuitos, excepto cuando se utiliza el complemento Global Reach. Es importante comprender qué tipos de SKU y plan de datos funcionan mejor para su carga de trabajo para optimizar mejor el costo y el presupuesto. Para obtener más información sobre cómo cambiar el tamaño del circuito ExpressRoute, consulte Actualización del ancho de banda del circuito ExpressRoute.",
+ "description": "La forma en que se le cobra por el uso de ExpressRoute varía entre los tres tipos de SKU diferentes. Con el SKU local, se te cobra automáticamente un plan de datos ilimitados. Con los SKU Estándar y Premium, puedes seleccionar entre un plan de datos medido o ilimitado. Todos los datos de entrada son gratuitos, excepto cuando se utiliza el complemento Global Reach. Es importante comprender qué tipos de SKU y plan de datos funcionan mejor para su carga de trabajo para optimizar mejor el costo y el presupuesto. Para obtener más información sobre cómo cambiar el tamaño del circuito ExpressRoute, consulte Actualización del ancho de banda del circuito ExpressRoute.",
"guid": "18ef72cd-862c-43e8-b9ee-921fb5f079f0",
"service": "Azure Expressroute",
"text": "Determinar la SKU y el ancho de banda necesarios",
@@ -107,7 +107,7 @@
"waf": "Costar"
},
{
- "description": "Las puertas de enlace de red virtual de ExpressRoute se usan para pasar tráfico a una red virtual a través del emparejamiento privado. Revise las necesidades de rendimiento y escalado de su SKU de puerta de enlace de red virtual preferida. Seleccione la SKU de puerta de enlace adecuada en la carga de trabajo local a Azure.",
+ "description": "Las puertas de enlace de red virtual de ExpressRoute se usan para pasar tráfico a una red virtual a través del emparejamiento privado. Revise las necesidades de rendimiento y escala de la SKU de puerta de enlace de red virtual preferida. Seleccione la SKU de puerta de enlace adecuada en la carga de trabajo local a Azure.",
"guid": "3655e3bc-9d56-47f6-b7bc-c1a568aa3c8a",
"service": "Azure Expressroute",
"text": "Determinación del tamaño de la puerta de enlace de red virtual de ExpressRoute",
@@ -123,15 +123,15 @@
"waf": "Costar"
},
{
- "description": "Los circuitos ExpressRoute se cobran desde el momento en que se crean. Para reducir costos innecesarios, desaprovisione el circuito con el proveedor de servicios y elimine el circuito ExpressRoute de la suscripción. Para conocer los pasos sobre cómo quitar un circuito ExpressRoute, consulte Desaprovisionamiento de un circuito ExpressRoute.",
+ "description": "Los circuitos ExpressRoute se cargan desde el momento en que se crean. Para reducir el costo innecesario, desaprovisione el circuito con el proveedor de servicios y elimine el circuito ExpressRoute de la suscripción. Para conocer los pasos sobre cómo quitar un circuito ExpressRoute, consulte Desaprovisionamiento de un circuito ExpressRoute.",
"guid": "ca8f1e36-5762-4510-b0af-5a073cc9185a",
"service": "Azure Expressroute",
- "text": "Desaprovisionar y eliminar circuitos ExpressRoute que ya no estén en uso.",
+ "text": "Desaprovisionar y eliminar los circuitos ExpressRoute que ya no están en uso.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "La supervisión de conexiones permite supervisar la conectividad entre los recursos locales y Azure a través del emparejamiento privado de ExpressRoute y la conexión de emparejamiento de Microsoft. El monitor de conexión puede detectar problemas de red identificando en qué parte de la ruta de red se encuentra el problema y ayudarlo a resolver rápidamente fallas de configuración o hardware.",
+ "description": "La supervisión de conexiones permite supervisar la conectividad entre los recursos locales y Azure a través del emparejamiento privado de ExpressRoute y la conexión de emparejamiento de Microsoft. El monitor de conexión puede detectar problemas de red identificando en qué parte de la ruta de red se encuentra el problema y ayudarlo a resolver rápidamente errores de configuración o hardware.",
"guid": "c1dcf762-0191-4963-89d7-3cc1df34b653",
"service": "Azure Expressroute",
"text": "Configurar la supervisión de conexiones",
@@ -139,7 +139,7 @@
"waf": "Operaciones"
},
{
- "description": "Configure las notificaciones de estado del servicio para alertar cuando se produzca un mantenimiento planeado y próximo en todos los circuitos ExpressRoute de la suscripción. El estado del servicio también muestra el mantenimiento anterior junto con el RCA si se produjera un mantenimiento no planeado.",
+ "description": "Configure las notificaciones de estado del servicio para avisar cuando se produzca un mantenimiento planeado y próximo en todos los circuitos ExpressRoute de la suscripción. El estado del servicio también muestra el mantenimiento anterior junto con el RCA si se produjera un mantenimiento no planeado.",
"guid": "60f840b9-1818-4967-a115-68e90f47daf3",
"service": "Azure Expressroute",
"text": "Configurar el estado del servicio",
@@ -147,15 +147,15 @@
"waf": "Operaciones"
},
{
- "description": "ExpressRoute Insights con Network Insights le permite revisar y analizar circuitos, puertas de enlace, métricas de conexiones y paneles de estado de ExpressRoute. ExpressRoute Insights también proporciona una vista de topología de las conexiones de ExpressRoute en la que puede ver los detalles de los componentes de emparejamiento en un solo lugar. Métricas disponibles:- Disponibilidad- Rendimiento- Métricas de puerta de enlace",
+ "description": "ExpressRoute Insights con Network Insights le permite revisar y analizar circuitos, puertas de enlace, métricas de conexiones y paneles de estado de ExpressRoute. ExpressRoute Insights también proporciona una vista de topología de las conexiones de ExpressRoute en la que puede ver los detalles de los componentes del emparejamiento, todo en un solo lugar. Métricas disponibles:- Disponibilidad- Rendimiento- Métricas de puerta de enlace",
"guid": "c3c5fe66-1901-4786-99ea-845944bd6ca3",
"service": "Azure Expressroute",
- "text": "Revisión de métricas con Network Insights",
+ "text": "Revise las métricas con Network Insights",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "ExpressRoute usa Azure Monitor para recopilar métricas y crear alertas basadas en la configuración. Las métricas se recopilan para los circuitos ExpressRoute, las puertas de enlace de ExpressRoute, las conexiones de puerta de enlace de ExpressRoute y ExpressRoute Direct. Estas métricas son útiles para diagnosticar problemas de conectividad y comprender el rendimiento de la conexión de ExpressRoute.",
+ "description": "ExpressRoute usa Azure Monitor para recopilar métricas y crear alertas en función de la configuración. Las métricas se recopilan para los circuitos ExpressRoute, las puertas de enlace de ExpressRoute, las conexiones de puerta de enlace de ExpressRoute y ExpressRoute Direct. Estas métricas son útiles para diagnosticar problemas de conectividad y comprender el rendimiento de la conexión de ExpressRoute.",
"guid": "03914313-6287-41c4-9e4a-4980c2ee3aa9",
"service": "Azure Expressroute",
"text": "Revisión de las métricas de recursos de ExpressRoute",
@@ -163,7 +163,7 @@
"waf": "Operaciones"
},
{
- "description": "Use Azure Connectivity Toolkit para probar el rendimiento en el circuito ExpressRoute a fin de comprender la capacidad de ancho de banda y la latencia de la conexión de red.",
+ "description": "Use Azure Connectivity Toolkit para probar el rendimiento en el circuito ExpressRoute para comprender la capacidad de ancho de banda y la latencia de la conexión de red.",
"guid": "07fac8bb-13c5-44b8-a4e8-7e2ed1a84b48",
"service": "Azure Expressroute",
"text": "Pruebe el rendimiento de la puerta de enlace de ExpressRoute para cumplir los requisitos de carga de trabajo.",
@@ -198,7 +198,7 @@
"description": "Configure alertas basadas en métricas de ExpressRoute para que le notifiquen de forma proactiva cuando se alcance un umbral determinado. Estas métricas son útiles para comprender las anomalías que pueden producirse con la conexión de ExpressRoute, como las interrupciones y el mantenimiento que se producen en los circuitos de ExpressRoute.",
"guid": "4a0e8302-106d-48a3-abc4-9e4875a48309",
"service": "Azure Expressroute",
- "text": "Supervisión de las métricas de circuitos y puertas de enlace de ExpressRoute",
+ "text": "Supervisión de métricas de circuitos y puertas de enlace de ExpressRoute",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -206,7 +206,7 @@
"metadata": {
"name": "Azure Expressroute Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -233,31 +233,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azureexpressroute_sg_checklist.ja.json b/checklists-ext/azureexpressroute_sg_checklist.ja.json
index 8ea2637e3..0ccddb43a 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.ja.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.ja.json
@@ -206,7 +206,7 @@
"metadata": {
"name": "Azure Expressroute Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -233,31 +233,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azureexpressroute_sg_checklist.ko.json b/checklists-ext/azureexpressroute_sg_checklist.ko.json
index 0519007a6..53054f855 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.ko.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.ko.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "초기 계획 단계에서 ExpressRoute 회로를 구성할지 아니면 ExpressRoute Direct 연결을 구성할지 결정하려고 합니다. ExpressRoute 회로를 사용하면 연결 공급자의 도움을 받아 Azure에 대한 프라이빗 전용 연결을 사용할 수 있습니다. ExpressRoute Direct를 사용하면 피어링 위치의 Microsoft 네트워크로 온-프레미스 네트워크를 직접 확장할 수 있습니다. 또한 비즈니스 요구 사항에 대한 대역폭 요구 사항 및 SKU 유형 요구 사항을 식별해야 합니다.",
+ "description": "초기 계획 단계에서 ExpressRoute 회로를 구성할지 또는 ExpressRoute Direct 연결을 구성할지 결정하려고 합니다. ExpressRoute 회로를 사용하면 연결 공급자의 도움을 받아 Azure에 대한 프라이빗 전용 연결을 사용할 수 있습니다. ExpressRoute Direct를 사용하면 피어링 위치의 Microsoft 네트워크로 온-프레미스 네트워크를 직접 확장할 수 있습니다. 또한 비즈니스 요구 사항에 대한 대역폭 요구 사항 및 SKU 유형 요구 사항을 식별해야 합니다.",
"guid": "e89fb4a5-9cdd-4fd5-bb8b-388dee7bc217",
"service": "Azure Expressroute",
"text": "ExpressRoute 회로 또는 ExpressRoute Direct 계획",
@@ -11,7 +11,7 @@
"waf": "신뢰도"
},
{
- "description": "재해 복구를 계획하려면 둘 이상의 피어링 위치에서 ExpressRoute 회로를 설정합니다. 동일한 메트로 또는 다른 메트로의 피어링 위치에 회로를 만들고 각 회로를 통한 다양한 경로에 대해 다른 서비스 공급자와 협력하도록 선택할 수 있습니다. 자세한 내용은 재해 복구를 위한 설계 및 고가용성을 위한 설계를 참조하세요.",
+ "description": "재해 복구를 계획하려면 둘 이상의 피어링 위치에서 ExpressRoute 회로를 설정합니다. 동일한 메트로 또는 다른 메트로의 피어링 위치에 회로를 만들고 각 회로를 통한 다양한 경로에 대해 다른 서비스 공급자와 협력하도록 선택할 수 있습니다. 자세한 내용은 재해 복구를 위한 디자인 및 고가용성을 위한 디자인을 참조하세요.",
"guid": "14b83764-dab1-4741-85ee-7b3cf55cde49",
"service": "Azure Expressroute",
"text": "지역 중복 회로 계획Plan for geo-redundant circuits",
@@ -19,7 +19,7 @@
"waf": "신뢰도"
},
{
- "description": "이 모드는 Expressroute 연결의 고가용성을 제공합니다. 또한 연결에 링크 오류가 있는 경우 더 빠른 장애 조치(failover)를 위해 BFD를 구성하는 것이 좋습니다.",
+ "description": "이 모드는 Expressroute 연결의 고가용성을 제공합니다. 또한 연결에 링크 장애가 있는 경우 더 빠른 장애 조치(failover)를 위해 BFD를 구성하는 것이 좋습니다.",
"guid": "f28fea39-a9e2-45ef-a711-997456c3d42c",
"service": "Azure Expressroute",
"text": "액티브-액티브 연결 계획",
@@ -27,7 +27,7 @@
"waf": "신뢰도"
},
{
- "description": "복원력을 높이기 위해 가용성 영역 인식 Virtual Network Gateway를 만들고 복원력, 재해 복구 및 고가용성을 위해 여러 지역의 Virtual Network 게이트웨이를 계획합니다.",
+ "description": "복원력을 높이기 위해 가용성 영역 인식 Virtual Network Gateway를 만들고 복원력, 재해 복구 및 고가용성을 위해 다른 지역의 Virtual Network Gateway를 계획합니다.",
"guid": "8e29e63c-2da5-4242-8a86-c7083b231b0f",
"service": "Azure Expressroute",
"text": "가상 네트워크 게이트웨이 계획",
@@ -43,7 +43,7 @@
"waf": "신뢰도"
},
{
- "description": "ExpressRoute는 서비스 상태를 사용하여 계획된 유지 관리 및 계획되지 않은 유지 관리에 대해 알립니다. 서비스 상태를 구성하면 ExpressRoute 회로에 대한 변경 내용에 대해 알려줍니다.",
+ "description": "ExpressRoute는 서비스 상태를 사용하여 계획된 유지 관리 및 계획되지 않은 유지 관리에 대해 알립니다. 서비스 상태를 구성하면 ExpressRoute 회로에 대한 변경 내용에 대해 알림을 받습니다.",
"guid": "c7bf09c0-317f-4f7f-be8d-3d74444757c8",
"service": "Azure Expressroute",
"text": "서비스 상태 사용",
@@ -54,7 +54,7 @@
"description": "활동 로그는 ExpressRoute 리소스에 대한 구독 수준에서 수행된 작업에 대한 인사이트를 제공합니다. 활동 로그를 사용하면 컨트롤 플레인에서 작업이 수행된 사람과 시간을 확인할 수 있습니다. 데이터 보존 기간은 90일이며 Log Analytics, Event Hubs 또는 보관용 스토리지 계정에 저장해야 합니다.",
"guid": "b1f76928-0fc3-407e-8658-f93f2812873f",
"service": "Azure Expressroute",
- "text": "로그를 보관으로 보내도록 활동 로그 구성",
+ "text": "로그를 보관하도록 활동 로그 구성",
"type": "recommendation",
"waf": "안전"
},
@@ -75,7 +75,7 @@
"waf": "안전"
},
{
- "description": "미디어 액세스 제어 보안은 데이터 링크 계층의 지점 간 보안입니다. ExpressRoute Direct는 이더넷 링크에서 일반적으로 보안되지 않는 ARP, DHCP, LACP와 같은 프로토콜에 대한 보안 위협을 방지하기 위해 MACSec 구성을 지원합니다. MACSec을 구성하는 방법에 대한 자세한 내용은 ExpressRoute Direct 포트에 대한 MACSec을 참조하세요.",
+ "description": "Media Access Control 보안은 데이터 링크 계층의 지점 간 보안입니다. ExpressRoute Direct는 이더넷 링크에서 일반적으로 보안되지 않는 ARP, DHCP, LACP와 같은 프로토콜에 대한 보안 위협을 방지하기 위해 MACSec 구성을 지원합니다. MACSec을 구성하는 방법에 대한 자세한 내용은 ExpressRoute Direct 포트에 대한 MACSec을 참조하세요.",
"guid": "90d32454-fcb9-496d-a411-166a2fe50b6b",
"service": "Azure Expressroute",
"text": "ExpressRoute Direct 리소스에 대한 MACSec 구성",
@@ -94,12 +94,12 @@
"description": "ExpressRoute 가격 책정에 대한 자세한 내용은 Azure ExpressRoute의 가격 책정 이해를 참조하세요. 가격 계산기를 사용할 수도 있습니다. 용량 수요를 충족하고 리소스 낭비 없이 예상 성능을 제공할 수 있도록 옵션의 크기가 적절하게 조정되었는지 확인합니다.",
"guid": "8ae8772a-7131-42f9-9d2f-ce2aa5bcdd2b",
"service": "Azure Expressroute",
- "text": "ExpressRoute 가격 책정 숙지",
+ "text": "ExpressRoute 가격 책정에 대해 숙지하기",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "ExpressRoute 사용량에 대한 요금이 청구되는 방식은 세 가지 SKU 유형에 따라 다릅니다. 현지 SKU를 사용하면 무제한 데이터 요금제가 자동으로 청구됩니다. 표준 및 프리미엄 SKU를 사용하면 데이터 요금제 또는 무제한 요금제 중에서 선택할 수 있습니다. 모든 수신 데이터는 Global Reach 추가 기능을 사용하는 경우를 제외하고 무료입니다. 비용과 예산을 가장 잘 최적화하려면 워크로드에 가장 적합한 SKU 유형 및 데이터 요금제를 이해하는 것이 중요합니다. ExpressRoute 회로 크기 조정에 대한 자세한 내용은 ExpressRoute 회로 대역폭 업그레이드를 참조하세요.",
+ "description": "ExpressRoute 사용량에 대한 요금이 청구되는 방식은 세 가지 SKU 유형에 따라 다릅니다. 현지 SKU를 사용하면 무제한 데이터 요금제가 자동으로 청구됩니다. 표준 및 프리미엄 SKU를 사용하면 데이터 요금제 또는 무제한 요금제 중에서 선택할 수 있습니다. 모든 수신 데이터는 Global Reach 추가 기능을 사용하는 경우를 제외하고는 무료입니다. 비용과 예산을 가장 잘 최적화하려면 워크로드에 가장 적합한 SKU 유형 및 데이터 요금제를 이해하는 것이 중요합니다. ExpressRoute 회로 크기 조정에 대한 자세한 내용은 ExpressRoute 회로 대역폭 업그레이드를 참조하세요.",
"guid": "18ef72cd-862c-43e8-b9ee-921fb5f079f0",
"service": "Azure Expressroute",
"text": "필요한 SKU 및 대역폭 확인",
@@ -107,7 +107,7 @@
"waf": "비용"
},
{
- "description": "ExpressRoute 가상 네트워크 게이트웨이는 개인 피어링을 통해 가상 네트워크로 트래픽을 전달하는 데 사용됩니다. 선호하는 Virtual Network Gateway SKU의 성능 및 크기 조정 요구 사항을 검토합니다. 온-프레미스에서 Azure 워크로드로 적절한 게이트웨이 SKU를 선택합니다.",
+ "description": "ExpressRoute 가상 네트워크 게이트웨이는 개인 피어링을 통해 가상 네트워크로 트래픽을 전달하는 데 사용됩니다. 선호하는 Virtual Network Gateway SKU의 성능 및 크기 조정 요구 사항을 검토합니다. 온-프레미스에서 Azure로 워크로드에서 적절한 게이트웨이 SKU를 선택합니다.",
"guid": "3655e3bc-9d56-47f6-b7bc-c1a568aa3c8a",
"service": "Azure Expressroute",
"text": "ExpressRoute 가상 네트워크 게이트웨이 크기 확인",
@@ -126,7 +126,7 @@
"description": "ExpressRoute 회로는 만들어지는 순간부터 요금이 청구됩니다. 불필요한 비용을 줄이려면 서비스 공급자를 통해 회로의 프로비전을 해제하고 구독에서 ExpressRoute 회로를 삭제합니다. ExpressRoute 회로를 제거하는 방법에 대한 단계는 ExpressRoute 회로 프로비전 해제를 참조하세요.",
"guid": "ca8f1e36-5762-4510-b0af-5a073cc9185a",
"service": "Azure Expressroute",
- "text": "더 이상 사용되지 않는 ExpressRoute 회로를 프로비전 해제하고 삭제합니다.",
+ "text": "더 이상 사용되지 않는 ExpressRoute 회로의 프로비전을 해제하고 삭제합니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -139,7 +139,7 @@
"waf": "작업"
},
{
- "description": "Service Health 알림을 설정하여 구독의 모든 ExpressRoute 회로에 계획된 유지 관리 및 예정된 유지 관리가 발생할 때 경고합니다. 또한 Service Health는 계획되지 않은 유지 관리가 발생하는 경우 RCA와 함께 과거 유지 관리를 표시합니다.",
+ "description": "Service Health 알림을 설정하여 계획된 유지 관리 및 예정된 유지 관리가 구독의 모든 ExpressRoute 회로에 발생할 때 경고합니다. 또한 Service Health는 계획되지 않은 유지 관리가 발생하는 경우 RCA와 함께 과거 유지 관리를 표시합니다.",
"guid": "60f840b9-1818-4967-a115-68e90f47daf3",
"service": "Azure Expressroute",
"text": "서비스 상태 구성",
@@ -147,7 +147,7 @@
"waf": "작업"
},
{
- "description": "Network Insights를 사용하는 ExpressRoute Insights를 사용하면 ExpressRoute 회로, 게이트웨이, 연결 메트릭 및 상태 대시보드를 검토하고 분석할 수 있습니다. 또한 ExpressRoute Insights는 피어링 구성 요소의 세부 정보를 모두 한 곳에서 볼 수 있는 ExpressRoute 연결의 토폴로지 보기를 제공합니다. 사용 가능한 메트릭:- 가용성- 처리량- 게이트웨이 메트릭",
+ "description": "네트워크 인사이트를 사용하는 ExpressRoute Insights를 사용하면 ExpressRoute 회로, 게이트웨이, 연결 메트릭 및 상태 대시보드를 검토하고 분석할 수 있습니다. 또한 ExpressRoute Insights는 피어링 구성 요소의 세부 정보를 모두 한 곳에서 볼 수 있는 ExpressRoute 연결의 토폴로지 보기를 제공합니다. 사용 가능한 메트릭:- 가용성- 처리량- 게이트웨이 메트릭",
"guid": "c3c5fe66-1901-4786-99ea-845944bd6ca3",
"service": "Azure Expressroute",
"text": "Network Insights로 메트릭 검토",
@@ -163,7 +163,7 @@
"waf": "작업"
},
{
- "description": "Azure Connectivity Toolkit를 사용하여 ExpressRoute 회로에서 성능을 테스트하여 네트워크 연결의 대역폭, 용량 및 대기 시간을 파악합니다.",
+ "description": "Azure Connectivity Toolkit을 사용하여 ExpressRoute 회로에서 성능을 테스트하여 네트워크 연결의 대역폭 용량 및 대기 시간을 파악합니다.",
"guid": "07fac8bb-13c5-44b8-a4e8-7e2ed1a84b48",
"service": "Azure Expressroute",
"text": "ExpressRoute 게이트웨이 성능을 테스트하여 작업 부하 요구 사항을 충족합니다.",
@@ -171,7 +171,7 @@
"waf": "공연"
},
{
- "description": "온-프레미스와 Azure 환경 간의 처리량 성능 향상을 위해 더 높은 게이트웨이 SKU로 업그레이드합니다.",
+ "description": "온-프레미스와 Azure 환경 간의 처리량 성능을 향상시키기 위해 더 높은 게이트웨이 SKU로 업그레이드합니다.",
"guid": "7f788e1a-71dd-4a3e-b19f-6bd8ef8ad815",
"service": "Azure Expressroute",
"text": "ExpressRoute 게이트웨이의 크기를 늘립니다.",
@@ -187,15 +187,15 @@
"waf": "공연"
},
{
- "description": "Ultra 성능 또는 ErGW3AZ 가상 네트워크 게이트웨이를 사용하는 경우 FastPath를 사용하도록 설정하여 온-프레미스 네트워크와 Azure 가상 네트워크 간의 데이터 경로 성능을 향상시킬 수 있습니다.",
+ "description": "울트라 성능 또는 ErGW3AZ 가상 네트워크 게이트웨이를 사용하는 경우 FastPath를 사용하도록 설정하여 온-프레미스 네트워크와 Azure 가상 네트워크 간의 데이터 경로 성능을 향상시킬 수 있습니다.",
"guid": "ef778b99-5006-4adf-bef1-d709456a4c51",
"service": "Azure Expressroute",
- "text": "처리량을 높이기 위해 ExpressRoute FastPath 사용",
+ "text": "처리량 증가를 위해 ExpressRoute FastPath 사용",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "특정 임계값에 도달할 때 사전에 알리도록 ExpressRoute 메트릭을 기반으로 경고를 설정합니다. 이러한 메트릭은 ExpressRoute 회로에서 발생하는 중단 및 유지 관리와 같이 ExpressRoute 연결에서 발생할 수 있는 변칙을 이해하는 데 유용합니다.",
+ "description": "특정 임계값이 충족될 때 사전에 알리도록 ExpressRoute 메트릭을 기반으로 경고를 설정합니다. 이러한 메트릭은 ExpressRoute 회로에서 발생하는 중단 및 유지 관리와 같이 ExpressRoute 연결에서 발생할 수 있는 변칙을 이해하는 데 유용합니다.",
"guid": "4a0e8302-106d-48a3-abc4-9e4875a48309",
"service": "Azure Expressroute",
"text": "ExpressRoute 회로 및 게이트웨이 메트릭 모니터링",
@@ -206,7 +206,7 @@
"metadata": {
"name": "Azure Expressroute Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -233,31 +233,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azureexpressroute_sg_checklist.pt.json b/checklists-ext/azureexpressroute_sg_checklist.pt.json
index e56cb2ff6..db049d516 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.pt.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.pt.json
@@ -206,7 +206,7 @@
"metadata": {
"name": "Azure Expressroute Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -233,31 +233,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azureexpressroute_sg_checklist.zh-Hant.json b/checklists-ext/azureexpressroute_sg_checklist.zh-Hant.json
index 2139a912e..389ad9fd6 100644
--- a/checklists-ext/azureexpressroute_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azureexpressroute_sg_checklist.zh-Hant.json
@@ -206,7 +206,7 @@
"metadata": {
"name": "Azure Expressroute Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -233,31 +233,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azurefiles_sg_checklist.en.json b/checklists-ext/azurefiles_sg_checklist.en.json
index 979d7c5a8..86157f3ec 100644
--- a/checklists-ext/azurefiles_sg_checklist.en.json
+++ b/checklists-ext/azurefiles_sg_checklist.en.json
@@ -301,6 +301,6 @@
"name": "Azure Files Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azurefiles_sg_checklist.es.json b/checklists-ext/azurefiles_sg_checklist.es.json
index 71bb3cffc..4dc68caaa 100644
--- a/checklists-ext/azurefiles_sg_checklist.es.json
+++ b/checklists-ext/azurefiles_sg_checklist.es.json
@@ -22,7 +22,7 @@
"description": "La eliminación temporal funciona en un nivel de recurso compartido de archivos para proteger los recursos compartidos de archivos de Azure frente a la eliminación accidental. La restauración a un momento dado protege contra la eliminación accidental o los daños, ya que puede restaurar los recursos compartidos de archivos a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
"guid": "8f7b75e8-8b14-44ce-b4a5-3e994995479d",
"service": "Azure Files",
- "text": "Como parte de su estrategia de copia de seguridad y recuperación, habilite la eliminación temporal y use instantáneas para la restauración a un momento dado. Puede usar Azure Backup para realizar una copia de seguridad de los recursos compartidos de archivos SMB. También puede usar Azure File Sync para realizar copias de seguridad de recursos compartidos de archivos SMB locales en un recurso compartido de archivos de Azure. Azure Backup también le permite realizar una copia de seguridad almacenada (versión preliminar) de Azure Files para proteger sus datos de ataques de ransomware o pérdida de datos de origen debido a un actor malintencionado o un administrador no autorizado. Mediante el uso de la copia de seguridad almacenada, Azure Backup copia y almacena los datos en el almacén de Recovery Services. Esto crea una copia externa de los datos que puede conservar durante un máximo de 99 años. Azure Backup crea y administra los puntos de recuperación según la programación y la retención definidas en la directiva de copia de seguridad. Aprende más.",
+ "text": "Como parte de su estrategia de copia de seguridad y recuperación, habilite la eliminación temporal y use instantáneas para la restauración a un momento dado. Puede usar Azure Backup para realizar copias de seguridad de los recursos compartidos de archivos SMB. También puede usar Azure File Sync para realizar copias de seguridad de recursos compartidos de archivos SMB locales en un recurso compartido de archivos de Azure. Azure Backup también le permite realizar una copia de seguridad almacenada (versión preliminar) de Azure Files para proteger sus datos de ataques de ransomware o pérdida de datos de origen debido a un actor malintencionado o un administrador no autorizado. Mediante la copia de seguridad almacenada, Azure Backup copia y almacena los datos en el almacén de Recovery Services. Esto crea una copia externa de los datos que puede conservar durante un máximo de 99 años. Azure Backup crea y administra los puntos de recuperación según la programación y la retención definidas en la directiva de copia de seguridad. Aprende más.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -43,10 +43,10 @@
"waf": "Seguridad"
},
{
- "description": "SMB 1 es un protocolo anticuado, ineficiente e inseguro. Desactívelo en los clientes para mejorar su posición de seguridad.",
+ "description": "SMB 1 es un protocolo obsoleto, ineficiente e inseguro. Desactívelo en los clientes para mejorar su posición de seguridad.",
"guid": "6ad18c63-4c63-45c3-b002-5b305235c439",
"service": "Azure Files",
- "text": "Si abre el puerto 445, asegúrese de deshabilitar SMBv1 en clientes Windows y Linux. Azure Files no es compatible con SMB 1, pero aún así debe deshabilitarlo en sus clientes.",
+ "text": "Si abre el puerto 445, asegúrese de deshabilitar SMBv1 en clientes Windows y Linux. Azure Files no es compatible con SMB 1, pero debe deshabilitarlo en los clientes.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -54,15 +54,15 @@
"description": "El tráfico de red viaja a través de la red troncal de Microsoft en lugar de la red pública de Internet, lo que elimina la exposición al riesgo de la red pública de Internet.",
"guid": "0291451b-94f7-4f9c-a479-48c142e6c208",
"service": "Azure Files",
- "text": "Considere la posibilidad de deshabilitar el acceso de red pública a la cuenta de almacenamiento. Habilite el acceso a la red pública solo si los clientes y servicios SMB externos a Azure requieren acceso a la cuenta de almacenamiento. Si deshabilita el acceso a la red pública, cree un punto de conexión privado para la cuenta de almacenamiento. Se aplican tarifas de procesamiento de datos estándar para puntos de conexión privados. Un punto de conexión privado no bloquea las conexiones al punto de conexión público. De todos modos, debe deshabilitar el acceso a la red pública como se describió anteriormente. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso de los puntos de conexión públicos a redes virtuales y direcciones IP específicas.",
+ "text": "Considere la posibilidad de deshabilitar el acceso de red pública a la cuenta de almacenamiento. Habilite el acceso a la red pública solo si los clientes y servicios SMB externos a Azure requieren acceso a la cuenta de almacenamiento. Si deshabilita el acceso a la red pública, cree un punto de conexión privado para la cuenta de almacenamiento. Se aplican las tarifas estándar de procesamiento de datos para los puntos de conexión privados. Un punto de conexión privado no bloquea las conexiones al punto de conexión público. De todos modos, debe deshabilitar el acceso a la red pública como se describió anteriormente. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso del punto de conexión público a redes virtuales y direcciones IP específicas.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Minimice el riesgo de crear oportunidades para los atacantes.",
+ "description": "Minimice el riesgo de crear aperturas para los atacantes.",
"guid": "28051b58-caf9-415f-ab61-daa7c3bf37c5",
"service": "Azure Files",
- "text": "Habilite reglas de firewall que limiten el acceso a redes virtuales específicas. Comience con acceso cero y, a continuación, proporcione de forma metódica e incremental la menor cantidad de acceso necesaria para los clientes y servicios.",
+ "text": "Habilite reglas de firewall que limiten el acceso a redes virtuales específicas. Comience con acceso cero y, a continuación, proporcione de forma metódica e incremental la menor cantidad de acceso necesaria para los clientes y los servicios.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -70,7 +70,7 @@
"description": "Use la autenticación basada en identidad para reducir la posibilidad de que un atacante use una clave de cuenta de almacenamiento para acceder a los recursos compartidos de archivos.",
"guid": "fa742663-b3d8-4808-a5bb-213c9f4ae78b",
"service": "Azure Files",
- "text": "Cuando sea posible, use la autenticación basada en identidad con el cifrado de vales AES-256 Kerberos para autorizar el acceso a los recursos compartidos de archivos de Azure SMB.",
+ "text": "Cuando sea posible, use la autenticación basada en identidad con el cifrado de vales Kerberos AES-256 para autorizar el acceso a los recursos compartidos de archivos de Azure SMB.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -83,10 +83,10 @@
"waf": "Seguridad"
},
{
- "description": "Esta configuración garantiza que todas las solicitudes que se realicen en la cuenta de almacenamiento se realicen a través de conexiones seguras (HTTPS). Se producirá un error en cualquier solicitud realizada a través de HTTP.",
+ "description": "Esta configuración garantiza que todas las solicitudes que se realicen en la cuenta de almacenamiento se realicen a través de conexiones seguras (HTTPS). Se producirá un error en todas las solicitudes realizadas a través de HTTP.",
"guid": "ad87891d-330d-4482-abd0-938ff9e700cc",
"service": "Azure Files",
- "text": "En la mayoría de los casos, debe habilitar la opción Transferencia segura necesaria en todas las cuentas de almacenamiento para habilitar el cifrado en tránsito para los recursos compartidos de archivos SMB. No habilite esta opción si necesita permitir que clientes muy antiguos accedan al recurso compartido. Si deshabilita la transferencia segura, asegúrese de usar los controles de red para restringir el tráfico.",
+ "text": "En la mayoría de los casos, debe habilitar la opción Transferencia segura necesaria en todas las cuentas de almacenamiento para habilitar el cifrado en tránsito para los recursos compartidos de archivos SMB. No habilite esta opción si necesita permitir que clientes muy antiguos accedan al recurso compartido. Si deshabilita la transferencia segura, asegúrese de usar controles de red para restringir el tráfico.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -126,12 +126,12 @@
"description": "El tráfico de red viaja a través de la red troncal de Microsoft en lugar de la red pública de Internet, lo que elimina la exposición al riesgo de la red pública de Internet.",
"guid": "d3fffd01-afd2-4654-94cf-b971a379cb1e",
"service": "Azure Files",
- "text": "Solo se puede acceder a los recursos compartidos de archivos de Azure de NFS a través de redes restringidas. Por lo tanto, debe crear un punto de conexión privado para la cuenta de almacenamiento o restringir el acceso del punto de conexión público a las redes virtuales y direcciones IP seleccionadas. Se recomienda crear un punto de conexión privado. Debe configurar la seguridad de nivel de red para los recursos compartidos de NFS, ya que Azure Files no admite el cifrado en tránsito con el protocolo NFS. Debe deshabilitar la opción Requerir transferencia segura en la cuenta de almacenamiento para usar recursos compartidos de archivos de Azure NFS. Se aplican tarifas estándar de procesamiento de datos para los puntos de conexión privados. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso a los puntos de conexión públicos.",
+ "text": "Solo se puede acceder a los recursos compartidos de archivos de Azure NFS a través de redes restringidas. Por lo tanto, debe crear un punto de conexión privado para la cuenta de almacenamiento o restringir el acceso del punto de conexión público a las redes virtuales y direcciones IP seleccionadas. Se recomienda crear un punto de conexión privado. Debe configurar la seguridad de nivel de red para los recursos compartidos de NFS, ya que Azure Files no admite el cifrado en tránsito con el protocolo NFS. Debe deshabilitar la opción Requerir transferencia segura en la cuenta de almacenamiento para usar recursos compartidos de archivos de Azure NFS. Se aplican tarifas estándar de procesamiento de datos para los puntos de conexión privados. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso a los puntos de conexión públicos.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "No permitir el uso de claves de cuenta de almacenamiento para que su cuenta de almacenamiento sea más segura.",
+ "description": "No permitir el uso de claves de cuenta de almacenamiento para que la cuenta de almacenamiento sea más segura.",
"guid": "e262e0ea-2a15-4870-a43e-77fae1ef4075",
"service": "Azure Files",
"text": "Considere la posibilidad de no permitir el acceso a la clave de la cuenta de almacenamiento en el nivel de la cuenta de almacenamiento. No necesita este acceso para montar recursos compartidos de archivos NFS. Pero tenga en cuenta que el control administrativo completo de un recurso compartido de archivos, incluida la capacidad de tomar posesión de un archivo, requiere el uso de una clave de cuenta de almacenamiento.",
@@ -150,12 +150,12 @@
"description": "Seleccione el nivel de acceso adecuado para los recursos compartidos de archivos estándar a fin de reducir considerablemente los costos.",
"guid": "2b332ca7-f600-49c3-a072-ee3679cdcb3a",
"service": "Azure Files",
- "text": "Después de migrar la carga de trabajo, si usa recursos compartidos de archivos estándar, elija cuidadosamente el nivel de acceso más rentable para el recurso compartido de archivos: frecuente, esporádico u optimizado para transacciones. Después de operar durante unos días o semanas con un uso regular, puede insertar los recuentos de transacciones en la calculadora de precios para averiguar qué nivel se adapta mejor a su carga de trabajo. La mayoría de los clientes deben elegir cool incluso si usan activamente el recurso compartido. Pero debe examinar cada recurso compartido y comparar el saldo de la capacidad de almacenamiento con las transacciones para determinar su nivel. Si los costos de transacción representan un porcentaje significativo de su factura, los ahorros del uso del nivel de acceso esporádico a menudo compensan este costo y minimizan el costo total total. Se recomienda mover recursos compartidos de archivos estándar entre niveles de acceso solo cuando sea necesario para optimizar los cambios en el patrón de carga de trabajo. Cada movimiento incurre en transacciones. Para obtener más información, consulte Cambiar entre niveles estándar.",
+ "text": "Después de migrar la carga de trabajo, si usa recursos compartidos de archivos estándar, elija cuidadosamente el nivel de acceso más rentable para el recurso compartido de archivos: frecuente, esporádico u optimizado para transacciones. Después de operar durante unos días o semanas con uso regular, puede insertar los recuentos de transacciones en la calculadora de precios para averiguar qué nivel se adapta mejor a su carga de trabajo. La mayoría de los clientes deben elegir cool incluso si usan activamente el recurso compartido. Sin embargo, debe examinar cada recurso compartido y comparar el saldo de la capacidad de almacenamiento con las transacciones para determinar su nivel. Si los costos de transacción representan un porcentaje significativo de su factura, los ahorros del uso del nivel de acceso esporádico a menudo compensan este costo y minimizan el costo total total. Se recomienda mover recursos compartidos de archivos estándar entre niveles de acceso solo cuando sea necesario para optimizar los cambios en el patrón de carga de trabajo. Cada movimiento incurre en transacciones. Para obtener más información, consulte Cambiar entre niveles estándar.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Aprovisionar en exceso los recursos compartidos de archivos premium en una cantidad razonable para ayudar a mantener el rendimiento y tener en cuenta el crecimiento futuro y los requisitos de rendimiento.",
+ "description": "Aprovisionamiento excesivo de recursos compartidos de archivos premium en una cantidad razonable para ayudar a mantener el rendimiento y tener en cuenta el crecimiento futuro y los requisitos de rendimiento.",
"guid": "9680a4b4-2878-45eb-bbc4-9954adf25eaa",
"service": "Azure Files",
"text": "Si usa recursos compartidos premium, asegúrese de aprovisionar capacidad y rendimiento más que suficientes para su carga de trabajo, pero no tanto como para incurrir en costos innecesarios. Se recomienda sobreaprovisionar dos o tres veces. Puede escalar dinámicamente los recursos compartidos de archivos premium hacia arriba o hacia abajo en función de las características de rendimiento de almacenamiento y entrada/salida (E/S).",
@@ -163,18 +163,18 @@
"waf": "Costar"
},
{
- "description": "Las reservas de tres años pueden proporcionar un descuento de hasta el 36% en el costo total del almacenamiento de archivos. Las reservas no afectan al rendimiento.",
+ "description": "Las reservas de tres años pueden proporcionar un descuento de hasta el 36% sobre el costo total del almacenamiento de archivos. Las reservas no afectan al rendimiento.",
"guid": "21d765dd-5a9c-44d7-908f-422102db61a1",
"service": "Azure Files",
- "text": "Use las reservas de Azure Files, también conocidas como instancias reservadas, para confirmar previamente el uso del almacenamiento y obtener un descuento. Utilice reservas para cargas de trabajo de producción o cargas de trabajo de desarrollo y pruebas con huellas coherentes. Para obtener más información, consulte Optimización de costos con reservas de almacenamiento. Las reservas no incluyen cargos por transacción, ancho de banda, transferencia de datos y almacenamiento de metadatos.",
+ "text": "Use las reservas de Azure Files, también conocidas como instancias reservadas, para confirmar previamente el uso del almacenamiento y obtener un descuento. Use reservas para cargas de trabajo de producción o cargas de trabajo de desarrollo y pruebas con huellas coherentes. Para obtener más información, consulte Optimización de costos con reservas de almacenamiento. Las reservas no incluyen cargos por transacción, ancho de banda, transferencia de datos y almacenamiento de metadatos.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Las instantáneas diferenciales garantizan que no se le facture varias veces por almacenar los mismos datos. Sin embargo, aún debe supervisar el uso de instantáneas para ayudar a reducir la factura de Azure Files.",
+ "description": "Las instantáneas diferenciales garantizan que no se le facture varias veces por almacenar los mismos datos. Sin embargo, aún debe supervisar el uso de instantáneas para ayudar a reducir su factura de Azure Files.",
"guid": "2600163f-0687-47c0-af5d-ebbc2e4f052b",
"service": "Azure Files",
- "text": "Supervise el uso de instantáneas. Las instantáneas conllevan cargos, pero se facturan en función del uso de almacenamiento diferencial de cada instantánea. Solo pagas por la diferencia en cada instantánea. Para obtener más información, consulte Instantáneas. Azure File Sync toma instantáneas de nivel de archivo y de recurso compartido como parte del uso normal, lo que puede aumentar la factura total de Azure Files.",
+ "text": "Supervise el uso de instantáneas. Las instantáneas incurren en cargos, pero se facturan en función del uso de almacenamiento diferencial de cada instantánea. Solo pagas por la diferencia en cada instantánea. Para obtener más información, consulte Instantáneas. Azure File Sync toma instantáneas de nivel de recurso compartido y de nivel de archivo como parte del uso normal, lo que puede aumentar la factura total de Azure Files.",
"type": "recommendation",
"waf": "Costar"
},
@@ -182,7 +182,7 @@
"description": "Establezca un período de retención para que los archivos eliminados temporalmente no se acumulen y aumenten el costo de la capacidad. Después del período de retención configurado, los datos eliminados permanentemente no incurren en ningún costo.",
"guid": "e2920277-545a-464d-83be-dd28b3e5c9db",
"service": "Azure Files",
- "text": "Establezca períodos de retención para la función de eliminación temporal, especialmente cuando comience a usarla por primera vez. Considere comenzar con un período de retención corto para comprender mejor cómo afecta la función a su factura. El período de retención mínimo recomendado es de siete días. Al eliminar temporalmente recursos compartidos de archivos estándar y premium, se facturan como capacidad usada en lugar de capacidad aprovisionada. Y los recursos compartidos de archivos premium se facturan a la tarifa de instantáneas mientras se encuentran en el estado de eliminación temporal. Los recursos compartidos de archivos estándar se facturan a la tarifa normal mientras se encuentran en el estado de eliminación temporal.",
+ "text": "Establezca períodos de retención para la función de eliminación temporal, especialmente cuando comience a usarla por primera vez. Considere comenzar con un período de retención corto para comprender mejor cómo la función afecta su factura. El período de retención mínimo recomendado es de siete días. Al eliminar temporalmente recursos compartidos de archivos estándar y premium, se facturan como capacidad usada en lugar de capacidad aprovisionada. Y los recursos compartidos de archivos premium se facturan a la tarifa de instantáneas mientras se encuentran en el estado de eliminación temporal. Los recursos compartidos de archivos estándar se facturan a la tarifa normal mientras se encuentran en el estado de eliminación temporal.",
"type": "recommendation",
"waf": "Costar"
},
@@ -211,10 +211,10 @@
"waf": "Operaciones"
},
{
- "description": "Aumente el rendimiento y las IOPS a la vez que reduce el coste total de propiedad. Las ventajas de rendimiento aumentan con el número de archivos que distribuyen la carga.",
+ "description": "Aumente el rendimiento y las IOPS a la vez que reduce el costo total de propiedad. Las ventajas de rendimiento aumentan con el número de archivos que distribuyen la carga.",
"guid": "7e271270-4f79-4418-b668-5c4a16627bbd",
"service": "Azure Files",
- "text": "Habilite SMB Multicanal para recursos compartidos de archivos SMB premium. SMB Multicanal permite a un cliente SMB 3.1.1 establecer varias conexiones de red a un recurso compartido de archivos de Azure SMB. SMB multicanal solo funciona cuando la característica está habilitada tanto en el lado del cliente (su cliente) como en el lado del servicio (Azure). En los clientes de Windows, SMB multicanal está habilitado de forma predeterminada, pero debe habilitarlo en su cuenta de almacenamiento.",
+ "text": "Habilite SMB Multichannel para recursos compartidos de archivos SMB premium. SMB Multicanal permite a un cliente SMB 3.1.1 establecer varias conexiones de red a un recurso compartido de archivos de Azure SMB. SMB multicanal solo funciona cuando la característica está habilitada tanto en el lado del cliente (su cliente) como en el lado del servicio (Azure). En los clientes de Windows, SMB Multicanal está habilitado de forma predeterminada, pero debe habilitarlo en su cuenta de almacenamiento.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -222,7 +222,7 @@
"description": "Aumente el rendimiento a escala y reduzca el costo total de propiedad de los recursos compartidos de archivos NFS.",
"guid": "9f9cb641-df29-440a-8f30-513367264e14",
"service": "Azure Files",
- "text": "Use la opción de montaje del lado del cliente nconnect con recursos compartidos de archivos de Azure NFS en clientes Linux. Nconnect permite usar más conexiones TCP entre el cliente y el servicio premium de Azure Files para NFSv4.1.",
+ "text": "Use la opción de montaje del lado cliente nconnect con recursos compartidos de archivos de Azure NFS en clientes Linux. Nconnect permite usar más conexiones TCP entre el cliente y el servicio premium de Azure Files para NFSv4.1.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -238,7 +238,7 @@
"metadata": {
"name": "Azure Files Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +265,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azurefiles_sg_checklist.ja.json b/checklists-ext/azurefiles_sg_checklist.ja.json
index 9da856a17..18a967ab5 100644
--- a/checklists-ext/azurefiles_sg_checklist.ja.json
+++ b/checklists-ext/azurefiles_sg_checklist.ja.json
@@ -238,7 +238,7 @@
"metadata": {
"name": "Azure Files Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +265,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azurefiles_sg_checklist.ko.json b/checklists-ext/azurefiles_sg_checklist.ko.json
index 361090896..b511a53fe 100644
--- a/checklists-ext/azurefiles_sg_checklist.ko.json
+++ b/checklists-ext/azurefiles_sg_checklist.ko.json
@@ -3,10 +3,10 @@
"categories": [],
"items": [
{
- "description": "이중화는 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 다양한 가용성 영역에서 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
+ "description": "중복성은 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 다양한 가용성 영역에서 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
"guid": "7005fc93-af02-4183-af03-e363ccf31456",
"service": "Azure Files",
- "text": "중복성을 위해 저장소 계정을 구성합니다. 가용성과 내구성을 최대화하려면 ZRS(영역 중복 스토리지), GRS 또는 GZRS를 사용하여 계정을 구성합니다. 제한된 Azure 지역은 표준 및 프리미엄 파일 공유에 대해 ZRS를 지원합니다. 표준 SMB 계정만 GRS 및 GZRS를 지원합니다. 프리미엄 SMB 공유 및 NFS 공유는 GRS 및 GZRS를 지원하지 않습니다. Azure Files는 RA-GRS(읽기 액세스 지역 중복 스토리지) 또는 RA-GZRS(읽기 액세스 지역 영역 중복 스토리지)를 지원하지 않습니다. RA-GRS 또는 RA-GZRS를 사용하도록 스토리지 계정을 구성하는 경우 파일 공유가 GRS 또는 GZRS로 구성되고 청구됩니다.",
+ "text": "중복성을 위해 저장소 계정을 구성합니다. 최대 가용성 및 내구성을 위해 ZRS(영역 중복 스토리지), GRS 또는 GZRS를 사용하여 계정을 구성합니다. 제한된 Azure 지역은 표준 및 프리미엄 파일 공유에 대해 ZRS를 지원합니다. 표준 SMB 계정만 GRS 및 GZRS를 지원합니다. 프리미엄 SMB 공유 및 NFS 공유는 GRS 및 GZRS를 지원하지 않습니다. Azure Files는 RA-GRS(읽기 액세스 지역 중복 스토리지) 또는 RA-GZRS(읽기 액세스 지역 영역 중복 스토리지)를 지원하지 않습니다. RA-GRS 또는 RA-GZRS를 사용하도록 스토리지 계정을 구성하는 경우 파일 공유가 GRS 또는 GZRS로 구성되고 청구됩니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -19,10 +19,10 @@
"waf": "신뢰도"
},
{
- "description": "일시 삭제는 파일 공유 수준에서 작동하여 실수로 삭제되지 않도록 Azure 파일 공유를 보호합니다. 특정 시점 복원은 파일 공유를 이전 상태로 복원할 수 있으므로 실수로 인한 삭제 또는 손상을 방지합니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
+ "description": "일시 삭제는 파일 공유 수준에서 작동하여 실수로 삭제되지 않도록 Azure 파일 공유를 보호합니다. 특정 시점 복원은 파일 공유를 이전 상태로 복원할 수 있으므로 실수로 삭제되거나 손상되는 것을 방지합니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
"guid": "8f7b75e8-8b14-44ce-b4a5-3e994995479d",
"service": "Azure Files",
- "text": "백업 및 복구 전략의 일환으로 일시 삭제를 사용하도록 설정하고 특정 시점 복원을 위해 스냅샷을 사용합니다. Azure Backup을 사용하여 SMB 파일 공유를 백업할 수 있습니다. Azure 파일 동기화를 사용하여 온-프레미스 SMB 파일 공유를 Azure 파일 공유에 백업할 수도 있습니다. 또한 Azure Backup을 사용하면 Azure Files의 자격 증명 모음 백업(미리 보기)을 수행하여 악의적인 행위자 또는 악의적인 관리자로 인한 랜섬웨어 공격 또는 원본 데이터 손실로부터 데이터를 보호할 수 있습니다. Azure Backup은 자격 증명 모음 백업을 사용하여 Recovery Services 자격 증명 모음에 데이터를 복사하고 저장합니다. 이렇게 하면 최대 99년 동안 보존할 수 있는 데이터의 오프사이트 복사본이 만들어집니다. Azure Backup은 백업 정책에 정의된 일정 및 보존에 따라 복구 지점을 만들고 관리합니다. 더 알아보세요.",
+ "text": "백업 및 복구 전략의 일환으로 일시 삭제를 사용하도록 설정하고 특정 시점 복원을 위해 스냅샷을 사용합니다. Azure Backup을 사용하여 SMB 파일 공유를 백업할 수 있습니다. Azure 파일 동기화를 사용하여 온-프레미스 SMB 파일 공유를 Azure 파일 공유에 백업할 수도 있습니다. 또한 Azure Backup을 사용하면 Azure Files의 자격 증명 모음 백업(미리 보기)을 수행하여 악의적인 행위자 또는 악의적인 관리자로 인한 랜섬웨어 공격 또는 원본 데이터 손실로부터 데이터를 보호할 수 있습니다. 자격 증명 모음 백업을 사용하여 Azure Backup은 Recovery Services 자격 증명 모음에 데이터를 복사하고 저장합니다. 이렇게 하면 최대 99년 동안 보존할 수 있는 데이터의 오프사이트 복사본이 만들어집니다. Azure Backup은 백업 정책에 정의된 일정 및 보존에 따라 복구 지점을 만들고 관리합니다. 더 알아보세요.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -38,7 +38,7 @@
"description": "SMB 3.x는 인터넷 안전 프로토콜이지만 조직 또는 ISP 정책을 변경할 수 없는 경우가 있습니다. VPN 게이트웨이 또는 ExpressRoute 연결을 대체 옵션으로 사용할 수 있습니다.",
"guid": "9f70f1de-9f49-4425-9fba-2bae24f81014",
"service": "Azure Files",
- "text": "TCP 포트 445 아웃바운드를 열거나 Azure 외부의 클라이언트에 대해 VPN 게이트웨이 또는 Azure ExpressRoute 연결을 설정하여 파일 공유에 액세스합니다.",
+ "text": "TCP 포트 445 아웃바운드를 열거나 Azure 외부의 클라이언트가 파일 공유에 액세스할 수 있도록 VPN 게이트웨이 또는 Azure ExpressRoute 연결을 설정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -46,12 +46,12 @@
"description": "SMB 1은 오래되고 비효율적이며 안전하지 않은 프로토콜입니다. 보안 태세를 강화하기 위해 클라이언트에서 사용하지 않도록 설정합니다.",
"guid": "6ad18c63-4c63-45c3-b002-5b305235c439",
"service": "Azure Files",
- "text": "포트 445를 여는 경우 Windows 및 Linux 클라이언트에서 SMBv1을 사용하지 않도록 설정해야 합니다. Azure Files는 SMB 1을 지원하지 않지만 클라이언트에서 사용하지 않도록 설정해야 합니다.",
+ "text": "포트 445를 여는 경우 Windows 및 Linux 클라이언트에서 SMBv1을 비활성화해야 합니다. Azure Files는 SMB 1을 지원하지 않지만 클라이언트에서 사용하지 않도록 설정해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험 노출이 제거됩니다.",
+ "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험에 노출되지 않습니다.",
"guid": "0291451b-94f7-4f9c-a479-48c142e6c208",
"service": "Azure Files",
"text": "스토리지 계정에 대한 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다. Azure 외부에 있는 SMB 클라이언트 및 서비스가 스토리지 계정에 액세스해야 하는 경우에만 공용 네트워크 액세스를 사용하도록 설정합니다. 공용 네트워크 액세스를 사용하지 않도록 설정하는 경우 스토리지 계정에 대한 프라이빗 엔드포인트를 만듭니다. 프라이빗 엔드포인트에 대한 표준 데이터 처리 요금이 적용됩니다. 프라이빗 엔드포인트는 퍼블릭 엔드포인트에 대한 연결을 차단하지 않습니다. 앞에서 설명한 대로 공용 네트워크 액세스를 사용하지 않도록 설정해야 합니다. 파일 공유에 고정 IP 주소가 필요하지 않고 프라이빗 엔드포인트 비용을 피하려면 대신 특정 가상 네트워크 및 IP 주소에 대한 퍼블릭 엔드포인트 액세스를 제한할 수 있습니다.",
@@ -62,7 +62,7 @@
"description": "공격자에게 틈을 만들 위험을 최소화합니다.",
"guid": "28051b58-caf9-415f-ab61-daa7c3bf37c5",
"service": "Azure Files",
- "text": "특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다. 제로 액세스부터 시작한 다음, 클라이언트 및 서비스에 필요한 최소한의 액세스를 체계적이고 점진적으로 제공합니다.",
+ "text": "특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다. 제로 액세스부터 시작한 다음, 클라이언트 및 서비스에 필요한 최소한의 액세스 권한을 체계적이고 점진적으로 제공합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -86,7 +86,7 @@
"description": "이 설정은 스토리지 계정에 대한 모든 요청이 보안 연결(HTTPS)을 통해 수행되도록 합니다. HTTP를 통한 모든 요청은 실패합니다.",
"guid": "ad87891d-330d-4482-abd0-938ff9e700cc",
"service": "Azure Files",
- "text": "대부분의 경우 모든 스토리지 계정에서 보안 전송 필요 옵션을 사용하도록 설정하여 SMB 파일 공유에 대한 전송 중 암호화를 사용하도록 설정해야 합니다. 아주 오래된 클라이언트가 공유에 액세스할 수 있도록 허용해야 하는 경우 이 옵션을 활성화하지 마세요. 보안 전송을 비활성화하는 경우 네트워크 컨트롤을 사용하여 트래픽을 제한해야 합니다.",
+ "text": "대부분의 경우 모든 스토리지 계정에서 보안 전송 필요 옵션을 사용하도록 설정하여 SMB 파일 공유에 대해 전송 중 암호화를 사용하도록 설정해야 합니다. 매우 오래된 클라이언트가 공유에 액세스할 수 있도록 허용해야 하는 경우 이 옵션을 활성화하지 마세요. 보안 전송을 비활성화하는 경우 네트워크 제어를 사용하여 트래픽을 제한해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -102,7 +102,7 @@
"description": "Windows 10과 함께 릴리스된 SMB 3.1.1에는 중요한 보안 및 성능 업데이트가 포함되어 있습니다. AES-256-GCM은 보다 안전한 채널 암호화를 제공합니다.",
"guid": "7704ad4b-c605-458a-bca3-b9915288379d",
"service": "Azure Files",
- "text": "지원되는 가장 최근의 SMB 프로토콜 버전(현재 3.1.1.)만 사용하고 SMB 채널 암호화에는 AES-256-GCM만 사용합니다. Azure Files는 SMB 프로토콜을 전환하고 조직의 요구 사항에 따라 호환성을 높이거나 보안을 강화하는 데 사용할 수 있는 설정을 노출합니다. 기본적으로 모든 SMB 버전이 허용됩니다. 그러나 SMB 2.1은 전송 중 데이터 암호화를 지원하지 않으므로 보안 전송 필요를 사용하도록 설정하면 SMB 2.1이 허용되지 않습니다. 이러한 설정을 높은 수준의 보안으로 제한하면 일부 클라이언트가 파일 공유에 연결하지 못할 수 있습니다.",
+ "text": "지원되는 가장 최근의 SMB 프로토콜 버전(현재 3.1.1.)만 사용하고 SMB 채널 암호화에는 AES-256-GCM만 사용합니다. Azure Files는 SMB 프로토콜을 전환하고 조직의 요구 사항에 따라 호환성을 높이거나 보안을 강화하는 데 사용할 수 있는 설정을 노출합니다. 기본적으로 모든 SMB 버전이 허용됩니다. 그러나 SMB 2.1은 전송 중인 데이터의 암호화를 지원하지 않으므로 보안 전송 필요를 사용하도록 설정하면 SMB 2.1이 허용되지 않습니다. 이러한 설정을 높은 수준의 보안으로 제한하면 일부 클라이언트가 파일 공유에 연결하지 못할 수 있습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -118,12 +118,12 @@
"description": "포트 2049를 열어 클라이언트가 NFS Azure 파일 공유와 통신할 수 있도록 합니다.",
"guid": "c0363075-4c11-41ae-bea9-c203481eb76e",
"service": "Azure Files",
- "text": "NFS 공유를 탑재하려는 클라이언트에서 포트 2049를 열어야 합니다.",
+ "text": "NFS 공유를 마운트하려는 클라이언트에서 포트 2049를 열어야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험 노출이 제거됩니다.",
+ "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험에 노출되지 않습니다.",
"guid": "d3fffd01-afd2-4654-94cf-b971a379cb1e",
"service": "Azure Files",
"text": "NFS Azure 파일 공유는 제한된 네트워크를 통해서만 액세스할 수 있습니다. 따라서 스토리지 계정에 대한 프라이빗 엔드포인트를 만들거나 선택한 가상 네트워크 및 IP 주소에 대한 퍼블릭 엔드포인트 액세스를 제한해야 합니다. 프라이빗 엔드포인트를 만드는 것이 좋습니다. Azure Files는 NFS 프로토콜을 사용한 전송 중 암호화를 지원하지 않으므로 NFS 공유에 대한 네트워크 수준 보안을 구성해야 합니다. NFS Azure 파일 공유를 사용하려면 스토리지 계정에서 보안 전송 필요 설정을 사용하지 않도록 설정해야 합니다. 프라이빗 엔드포인트에는 표준 데이터 처리 요금이 적용됩니다. 파일 공유에 고정 IP 주소가 필요하지 않고 프라이빗 엔드포인트 비용을 피하려면 대신 퍼블릭 엔드포인트 액세스를 제한할 수 있습니다.",
@@ -150,15 +150,15 @@
"description": "표준 파일 공유에 적합한 액세스 계층을 선택하면 비용을 크게 줄일 수 있습니다.",
"guid": "2b332ca7-f600-49c3-a072-ee3679cdcb3a",
"service": "Azure Files",
- "text": "워크로드를 마이그레이션한 후 표준 파일 공유를 사용하는 경우 파일 공유에 대해 가장 비용 효율적인 액세스 계층(핫, 쿨 또는 트랜잭션 최적화)을 신중하게 선택합니다. 며칠 또는 몇 주 동안 정기적으로 사용한 후 가격 계산기에 트랜잭션 수를 삽입하여 워크로드에 가장 적합한 계층을 파악할 수 있습니다. 대부분의 고객은 공유를 적극적으로 사용하더라도 쿨을 선택해야 합니다. 그러나 각 공유를 검사하고 스토리지 용량의 균형을 트랜잭션과 비교하여 계층을 결정해야 합니다. 트랜잭션 비용이 청구서의 상당 부분을 차지하는 경우 쿨 액세스 계층을 사용하여 절감된 금액이 이 비용을 상쇄하고 총 비용을 최소화하는 경우가 많습니다. 워크로드 패턴의 변경을 최적화하기 위해 필요한 경우에만 액세스 계층 간에 표준 파일 공유를 이동하는 것이 좋습니다. 이동할 때마다 트랜잭션이 발생합니다. 자세한 내용은 표준 계층 간 전환을 참조하세요.",
+ "text": "워크로드를 마이그레이션한 후 표준 파일 공유를 사용하는 경우 파일 공유에 대해 가장 비용 효율적인 액세스 계층(핫, 쿨 또는 트랜잭션 최적화)을 신중하게 선택합니다. 며칠 또는 몇 주 동안 정기적으로 사용한 후 가격 계산기에 트랜잭션 수를 삽입하여 워크로드에 가장 적합한 계층을 파악할 수 있습니다. 대부분의 고객은 공유를 적극적으로 사용하더라도 시원한 선택을 해야 합니다. 그러나 각 공유를 검사하고 스토리지 용량의 균형을 트랜잭션과 비교하여 계층을 결정해야 합니다. 트랜잭션 비용이 청구서의 상당 부분을 차지하는 경우 쿨 액세스 계층을 사용하여 절감된 금액으로 이 비용을 상쇄하고 총 전체 비용을 최소화하는 경우가 많습니다. 워크로드 패턴의 변경을 최적화하기 위해 필요한 경우에만 액세스 계층 간에 표준 파일 공유를 이동하는 것이 좋습니다. 이동할 때마다 트랜잭션이 발생합니다. 자세한 내용은 표준 계층 간 전환을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "성능을 유지하고 향후 성장 및 성능 요구 사항을 고려하는 데 도움이 되도록 프리미엄 파일 공유를 합리적인 금액으로 과도하게 프로비저닝합니다.",
+ "description": "성능을 유지하고 향후 성장 및 성능 요구 사항을 고려하는 데 도움이 되도록 합리적인 금액으로 프리미엄 파일 공유를 과도하게 프로비저닝합니다.",
"guid": "9680a4b4-2878-45eb-bbc4-9954adf25eaa",
"service": "Azure Files",
- "text": "프리미엄 공유를 사용하는 경우 워크로드에 충분한 용량과 성능을 프로비전해야 하지만 불필요한 비용이 발생할 정도는 아니어야 합니다. 2-3회 오버프로비저닝하는 것이 좋습니다. 프리미엄 파일 공유는 스토리지 및 IO(입력/출력) 성능 특성에 따라 동적으로 확장하거나 축소할 수 있습니다.",
+ "text": "프리미엄 공유를 사용하는 경우 워크로드에 대해 충분한 용량과 성능을 프로비전해야 하지만 불필요한 비용이 발생할 정도는 안 됩니다. 2-3회 오버프로비저닝하는 것이 좋습니다. 프리미엄 파일 공유는 스토리지 및 IO(입력/출력) 성능 특성에 따라 동적으로 확장하거나 축소할 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -166,12 +166,12 @@
"description": "3년 예약은 총 파일 스토리지 비용의 최대 36%까지 할인을 받을 수 있습니다. 예약은 성능에 영향을 주지 않습니다.",
"guid": "21d765dd-5a9c-44d7-908f-422102db61a1",
"service": "Azure Files",
- "text": "예약 인스턴스라고도 하는 Azure Files 예약을 사용하여 스토리지 사용량을 미리 커밋하고 할인을 받으세요. 일관된 공간을 가진 프로덕션 워크로드 또는 개발/테스트 워크로드에 대한 예약을 사용합니다. 자세한 내용은 스토리지 예약을 사용하여 비용 최적화를 참조하세요. 예약에는 트랜잭션, 대역폭, 데이터 전송 및 메타데이터 스토리지 요금이 포함되지 않습니다.",
+ "text": "예약 인스턴스라고도 하는 Azure Files 예약을 사용하여 스토리지 사용량을 미리 커밋하고 할인을 받으세요. 프로덕션 워크로드 또는 개발/테스트 워크로드에 대한 예약을 일관된 공간으로 사용합니다. 자세한 내용은 스토리지 예약을 사용하여 비용 최적화를 참조하세요. 예약에는 트랜잭션, 대역폭, 데이터 전송 및 메타데이터 스토리지 요금이 포함되지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "차등 스냅샷은 동일한 데이터를 저장하는 데 여러 번 요금이 청구되지 않도록 합니다. 그러나 Azure Files 청구를 줄이기 위해 스냅샷 사용량을 계속 모니터링해야 합니다.",
+ "description": "차등 스냅샷은 동일한 데이터를 저장하는 데 여러 번 요금이 청구되지 않도록 합니다. 그러나 Azure Files 청구액을 줄이기 위해 스냅샷 사용량을 계속 모니터링해야 합니다.",
"guid": "2600163f-0687-47c0-af5d-ebbc2e4f052b",
"service": "Azure Files",
"text": "스냅샷 사용량을 모니터링합니다. 스냅샷에는 요금이 부과되지만 각 스냅샷의 차등 스토리지 사용량에 따라 요금이 청구됩니다. 각 스냅샷의 차이에 대해서만 비용을 지불하면 됩니다. 자세한 내용은 스냅샷을 참조하십시오. Azure 파일 동기화는 일반 사용의 일부로 공유 수준 및 파일 수준 스냅샷을 수행하므로 총 Azure Files 청구액이 증가할 수 있습니다.",
@@ -182,7 +182,7 @@
"description": "일시 삭제된 파일이 쌓이지 않고 용량 비용이 증가하지 않도록 보존 기간을 설정합니다. 구성된 보존 기간이 지나면 영구적으로 삭제된 데이터에 비용이 발생하지 않습니다.",
"guid": "e2920277-545a-464d-83be-dd28b3e5c9db",
"service": "Azure Files",
- "text": "일시 삭제 기능에 대한 보존 기간을 설정합니다(특히 처음 사용을 시작할 때). 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다. 표준 및 프리미엄 파일 공유를 일시 삭제하면 프로비저닝된 용량이 아닌 사용된 용량으로 청구됩니다. 또한 프리미엄 파일 공유는 일시 삭제 상태에 있는 동안 스냅샷 요금으로 청구됩니다. 표준 파일 공유는 일시 삭제 상태에 있는 동안 일반 요율로 청구됩니다.",
+ "text": "일시 삭제 기능에 대한 보존 기간을 설정합니다(특히 처음 사용하기 시작할 때). 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다. 표준 및 프리미엄 파일 공유를 일시 삭제하면 프로비저닝된 용량이 아닌 사용된 용량으로 청구됩니다. 또한 프리미엄 파일 공유는 일시 삭제 상태에 있는 동안 스냅샷 요금으로 청구됩니다. 표준 파일 공유는 일시 삭제 상태에 있는 동안 일반 요율로 청구됩니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -195,7 +195,7 @@
"waf": "작업"
},
{
- "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드와 보고서를 쉽게 만들 수 있습니다.",
+ "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드 및 보고서를 쉽게 만들 수 있습니다.",
"guid": "d2414f84-0b9f-44a6-ab13-bef6984774bc",
"service": "Azure Files",
"text": "Storage 인사이트를 사용하여 스토리지 계정의 상태와 성능을 추적합니다. Storage 인사이트는 모든 스토리지 계정에 대한 오류, 성능, 가용성 및 용량에 대한 통합 보기를 제공합니다.",
@@ -219,7 +219,7 @@
"waf": "공연"
},
{
- "description": "대규모로 성능을 높이고 NFS 파일 공유의 총 소유 비용을 줄입니다.",
+ "description": "규모에 맞게 성능을 높이고 NFS 파일 공유의 총 소유 비용을 절감합니다.",
"guid": "9f9cb641-df29-440a-8f30-513367264e14",
"service": "Azure Files",
"text": "Linux 클라이언트에서 NFS Azure 파일 공유와 함께 nconnect 클라이언트 쪽 탑재 옵션을 사용합니다. Nconnect를 사용하면 클라이언트와 NFSv4.1용 Azure Files 프리미엄 서비스 간에 더 많은 TCP 연결을 사용할 수 있습니다.",
@@ -230,7 +230,7 @@
"description": "최상의 클라이언트 환경을 제공하기 위해 제한을 피합니다.",
"guid": "e85fb837-f8a0-4b2f-b759-6ccdafa4f05c",
"service": "Azure Files",
- "text": "파일 공유 또는 스토리지 계정이 제한되어 대기 시간이 길거나 처리량이 낮거나 IOPS가 낮을 수 있는 상황이 발생하지 않는지 확인합니다. IOPS, 수신 또는 송신 제한에 도달하면 요청이 제한됩니다. 표준 스토리지 계정의 경우 계정 수준에서 제한이 발생합니다. 프리미엄 파일 공유의 경우 제한은 일반적으로 공유 수준에서 발생합니다.",
+ "text": "파일 공유 또는 스토리지 계정이 제한되어 대기 시간이 길거나 처리량이 낮거나 IOPS가 낮을 수 있는 경우가 아닌지 확인합니다. IOPS, 수신 또는 송신 제한에 도달하면 요청이 제한됩니다. 표준 스토리지 계정의 경우 계정 수준에서 제한이 발생합니다. 프리미엄 파일 공유의 경우 제한은 일반적으로 공유 수준에서 발생합니다.",
"type": "recommendation",
"waf": "공연"
}
@@ -238,7 +238,7 @@
"metadata": {
"name": "Azure Files Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +265,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azurefiles_sg_checklist.pt.json b/checklists-ext/azurefiles_sg_checklist.pt.json
index 6ceb6fb94..9e7746b96 100644
--- a/checklists-ext/azurefiles_sg_checklist.pt.json
+++ b/checklists-ext/azurefiles_sg_checklist.pt.json
@@ -238,7 +238,7 @@
"metadata": {
"name": "Azure Files Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +265,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azurefiles_sg_checklist.zh-Hant.json b/checklists-ext/azurefiles_sg_checklist.zh-Hant.json
index 2f0737307..b2fb03a85 100644
--- a/checklists-ext/azurefiles_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azurefiles_sg_checklist.zh-Hant.json
@@ -238,7 +238,7 @@
"metadata": {
"name": "Azure Files Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -265,31 +265,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azurefirewall_sg_checklist.en.json b/checklists-ext/azurefirewall_sg_checklist.en.json
index 5bcd62937..18cc720cb 100644
--- a/checklists-ext/azurefirewall_sg_checklist.en.json
+++ b/checklists-ext/azurefirewall_sg_checklist.en.json
@@ -309,6 +309,6 @@
"name": "Azure Firewall Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azurefirewall_sg_checklist.es.json b/checklists-ext/azurefirewall_sg_checklist.es.json
index ca4351274..583bc4b69 100644
--- a/checklists-ext/azurefirewall_sg_checklist.es.json
+++ b/checklists-ext/azurefirewall_sg_checklist.es.json
@@ -11,10 +11,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Supervise las métricas de recursos y el estado del servicio para poder detectar cuándo se degrada un estado del servicio y tomar medidas proactivas para evitar errores.",
+ "description": "Supervise las métricas de recursos y el estado del servicio para poder detectar cuándo se degrada un estado de servicio y tomar medidas proactivas para evitar errores.",
"guid": "a61daca7-ba87-4a5f-8d72-6c4e61f1f8a1",
"service": "Azure Firewall",
- "text": "Supervise las métricas de Azure Firewall en un área de trabajo de Log Analytics. Supervise de cerca las métricas que indican el estado de mantenimiento de Azure Firewall, como el rendimiento, el estado de mantenimiento del firewall, el uso del puerto SNAT y las métricas de sondeo de latencia de AZFW. Use Azure Service Health para supervisar el estado de Azure Firewall.",
+ "text": "Supervise las métricas de Azure Firewall en un área de trabajo de Log Analytics. Supervise de cerca las métricas que indican el estado de mantenimiento de Azure Firewall, como el rendimiento, el estado de mantenimiento del firewall, la utilización del puerto SNAT y las métricas de sondeo de latencia de AZFW. Use Azure Service Health para supervisar el estado de Azure Firewall.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -22,7 +22,7 @@
"description": "Use la tunelización forzada para no exponer los recursos de Azure directamente a Internet. Este enfoque reduce la superficie de ataque y minimiza el riesgo de amenazas externas. Para aplicar las directivas corporativas y los requisitos de cumplimiento de forma más eficaz, enrute todo el tráfico enlazado a Internet a través de un firewall local o una NVA.",
"guid": "11c69324-ff8f-48aa-9e9e-9c954e29a121",
"service": "Azure Firewall",
- "text": "Configure Azure Firewall en modo de tunelización forzada si necesita enrutar todo el tráfico enlazado a Internet a un próximo salto designado en lugar de directamente a Internet. Esta recomendación no se aplica a Virtual WAN.
Azure Firewall debe tener conexión directa a Internet. Si AzureFirewallSubnet aprende una ruta predeterminada a la red local a través del protocolo de puerta de enlace fronteriza, debe configurar Azure Firewall en modo de tunelización forzada. Puede usar la característica de tunelización forzada para agregar otro espacio de direcciones /26 para la subred de administración de Azure Firewall. Asigne a la subred el nombre AzureFirewallManagementSubnet. Si tiene una instancia de Azure Firewall existente que no puede volver a configurar en el modo de tunelización forzada, cree una UDR con una ruta 0.0.0.0/0. Establezca el valor de NextHopType como Internet. Para mantener la conectividad a Internet, asocie la UDR con AzureFirewallSubnet. Establezca la dirección IP pública en None para implementar un plano de datos totalmente privado al configurar Azure Firewall en modo de tunelización forzada. Sin embargo, el plano de administración sigue requiriendo una dirección IP pública solo con fines de administración. El tráfico interno de las redes virtuales y locales no usa esa dirección IP pública.",
+ "text": "Configure Azure Firewall en modo de tunelización forzada si necesita enrutar todo el tráfico enlazado a Internet a un próximo salto designado en lugar de directamente a Internet. Esta recomendación no se aplica a Virtual WAN.
Azure Firewall debe tener conectividad directa a Internet. Si AzureFirewallSubnet aprende una ruta predeterminada a la red local a través del protocolo de puerta de enlace fronteriza, debe configurar Azure Firewall en modo de tunelización forzada. Puede usar la característica de tunelización forzada para agregar otro espacio de direcciones /26 para la subred de administración de Azure Firewall. Asigne a la subred el nombre AzureFirewallManagementSubnet. Si tiene una instancia de Azure Firewall existente que no puede volver a configurar en el modo de tunelización forzada, cree una UDR con una ruta 0.0.0.0/0. Establezca el valor de NextHopType como Internet. Para mantener la conectividad a Internet, asocie la UDR con AzureFirewallSubnet. Establezca la dirección IP pública en None para implementar un plano de datos totalmente privado al configurar Azure Firewall en modo de tunelización forzada. Sin embargo, el plano de administración sigue requiriendo una dirección IP pública solo con fines de administración. El tráfico interno de las redes virtuales y locales no usa esa dirección IP pública.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -30,7 +30,7 @@
"description": "Organice las reglas en una estructura jerárquica para que las políticas granulares puedan cumplir con los requisitos de regiones específicas. Cada política puede contener diferentes conjuntos de reglas de traducción de direcciones de red de destino (DNAT), redes y aplicaciones que tienen prioridades, acciones y órdenes de procesamiento específicos.",
"guid": "29a3b176-03b3-4273-b9f8-cdddee154009",
"service": "Azure Firewall",
- "text": "Cree reglas para políticas de firewall en una estructura jerárquica para superponer una política base central. Para más información, consulte Uso de directivas de Azure Firewall para procesar reglas.
Cree sus reglas basadas en el principio de confianza cero de acceso con privilegios mínimos",
+ "text": "Cree reglas para políticas de firewall en una estructura jerárquica para superponer una política base central. Para más información, consulte Uso de directivas de Azure Firewall para procesar reglas.
Cree sus reglas basadas en el principio de Confianza cero de acceso con privilegios mínimos",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -46,7 +46,7 @@
"description": "Habilite esta característica para apuntar a los clientes de las redes virtuales a Azure Firewall como servidor DNS. Esta característica protege la infraestructura DNS interna a la que no se accede ni se expone directamente.",
"guid": "98a53328-cf36-4d0e-b7dc-a15a8957ab3b",
"service": "Azure Firewall",
- "text": "Habilite la configuración de proxy DNS de Azure Firewall.
Configure también Azure Firewall para usar DNS personalizado para reenviar consultas DNS.",
+ "text": "Habilite la configuración del proxy DNS de Azure Firewall.
Configure también Azure Firewall para que use DNS personalizado para reenviar consultas DNS.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -54,15 +54,15 @@
"description": "Envíe tráfico a través del firewall para inspeccionar el tráfico y ayudar a identificar y bloquear el tráfico malicioso.
Use Azure Firewall como proxy explícito para el tráfico saliente, de modo que el tráfico web llegue a la dirección IP privada del firewall y, por lo tanto, salga directamente del firewall sin usar una UDR. Esta característica también facilita el uso de múltiples firewalls sin modificar las rutas de red existentes.",
"guid": "5a33a8c3-32ad-4df5-b10e-ae88d9341652",
"service": "Azure Firewall",
- "text": "Configure las UDR para forzar el tráfico a través de Azure Firewall en una arquitectura tradicional de concentrador y radio para la conectividad de radio a radio, de radio a Internet y de radio a híbrido.
En Virtual WAN, configure la intención de enrutamiento y las directivas para redirigir el tráfico privado o el tráfico de Internet a través de la instancia de Azure Firewall integrada en el centro.
Si no puede aplicar una UDR y solo necesita el redireccionamiento del tráfico web, use Azure Firewall como proxy explícito en la ruta de acceso de salida. Puede configurar una opción de proxy en la aplicación de envío, como un explorador web, al configurar Azure Firewall como proxy.",
+ "text": "Configure las UDR para forzar el tráfico a través de Azure Firewall en una arquitectura tradicional de centro y radio para la conectividad de radio a radio, de radio a Internet y de radio a híbrido.
En Virtual WAN, configure la intención de enrutamiento y las directivas para redirigir el tráfico privado o el tráfico de Internet a través de la instancia de Azure Firewall integrada en el centro.
Si no puede aplicar una UDR y solo necesita el redireccionamiento del tráfico web, use Azure Firewall como proxy explícito en la ruta de salida. Puede configurar una opción de proxy en la aplicación de envío, como un explorador web, al configurar Azure Firewall como proxy.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Use FQDN en las reglas de red de Azure Firewall para que los administradores puedan administrar nombres de dominio en lugar de varias direcciones IP, lo que simplifica la administración. Esta resolución dinámica garantiza que las reglas de firewall se actualicen automáticamente cuando cambien las direcciones IP de los dominios.",
+ "description": "Use FQDN en las reglas de red de Azure Firewall para que los administradores puedan administrar nombres de dominio en lugar de varias direcciones IP, lo que simplifica la administración. Esta resolución dinámica garantiza que las reglas de firewall se actualicen automáticamente cuando cambien las direcciones IP de dominio.",
"guid": "468a142a-2b62-4379-90d1-46a7d351716f",
"service": "Azure Firewall",
- "text": "Use el filtrado de FQDN en las reglas de red. Debe habilitar la configuración del proxy DNS de Azure Firewall para usar FQDN en las reglas de red.",
+ "text": "Utilice el filtrado de FQDN en las reglas de red. Debe habilitar la configuración del proxy DNS de Azure Firewall para usar FQDN en las reglas de red.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -78,7 +78,7 @@
"description": "Use etiquetas FQDN en las reglas de aplicación de Azure Firewall para representar un grupo de FQDN asociados a servicios conocidos de Microsoft. Este método simplifica la administración de las reglas de seguridad de la red.",
"guid": "f8f92e49-b7ed-40cc-ad7b-3431067dd488",
"service": "Azure Firewall",
- "text": "Use etiquetas FQDN en las reglas de la aplicación para proporcionar acceso selectivo a servicios específicos de Microsoft.
Puede usar una etiqueta FQDN en las reglas de la aplicación para permitir el tráfico de red de salida necesario a través del firewall para servicios específicos de Azure, como Microsoft 365, Windows 365 y Microsoft Intune.",
+ "text": "Use etiquetas FQDN en las reglas de la aplicación para proporcionar acceso selectivo a servicios específicos de Microsoft.
Puede usar una etiqueta FQDN en las reglas de la aplicación para permitir el tráfico de red saliente necesario a través del firewall para servicios específicos de Azure, como Microsoft 365, Windows 365 y Microsoft Intune.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -110,7 +110,7 @@
"description": "Configure un plan de protección contra DDoS de Azure para que pueda administrar de forma centralizada la protección contra DDoS junto con las directivas de firewall. Este enfoque agiliza la forma en que administra la seguridad de su red y simplifica la forma en que implementa y supervisa los procesos.",
"guid": "fe3488cd-72a6-4672-b26b-64b1a0e9f625",
"service": "Azure Firewall",
- "text": "Use Firewall Manager para crear y asociar un plan de Azure DDoS Protection con la red virtual del centro. Este enfoque no se aplica a Virtual WAN.",
+ "text": "Use Firewall Manager para crear y asociar un plan de Azure DDoS Protection con la red virtual del centro de conectividad. Este enfoque no se aplica a Virtual WAN.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -118,7 +118,7 @@
"description": "Apague estas implementaciones durante las horas de menor actividad o cuando estén inactivas para reducir los gastos innecesarios, pero mantenga la seguridad y el rendimiento durante los momentos críticos.",
"guid": "463b7549-f012-4554-a6df-4ea62350cc52",
"service": "Azure Firewall",
- "text": "Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse de forma continua. Es posible que tenga entornos de desarrollo o prueba que solo use durante el horario comercial. Para más información, consulte Desasignación y asignación de Azure Firewall.",
+ "text": "Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse continuamente. Es posible que tenga entornos de desarrollo o pruebas que solo use durante el horario comercial. Para más información, consulte Desasignación y asignación de Azure Firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -126,7 +126,7 @@
"description": "Optimice las cargas de trabajo que generan la mayor cantidad de tráfico a través del firewall para reducir el volumen de tráfico, lo que disminuye la carga en el firewall y minimiza los costos de procesamiento de datos y ancho de banda.",
"guid": "ccd04d1a-611b-4c77-aef7-96d1ac1470d1",
"service": "Azure Firewall",
- "text": "Revise periódicamente el tráfico que Azure Firewall procesa y busque optimizaciones de carga de trabajo de origen. El registro de flujos superiores, también conocido como registro de flujos pesados, muestra las conexiones principales que contribuyen al rendimiento más alto a través del firewall.",
+ "text": "Revise periódicamente el tráfico que Azure Firewall procesa y encuentre las optimizaciones de la carga de trabajo de origen. El registro de flujos principales, también conocido como registro de flujos pesados, muestra las conexiones principales que contribuyen al rendimiento más alto a través del firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -134,7 +134,7 @@
"description": "Utilice este enfoque para detectar implementaciones rentables a lo largo del tiempo y eliminar los recursos no utilizados, lo que evita costos innecesarios.",
"guid": "9ddcb977-4f4d-4c98-a7bc-daad82bf79fb",
"service": "Azure Firewall",
- "text": "Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Analice las métricas de supervisión y las UDR asociadas a las subredes que apuntan a la IP privada del firewall. Tenga en cuenta también otras validaciones y documentación interna sobre el entorno y las implementaciones. Por ejemplo, analice las reglas clásicas de NAT, red y aplicación para Azure Firewall. Y ten en cuenta tu configuración. Por ejemplo, puede configurar la configuración del proxy DNS en Deshabilitado. Para más información, consulte Supervisión de Azure Firewall.",
+ "text": "Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Analice las métricas de supervisión y las UDR asociadas a las subredes que apuntan a la IP privada del firewall. Tenga en cuenta también otras validaciones y documentación interna sobre el entorno y las implementaciones. Por ejemplo, analice las reglas clásicas de NAT, red y aplicación para Azure Firewall. Y ten en cuenta tu configuración. Por ejemplo, puede configurar la opción de proxy DNS en Deshabilitado. Para más información, consulte Supervisión de Azure Firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -142,7 +142,7 @@
"description": "Utilice correctamente Firewall Manager y sus políticas para reducir los costos operativos, aumentar la eficiencia y reducir la sobrecarga de administración.",
"guid": "a42cec48-b5d7-467a-8296-4864c6e9b413",
"service": "Azure Firewall",
- "text": "Revise detenidamente las políticas, las asociaciones y la herencia de Firewall Manager para optimizar los costos. Las políticas se facturan en función de las asociaciones de firewall. Una política con cero o una asociación de firewall es gratuita. Una política con varias asociaciones de firewall se factura a una tarifa fija. Para obtener más información, consulte Precios de Firewall Manager.",
+ "text": "Revise detenidamente las políticas, las asociaciones y la herencia de Firewall Manager para optimizar el costo. Las políticas se facturan en función de las asociaciones de firewall. Una política con cero o una asociación de firewall es gratuita. Una política con varias asociaciones de firewall se factura a una tarifa fija. Para obtener más información, consulte Precios de Firewall Manager.",
"type": "recommendation",
"waf": "Costar"
},
@@ -150,15 +150,15 @@
"description": "Elimine las direcciones IP no utilizadas para reducir costos.",
"guid": "407db414-2814-4803-9b80-be5ff2a97950",
"service": "Azure Firewall",
- "text": "Revise todas las direcciones IP públicas de su configuración y desvincule y elimine las que no utilice. Evalúe el uso del puerto de traducción de direcciones de red de origen (SNAT) antes de eliminar cualquier dirección IP. Para más información, consulte Supervisión de los registros y métricas de Azure Firewall y el uso de puertos SNAT.",
+ "text": "Revise todas las direcciones IP públicas de su configuración y desvincule y elimine las que no use. Evalúe el uso del puerto de traducción de direcciones de red de origen (SNAT) antes de eliminar cualquier dirección IP. Para más información, consulte Supervisión de los registros y las métricas de Azure Firewall y el uso de puertos SNAT.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Habilite los registros de diagnóstico para optimizar las herramientas y estrategias de supervisión de Azure Firewall. Utilice registros de firewall estructurados para estructurar los datos de registro de modo que sean fáciles de buscar, filtrar y analizar. Las últimas herramientas de supervisión se basan en este tipo de registro, por lo que suele ser un requisito previo.",
+ "description": "Habilite los registros de diagnóstico para optimizar las herramientas y estrategias de supervisión de Azure Firewall. Utilice los registros de firewall estructurados para estructurar los datos de registro de modo que sean fáciles de buscar, filtrar y analizar. Las herramientas de supervisión más recientes se basan en este tipo de registro, por lo que suele ser un requisito previo.",
"guid": "fb2c3215-9576-49d1-a936-e302ef9049c2",
"service": "Azure Firewall",
- "text": "Habilite los registros de diagnóstico para Azure Firewall. Use registros o libros de firewall para supervisar Azure Firewall. También puede usar los registros de actividad para auditar las operaciones en los recursos de Azure Firewall. Utilice el formato de registros de firewall estructurado. Utilice únicamente el formato de registros de diagnóstico anterior si tiene una herramienta existente que lo requiera. No habilite ambos formatos de registro al mismo tiempo.",
+ "text": "Habilite los registros de diagnóstico para Azure Firewall. Use registros o libros de firewall para supervisar Azure Firewall. También puede usar registros de actividad para auditar las operaciones en los recursos de Azure Firewall. Utilice el formato de registros de firewall estructurado. Utilice únicamente el formato de registros de diagnóstico anterior si tiene una herramienta existente que lo requiera. No habilite ambos formatos de registro al mismo tiempo.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -171,7 +171,7 @@
"waf": "Operaciones"
},
{
- "description": "Configure alertas para eventos clave para notificar a los operadores antes de que surjan posibles problemas, ayudar a prevenir interrupciones e iniciar ajustes rápidos de capacidad.",
+ "description": "Configure alertas de eventos clave para notificar a los operadores antes de que surjan posibles problemas, ayudar a prevenir interrupciones e iniciar ajustes rápidos de capacidad.",
"guid": "79268d8a-5829-4fb3-a1c6-d7ee9c980cd4",
"service": "Azure Firewall",
"text": "Supervise los registros y las métricas de Azure Firewall y cree alertas para la capacidad de Azure Firewall. Cree alertas para supervisar el rendimiento, el estado de mantenimiento del firewall, la utilización del puerto SNAT y las métricas de sondeo de latencia de AZFW.",
@@ -179,7 +179,7 @@
"waf": "Operaciones"
},
{
- "description": "Use el análisis de directivas para analizar el impacto de las directivas de Azure Firewall. Identifique los posibles problemas en sus políticas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
+ "description": "Use el análisis de directivas para analizar el impacto de las directivas de Azure Firewall. Identifique los posibles problemas de las directivas, como el cumplimiento de los límites de las directivas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
"guid": "63b266a4-285f-4fd4-a0fb-b6bb4c1ce75b",
"service": "Azure Firewall",
"text": "Revise periódicamente el panel de análisis de políticas para identificar posibles problemas.",
@@ -187,7 +187,7 @@
"waf": "Operaciones"
},
{
- "description": "Use las consultas de KQL para identificar rápidamente los eventos dentro del firewall y comprobar qué regla se desencadena o qué regla permite o bloquea una solicitud.",
+ "description": "Utilice las consultas de KQL para identificar rápidamente los eventos dentro del firewall y comprobar qué regla se ha activado o qué regla permite o bloquea una solicitud.",
"guid": "37cc2cc2-5700-4e4b-bb0b-86e6acb11092",
"service": "Azure Firewall",
"text": "Comprenda las consultas de KQL para que pueda usar los registros de Azure Firewall para analizar y solucionar problemas rápidamente. Azure Firewall proporciona consultas de ejemplo.",
@@ -195,7 +195,7 @@
"waf": "Operaciones"
},
{
- "description": "Utilice el análisis de políticas para identificar posibles problemas en sus políticas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
+ "description": "Utilice el análisis de políticas para identificar posibles problemas en las directivas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
"guid": "e9cf81c7-6938-44e1-83fe-0c16af8214fd",
"service": "Azure Firewall",
"text": "Use el panel de análisis de directivas para identificar formas de optimizar las directivas de Azure Firewall.",
@@ -214,7 +214,7 @@
"description": "Este enfoque aumenta efectivamente el número de direcciones IP que puede cubrir sin exceder el límite. Para cada regla, Azure multiplica los puertos por direcciones IP. Por lo tanto, si una regla tiene cuatro intervalos de direcciones IP y cinco puertos, consume 20 reglas de red.",
"guid": "6acef044-ef2f-47b0-8463-5de890902930",
"service": "Azure Firewall",
- "text": "Utilice grupos de direcciones IP para resumir los intervalos de direcciones IP y evitar superar el límite de reglas de red de origen o destino único. Azure Firewall trata el grupo de direcciones IP como una única dirección al crear reglas de red.",
+ "text": "Utilice los grupos de direcciones IP para resumir los intervalos de direcciones IP y evitar superar el límite de las reglas de red de origen o destino único. Azure Firewall trata el grupo IP como una única dirección al crear reglas de red.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -227,7 +227,7 @@
"waf": "Rendimiento"
},
{
- "description": "Habilite IDPS en modo de alerta y denegación para detectar y prevenir actividades maliciosas en la red. Esta característica podría introducir una penalización del rendimiento. Comprenda el efecto en su carga de trabajo para que pueda planificar en consecuencia.",
+ "description": "Habilite IDPS en modo de alerta y denegación para detectar y prevenir actividad de red maliciosa. Esta característica podría introducir una penalización en el rendimiento. Comprenda el efecto en su carga de trabajo para que pueda planificar en consecuencia.",
"guid": "a281c1d2-e2da-458f-ad57-d67d19b8377e",
"service": "Azure Firewall",
"text": "Evalúe el impacto en el rendimiento de IDPS en modo de alerta y denegación. Para más información, consulte Rendimiento de Azure Firewall.",
@@ -246,7 +246,7 @@
"metadata": {
"name": "Azure Firewall Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -273,31 +273,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azurefirewall_sg_checklist.ja.json b/checklists-ext/azurefirewall_sg_checklist.ja.json
index b483705d0..7456acf6c 100644
--- a/checklists-ext/azurefirewall_sg_checklist.ja.json
+++ b/checklists-ext/azurefirewall_sg_checklist.ja.json
@@ -246,7 +246,7 @@
"metadata": {
"name": "Azure Firewall Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -273,31 +273,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azurefirewall_sg_checklist.ko.json b/checklists-ext/azurefirewall_sg_checklist.ko.json
index f59d180d1..2413e08bb 100644
--- a/checklists-ext/azurefirewall_sg_checklist.ko.json
+++ b/checklists-ext/azurefirewall_sg_checklist.ko.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "여러 가용성 영역에 Azure Firewall을 배포하여 특정 수준의 복원력을 유지합니다. 한 영역에서 중단이 발생하면 다른 영역에서 트래픽을 계속 처리합니다.",
+ "description": "여러 가용성 영역에 Azure Firewall을 배포하여 특정 수준의 복원력을 유지합니다. 한 영역에서 중단이 발생하면 다른 영역에서 계속 트래픽을 처리합니다.",
"guid": "881f08f8-32f0-420d-b4f7-f0660a0402cb",
"service": "Azure Firewall",
"text": "여러 가용성 영역에 Azure Firewall을 배포합니다.",
@@ -22,15 +22,15 @@
"description": "Azure 리소스를 인터넷에 직접 노출하지 않도록 강제 터널링을 사용합니다. 이 접근 방식은 공격 표면을 줄이고 외부 위협의 위험을 최소화합니다. 회사 정책 및 규정 준수 요구 사항을 보다 효과적으로 적용하려면 모든 인터넷 바인딩 트래픽을 온-프레미스 방화벽 또는 NVA를 통해 라우팅합니다.",
"guid": "11c69324-ff8f-48aa-9e9e-9c954e29a121",
"service": "Azure Firewall",
- "text": "모든 인터넷 바인딩 트래픽을 인터넷으로 직접 라우팅하는 대신 지정된 다음 홉으로 라우팅해야 하는 경우 강제 터널링 모드에서 Azure Firewall을 구성합니다. 이 권장 사항은 Virtual WAN에는 적용되지 않습니다.
Azure Firewall은 인터넷에 직접 연결되어 있어야 합니다. AzureFirewallSubnet이 Border Gateway Protocol을 통해 온-프레미스 네트워크에 대한 기본 경로를 학습하는 경우 강제 터널링 모드에서 Azure Firewall을 구성해야 합니다. 강제 터널링 기능을 사용하여 Azure Firewall 관리 서브넷에 대한 다른 /26 주소 공간을 추가할 수 있습니다. 서브넷 이름을 AzureFirewallManagementSubnet으로 지정합니다. 강제 터널링 모드에서 다시 구성할 수 없는 기존 Azure Firewall 인스턴스가 있는 경우 0.0.0.0/0 경로를 사용하여 UDR을 만듭니다. NextHopType 값을 Internet으로 설정합니다. 인터넷 연결을 유지하려면 UDR을 AzureFirewallSubnet과 연결합니다. 강제 터널링 모드에서 Azure Firewall을 구성할 때 완전한 프라이빗 데이터 평면을 배포하려면 공용 IP 주소를 없음으로 설정합니다. 그러나 관리 평면에는 여전히 관리 목적으로만 공용 IP가 필요합니다. 가상 및 온-프레미스 네트워크의 내부 트래픽은 해당 공용 IP를 사용하지 않습니다.",
+ "text": "모든 인터넷 바인딩 트래픽을 인터넷으로 직접 라우팅하는 대신 지정된 다음 홉으로 라우팅해야 하는 경우 강제 터널링 모드에서 Azure Firewall을 구성합니다. 이 권장 사항은 Virtual WAN에는 적용되지 않습니다.
Azure Firewall은 인터넷에 직접 연결되어 있어야 합니다. AzureFirewallSubnet이 Border Gateway Protocol을 통해 온-프레미스 네트워크에 대한 기본 경로를 학습하는 경우 강제 터널링 모드에서 Azure Firewall을 구성해야 합니다. 강제 터널링 기능을 사용하여 Azure Firewall 관리 서브넷에 대한 다른 /26 주소 공간을 추가할 수 있습니다. 서브넷 이름을 AzureFirewallManagementSubnet으로 지정합니다. 강제 터널링 모드에서 다시 구성할 수 없는 기존 Azure Firewall 인스턴스가 있는 경우 0.0.0.0/0 경로를 사용하여 UDR을 만듭니다. NextHopType 값을 Internet으로 설정합니다. 인터넷 연결을 유지하려면 UDR을 AzureFirewallSubnet과 연결합니다. 강제 터널링 모드에서 Azure Firewall을 구성할 때 완전 프라이빗 데이터 평면을 배포하려면 공용 IP 주소를 없음으로 설정합니다. 그러나 관리 플레인에는 관리 목적으로만 공용 IP가 필요합니다. 가상 및 온-프레미스 네트워크의 내부 트래픽은 해당 공용 IP를 사용하지 않습니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "세분화된 정책이 특정 지역의 요구 사항을 충족할 수 있도록 계층적 구조로 규칙을 구성합니다. 각 정책에는 특정 우선 순위, 작업 및 처리 순서가 있는 서로 다른 DNAT(Destination Network Address Translation), 네트워크 및 애플리케이션 규칙 집합이 포함될 수 있습니다.",
+ "description": "세분화된 정책이 특정 지역의 요구 사항을 충족할 수 있도록 계층 구조로 규칙을 구성합니다. 각 정책에는 특정 우선 순위, 작업 및 처리 순서가 있는 서로 다른 DNAT(Destination Network Address Translation), 네트워크 및 애플리케이션 규칙 집합이 포함될 수 있습니다.",
"guid": "29a3b176-03b3-4273-b9f8-cdddee154009",
"service": "Azure Firewall",
- "text": "계층 구조에서 방화벽 정책에 대한 규칙을 만들어 중앙 기본 정책을 오버레이합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.
최소 권한 액세스 Zero Trust 원칙에 따라 규칙 만들기Create your rules based on the least-privilege access Zero Trust principle",
+ "text": "계층 구조에서 방화벽 정책에 대한 규칙을 만들어 중앙 기본 정책을 오버레이합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.
최소 권한 액세스 제로 트러스트 원칙에 따라 규칙 만들기Create your rules based on the least-privilege access Zero Trust principle",
"type": "recommendation",
"waf": "안전"
},
@@ -38,12 +38,12 @@
"description": "Azure Firewall의 보안 파트너 공급자가 인터넷 트래픽에 대한 고급 보호를 제공하는 동급 최고의 클라우드 보안 제품을 활용할 수 있도록 합니다. 이러한 제공업체는 전문화된 사용자 인식 필터링 및 포괄적인 위협 탐지 기능을 제공하여 전반적인 보안 태세를 강화합니다.",
"guid": "f03b413a-c06c-4f22-98ad-6798b74f825e",
"service": "Azure Firewall",
- "text": "아웃바운드 연결을 보호하기 위해 Firewall Manager 내에서 지원되는 보안 파트너 공급자를 구성합니다.
이 시나리오에서는 IPsec 터널을 사용하여 공급자의 인프라에 연결하기 때문에 허브에 S2S VPN 게이트웨이가 있는 Virtual WAN이 필요합니다. 관리형 보안 서비스 제공업체는 추가 라이선스 비용을 부과하고 IPsec 연결의 처리량을 제한할 수 있습니다. Zscaler Cloud Connector와 같은 대체 솔루션을 사용할 수도 있습니다.",
+ "text": "아웃바운드 연결을 보호하기 위해 Firewall Manager 내에서 지원되는 보안 파트너 공급자를 구성합니다.
이 시나리오에서는 IPsec 터널을 사용하여 공급자의 인프라에 연결하기 때문에 허브에 S2S VPN 게이트웨이가 있는 Virtual WAN이 필요합니다. 관리형 보안 서비스 제공업체는 추가 라이선스 비용을 부과하고 IPsec 연결에 대한 처리량을 제한할 수 있습니다. Zscaler Cloud Connector와 같은 대체 솔루션을 사용할 수도 있습니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "이 기능을 사용하면 가상 네트워크의 클라이언트가 DNS 서버로 Azure Firewall을 가리킬 수 있습니다. 이 기능은 직접 액세스 및 노출되지 않는 내부 DNS 인프라를 보호합니다.",
+ "description": "이 기능을 사용하면 가상 네트워크의 클라이언트가 DNS 서버로 Azure Firewall 가리킵니다. 이 기능은 직접 액세스 및 노출되지 않는 내부 DNS 인프라를 보호합니다.",
"guid": "98a53328-cf36-4d0e-b7dc-a15a8957ab3b",
"service": "Azure Firewall",
"text": "Azure Firewall DNS 프록시 구성을 사용하도록 설정합니다.
또한 DNS 쿼리를 전달하는 데 사용자 지정 DNS를 사용하도록 Azure Firewall을 구성합니다.",
@@ -51,10 +51,10 @@
"waf": "안전"
},
{
- "description": null,
+ "description": "방화벽을 통해 트래픽을 전송하여 트래픽을 검사하고 악성 트래픽을 식별 및 차단할 수 있습니다.
웹 트래픽이 방화벽의 개인 IP 주소에 도달하여 UDR을 사용하지 않고 방화벽에서 직접 나가도록 Azure Firewall을 아웃바운드 트래픽에 대한 명시적 프록시로 사용합니다. 또한 이 기능을 사용하면 기존 네트워크 경로를 수정하지 않고도 여러 방화벽을 쉽게 사용할 수 있습니다.",
"guid": "5a33a8c3-32ad-4df5-b10e-ae88d9341652",
"service": "Azure Firewall",
- "text": "스포크-스포크, 스포크-인터넷 및 스포크-하이브리드 연결을 위한 기존 허브 및 스포크 아키텍처에서 Azure Firewall을 통해 트래픽을 강제 적용하도록 UDR을 구성합니다.
Virtual WAN에서 허브에 통합된 Azure Firewall 인스턴스를 통해 프라이빗 트래픽 또는 인터넷 트래픽을 리디렉션하도록 라우팅 의도 및 정책을 구성합니다.
UDR을 적용할 수 없고 웹 트래픽 리디렉션만 필요한 경우 아웃바운드 경로에서 Azure Firewall을 명시적 프록시로 사용합니다. Azure Firewall을 프록시로 구성할 때 웹 브라우저와 같은 전송 애플리케이션에서 프록시 설정을 구성할 수 있습니다.",
+ "text": "스포크 투 스포크, 스포크 투 스포크 및 스포크-하이브리드 연결을 위한 기존 허브 및 스포크 아키텍처에서 Azure Firewall을 통해 트래픽을 강제 적용하도록 UDR을 구성합니다.
Virtual WAN에서 허브에 통합된 Azure Firewall 인스턴스를 통해 프라이빗 트래픽 또는 인터넷 트래픽을 리디렉션하도록 라우팅 의도 및 정책을 구성합니다.
UDR을 적용할 수 없고 웹 트래픽 리디렉션만 필요한 경우 아웃바운드 경로에서 Azure Firewall을 명시적 프록시로 사용합니다. Azure Firewall을 프록시로 구성할 때 웹 브라우저와 같은 전송 애플리케이션에서 프록시 설정을 구성할 수 있습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -75,7 +75,7 @@
"waf": "안전"
},
{
- "description": null,
+ "description": "Azure Firewall 애플리케이션 규칙에서 FQDN 태그를 사용하여 잘 알려진 Microsoft 서비스와 연결된 FQDN 그룹을 나타냅니다. 이 방법을 사용하면 네트워크 보안 규칙의 관리가 간소화됩니다.",
"guid": "f8f92e49-b7ed-40cc-ad7b-3431067dd488",
"service": "Azure Firewall",
"text": "응용 프로그램 규칙에서 FQDN 태그를 사용하여 특정 Microsoft 서비스에 대한 선택적 액세스를 제공합니다.
애플리케이션 규칙에서 FQDN 태그를 사용하여 Microsoft 365, Windows 365 및 Microsoft Intune 같은 특정 Azure 서비스에 대해 방화벽을 통해 필요한 아웃바운드 네트워크 트래픽을 허용할 수 있습니다.",
@@ -91,10 +91,10 @@
"waf": "안전"
},
{
- "description": "Azure Firewall에서 IDPS 필터링을 사용하도록 설정하면 네트워크 트래픽에 대한 실시간 모니터링 및 분석을 제공하여 악의적인 활동을 감지하고 방지할 수 있습니다. 이 기능은 시그니처 기반 탐지를 사용하여 알려진 위협을 신속하게 식별하고 피해를 입히기 전에 차단합니다. 자세한 내용은 남용 감지를 참조하세요.",
+ "description": "Azure Firewall에서 IDPS 필터링 사용은 네트워크 트래픽에 대한 실시간 모니터링 및 분석을 제공하여 악의적인 활동을 감지하고 방지합니다. 이 기능은 시그니처 기반 탐지를 사용하여 알려진 위협을 신속하게 식별하고 피해를 입히기 전에 차단합니다. 자세한 내용은 남용 감지를 참조하세요.",
"guid": "754d917c-b22f-4fe7-92b1-d0d88b5b1873",
"service": "Azure Firewall",
- "text": "경고 또는 경고 및 거부 모드에서 IDPS를 활성화합니다. 이 기능이 성능에 미치는 영향을 고려합니다.",
+ "text": "경고 또는 경고 및 거부 모드에서 IDPS를 사용하도록 설정합니다. 이 기능이 성능에 미치는 영향을 고려합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -123,10 +123,10 @@
"waf": "비용"
},
{
- "description": "방화벽을 통해 가장 많은 트래픽을 생성하는 워크로드를 최적화하여 트래픽 볼륨을 줄임으로써 방화벽의 부하를 줄이고 데이터 처리 및 대역폭 비용을 최소화합니다.",
+ "description": "방화벽을 통해 가장 많은 트래픽을 생성하는 워크로드를 최적화하여 트래픽 볼륨을 줄여 방화벽의 부하를 줄이고 데이터 처리 및 대역폭 비용을 최소화합니다.",
"guid": "ccd04d1a-611b-4c77-aef7-96d1ac1470d1",
"service": "Azure Firewall",
- "text": "Azure Firewall이 처리하는 트래픽을 정기적으로 검토하고 원래 워크로드 최적화를 찾습니다. 팻 흐름 로그라고도 하는 상위 흐름 로그는 방화벽을 통해 가장 높은 처리량에 기여하는 상위 연결을 보여 줍니다.",
+ "text": "Azure Firewall에서 처리하는 트래픽을 정기적으로 검토하고 원래 워크로드 최적화를 찾습니다. 뚱뚱한 흐름 로그라고도 하는 상위 흐름 로그는 방화벽을 통해 가장 높은 처리량에 기여하는 상위 연결을 보여 줍니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -139,10 +139,10 @@
"waf": "비용"
},
{
- "description": null,
+ "description": "Firewall Manager 및 해당 정책을 적절하게 사용하여 운영 비용을 절감하고 효율성을 높이며 관리 오버헤드를 줄입니다.",
"guid": "a42cec48-b5d7-467a-8296-4864c6e9b413",
"service": "Azure Firewall",
- "text": "Firewall Manager 정책, 연결 및 상속을 신중하게 검토하여 비용을 최적화합니다. 정책은 방화벽 연결을 기준으로 요금이 청구됩니다. 방화벽 연결이 0개 또는 1개인 정책은 무료입니다. 여러 방화벽 연결이 있는 정책은 고정 요율로 청구됩니다. 자세한 내용은 Firewall Manager 요금을 참조하세요.",
+ "text": "Firewall Manager 정책, 연결 및 상속을 신중하게 검토하여 비용을 최적화합니다. 정책은 방화벽 연결을 기준으로 청구됩니다. 방화벽 연결이 0개 또는 1개 있는 정책은 무료입니다. 여러 방화벽 연결이 있는 정책은 고정 요율로 청구됩니다. 자세한 내용은 Firewall Manager 요금을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -150,7 +150,7 @@
"description": "사용하지 않는 IP 주소를 삭제하여 비용을 절감합니다.",
"guid": "407db414-2814-4803-9b80-be5ff2a97950",
"service": "Azure Firewall",
- "text": "구성의 모든 공용 IP 주소를 검토하고 사용하지 않는 IP 주소의 연결을 끊고 삭제합니다. IP 주소를 제거하기 전에 원본 SNAT(네트워크 주소 변환) 포트 사용량을 평가합니다. 자세한 내용은 Azure Firewall 로그 및 메트릭 모니터링 및 SNAT 포트 사용량을 참조하세요.",
+ "text": "구성의 모든 공용 IP 주소를 검토하고 사용하지 않는 IP 주소의 연결을 끊고 삭제합니다. IP 주소를 제거하기 전에 SNAT(원본 네트워크 주소 변환) 포트 사용량을 평가합니다. 자세한 내용은 Azure Firewall 로그 및 메트릭 모니터링 및 SNAT 포트 사용량을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -158,12 +158,12 @@
"description": "진단 로그를 사용하도록 설정하여 Azure Firewall에 대한 모니터링 도구 및 전략을 최적화합니다. 구조화된 방화벽 로그를 사용하여 로그 데이터를 구조화하여 쉽게 검색, 필터링 및 분석할 수 있습니다. 최신 모니터링 도구는 이러한 유형의 로그를 기반으로 하므로 필수 구성 요소인 경우가 많습니다.",
"guid": "fb2c3215-9576-49d1-a936-e302ef9049c2",
"service": "Azure Firewall",
- "text": "Azure Firewall에 대한 진단 로그를 사용하도록 설정합니다. 방화벽 로그 또는 통합 문서를 사용하여 Azure Firewall을 모니터링합니다. 활동 로그를 사용하여 Azure Firewall 리소스에 대한 작업을 감사할 수도 있습니다. 구조화된 방화벽 로그 형식을 사용합니다. 이전 진단 로그 형식은 필요한 기존 도구가 있는 경우에만 사용합니다. 두 로깅 형식을 동시에 사용하도록 설정하지 마세요.",
+ "text": "Azure Firewall에 대한 진단 로그를 사용하도록 설정합니다. 방화벽 로그 또는 통합 문서를 사용하여 Azure Firewall을 모니터링합니다. 활동 로그를 사용하여 Azure Firewall 리소스에 대한 작업을 감사할 수도 있습니다. 구조적 방화벽 로그 형식을 사용합니다. 이전 진단 로그 형식은 필요한 기존 도구가 있는 경우에만 사용합니다. 두 로깅 형식을 동시에 사용하도록 설정하지 마세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "Azure Firewall 통합 문서를 사용하여 Azure Firewall 이벤트에서 중요한 인사이트를 추출하고, 애플리케이션 및 네트워크 규칙을 분석하고, URL, 포트 및 주소에서 방화벽 활동에 대한 통계를 검토할 수 있습니다.",
+ "description": "Azure Firewall 통합 문서를 사용하여 Azure Firewall 이벤트에서 중요한 인사이트를 추출하고, 애플리케이션 및 네트워크 규칙을 분석하고, URL, 포트 및 주소에서 방화벽 활동에 대한 통계를 검사할 수 있습니다.",
"guid": "913ed2e5-c63c-4325-8578-965c5c3c4b79",
"service": "Azure Firewall",
"text": "기본 제공 Azure Firewall 통합 문서를 사용합니다.",
@@ -203,15 +203,15 @@
"waf": "공연"
},
{
- "description": "자주 사용하는 규칙을 규칙 집합의 상위에 배치하여 처리 대기 시간을 최적화합니다. Azure Firewall은 규칙 유형, 상속, 규칙 컬렉션 그룹 우선 순위 및 규칙 컬렉션 우선 순위에 따라 규칙을 처리합니다. Azure Firewall은 우선 순위가 높은 규칙 컬렉션 그룹을 먼저 처리합니다. 규칙 컬렉션 그룹 내에서 Azure Firewall은 우선 순위가 가장 높은 규칙 컬렉션을 먼저 처리합니다.",
+ "description": "자주 사용하는 규칙을 규칙 집합의 높은 위치에 배치하여 처리 대기 시간을 최적화합니다. Azure Firewall은 규칙 유형, 상속, 규칙 컬렉션 그룹 우선 순위 및 규칙 컬렉션 우선 순위에 따라 규칙을 처리합니다. Azure Firewall은 우선 순위가 높은 규칙 컬렉션 그룹을 먼저 처리합니다. 규칙 컬렉션 그룹 내에서 Azure Firewall은 우선 순위가 가장 높은 규칙 컬렉션을 먼저 처리합니다.",
"guid": "4413e944-e222-419c-bc01-54f518dace78",
"service": "Azure Firewall",
- "text": "자주 사용하는 규칙을 그룹의 초기에 배치하여 규칙 집합이 큰 Azure Firewall 정책에 대한 대기 시간을 최적화합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.",
+ "text": "자주 사용하는 규칙을 그룹의 초기에 배치하여 큰 규칙 집합이 있는 Azure Firewall 정책에 대한 대기 시간을 최적화합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "이 방법을 사용하면 제한을 초과하지 않고 처리할 수 있는 IP 주소 수가 효과적으로 늘어납니다. 각 규칙에 대해 Azure는 포트에 IP 주소를 곱합니다. 따라서 한 규칙에 4개의 IP 주소 범위와 5개의 포트가 있는 경우 20개의 네트워크 규칙을 사용합니다.",
+ "description": "이 방법을 사용하면 제한을 초과하지 않고 처리할 수 있는 IP 주소 수를 효과적으로 늘릴 수 있습니다. 각 규칙에 대해 Azure는 포트에 IP 주소를 곱합니다. 따라서 하나의 규칙에 4개의 IP 주소 범위와 5개의 포트가 있는 경우 20개의 네트워크 규칙을 사용합니다.",
"guid": "6acef044-ef2f-47b0-8463-5de890902930",
"service": "Azure Firewall",
"text": "IP 그룹을 사용하여 IP 주소 범위를 요약하고 고유한 원본 또는 고유한 대상 네트워크 규칙의 제한을 초과하지 않도록 합니다. Azure Firewall은 네트워크 규칙을 만들 때 IP 그룹을 단일 주소로 처리합니다.",
@@ -227,7 +227,7 @@
"waf": "공연"
},
{
- "description": "경고 및 거부 모드에서 IDPS를 활성화하여 악의적인 네트워크 활동을 탐지하고 방지합니다. 이 기능을 사용하면 성능이 저하될 수 있습니다. 그에 따라 계획할 수 있도록 워크로드에 미치는 영향을 이해합니다.",
+ "description": "경고 및 거부 모드에서 IDPS를 활성화하여 악의적인 네트워크 활동을 탐지하고 방지합니다. 이 기능으로 인해 성능 저하가 발생할 수 있습니다. 그에 따라 계획할 수 있도록 업무량에 미치는 영향을 이해합니다.",
"guid": "a281c1d2-e2da-458f-ad57-d67d19b8377e",
"service": "Azure Firewall",
"text": "경고 및 거부 모드에서 IDPS의 성능 영향을 평가합니다. 자세한 내용은 Azure Firewall 성능을 참조하세요.",
@@ -246,7 +246,7 @@
"metadata": {
"name": "Azure Firewall Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -273,31 +273,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azurefirewall_sg_checklist.pt.json b/checklists-ext/azurefirewall_sg_checklist.pt.json
index 5abd3e763..3da7960f1 100644
--- a/checklists-ext/azurefirewall_sg_checklist.pt.json
+++ b/checklists-ext/azurefirewall_sg_checklist.pt.json
@@ -246,7 +246,7 @@
"metadata": {
"name": "Azure Firewall Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -273,31 +273,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azurefirewall_sg_checklist.zh-Hant.json b/checklists-ext/azurefirewall_sg_checklist.zh-Hant.json
index 3b17b8445..14e2c1322 100644
--- a/checklists-ext/azurefirewall_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azurefirewall_sg_checklist.zh-Hant.json
@@ -246,7 +246,7 @@
"metadata": {
"name": "Azure Firewall Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -273,31 +273,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.en.json b/checklists-ext/azurefrontdoor_sg_checklist.en.json
index e00c8dc13..c5759b27e 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.en.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.en.json
@@ -245,6 +245,6 @@
"name": "Azure Front Door Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.es.json b/checklists-ext/azurefrontdoor_sg_checklist.es.json
index ebde68632..97d9e4b25 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.es.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.es.json
@@ -6,7 +6,7 @@
"description": "Puede seleccionar el mejor recurso de origen mediante una serie de pasos de decisión y su diseño. El origen seleccionado atiende el tráfico dentro del rango de latencia permitido en la proporción de ponderaciones especificada.",
"guid": "00d75bec-38c3-456d-86e6-42031076f429",
"service": "Azure Front Door",
- "text": "Elija un método de enrutamiento que admita su estrategia de implementación. El método ponderado, que distribuye el tráfico en función del coeficiente de ponderación configurado, admite modelos activo-activo. Un valor basado en prioridades que configura la región primaria para recibir todo el tráfico y enviar tráfico a la región secundaria como copia de seguridad admite modelos activo-pasivo. Combine los métodos anteriores con la latencia para que el origen con la latencia más baja reciba tráfico.",
+ "text": "Elija un método de enrutamiento que admita su estrategia de implementación. El método ponderado, que distribuye el tráfico en función del coeficiente de ponderación configurado, admite modelos activo-activo. Un valor basado en prioridad que configura la región primaria para recibir todo el tráfico y enviarlo a la región secundaria como copia de seguridad admite modelos activo-pasivo. Combine los métodos anteriores con la latencia para que el origen con la latencia más baja reciba tráfico.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -19,7 +19,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Los sondeos de estado habilitados forman parte de la implementación del patrón de supervisión de estado. Los sondeos de estado se aseguran de que Azure Front Door solo enruta el tráfico a las instancias que están en buen estado para controlar las solicitudes. Para obtener más información, consulte Procedimientos recomendados sobre sondeos de estado.",
+ "description": "Los sondeos de estado habilitados forman parte de la implementación del patrón de supervisión de estado. Los sondeos de estado se aseguran de que Azure Front Door solo enruta el tráfico a las instancias que están en buen estado para controlar las solicitudes. Para obtener más información, consulte Procedimientos recomendados para sondeos de estado.",
"guid": "f802e2c6-ea9b-4e0d-b3d1-b7c4d0b4aa26",
"service": "Azure Front Door",
"text": "Configure sondeos de estado en el origen. Configure Azure Front Door para realizar comprobaciones de estado a fin de determinar si la instancia de back-end está disponible y lista para seguir recibiendo solicitudes.",
@@ -30,7 +30,7 @@
"description": "Los tiempos de espera ayudan a evitar problemas de rendimiento y disponibilidad al finalizar las solicitudes que tardan más de lo esperado en completarse.",
"guid": "e1ec439d-2bc8-4e6e-b72f-1aafaa2aae58",
"service": "Azure Front Door",
- "text": "Establezca un tiempo de espera para reenviar solicitudes al back-end. Ajuste la configuración de tiempo de espera según las necesidades de sus terminales. Si no lo hace, Azure Front Door podría cerrar la conexión antes de que el origen envíe la respuesta. También puede reducir el tiempo de espera predeterminado para Azure Front Door si todos los orígenes tienen un tiempo de espera más corto. Para obtener más información, consulte Solución de problemas de solicitudes que no responden.",
+ "text": "Establezca un tiempo de espera para reenviar solicitudes al back-end. Ajuste la configuración del tiempo de espera según las necesidades de sus terminales. Si no lo hace, Azure Front Door podría cerrar la conexión antes de que el origen envíe la respuesta. También puede reducir el tiempo de espera predeterminado para Azure Front Door si todos los orígenes tienen un tiempo de espera más corto. Para obtener más información, consulte Solución de problemas de solicitudes que no responden.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -38,12 +38,12 @@
"description": "Establezca el mismo nombre de host para evitar un mal funcionamiento con la afinidad de sesión, la autenticación y la autorización. Para obtener más información, consulte Conservar el nombre de host HTTP original entre un proxy inverso y su aplicación web back-end.",
"guid": "dd9e850c-0ce5-4ac2-8d8b-53cd21925a8d",
"service": "Azure Front Door",
- "text": "Use el mismo nombre de host en Azure Front Door y en el origen. Azure Front Door puede reescribir el encabezado de host de las solicitudes entrantes, lo que resulta útil cuando hay varios nombres de dominio personalizados que se enrutan a un origen. Sin embargo, reescribir el encabezado del host puede causar problemas con las cookies de solicitud y el redireccionamiento de URL.",
+ "text": "Use el mismo nombre de host en Azure Front Door y en su origen. Azure Front Door puede reescribir el encabezado de host de las solicitudes entrantes, lo que resulta útil cuando hay varios nombres de dominio personalizados que se enrutan a un origen. Sin embargo, reescribir el encabezado del host puede causar problemas con las cookies de solicitud y el redireccionamiento de URL.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Con la afinidad de sesión, las conexiones de usuario permanecen en el mismo origen durante la sesión de usuario. Si ese origen deja de estar disponible, es posible que la experiencia del usuario se vea interrumpida.",
+ "description": "Con la afinidad de sesión, las conexiones de usuario permanecen en el mismo origen durante la sesión de usuario. Si ese origen deja de estar disponible, es posible que se interrumpa la experiencia del usuario.",
"guid": "66bc38be-1613-4bf5-b10b-f130eaff5140",
"service": "Azure Front Door",
"text": "Decida si la aplicación requiere afinidad de sesión. Si tiene requisitos de alta confiabilidad, le recomendamos que deshabilite la afinidad de sesión.",
@@ -59,7 +59,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Los conjuntos de reglas predeterminados se actualizan con frecuencia en función de los 10 tipos de ataque principales de OWASP y de la información de Microsoft Threat Intelligence. Los conjuntos de reglas especializadas detectan ciertos casos de uso. Por ejemplo, las reglas de bots clasifican los bots como buenos, malos o desconocidos en función de las direcciones IP del cliente. También bloquean los bots maliciosos y las direcciones IP conocidas y restringen el tráfico en función de la ubicación geográfica de las personas que llaman. Mediante el uso de una combinación de conjuntos de reglas, puede detectar y bloquear ataques con varias intenciones.",
+ "description": "Los conjuntos de reglas predeterminados se actualizan con frecuencia en función de los 10 tipos de ataque principales de OWASP y de la información de Microsoft Threat Intelligence. Los conjuntos de reglas especializadas detectan determinados casos de uso. Por ejemplo, las reglas de bots clasifican los bots como buenos, malos o desconocidos en función de las direcciones IP del cliente. También bloquean los bots maliciosos y las direcciones IP conocidas, y restringen el tráfico en función de la ubicación geográfica de las personas que llaman. Mediante el uso de una combinación de conjuntos de reglas, puede detectar y bloquear ataques con varias intenciones.",
"guid": "56baca49-9e07-4ea8-983f-6a580cee1b4b",
"service": "Azure Front Door",
"text": "Habilite los conjuntos de reglas de WAF que detectan y bloquean el tráfico potencialmente malintencionado. Esta función está disponible en el nivel Premium. Recomendamos estos conjuntos de reglas: - Predeterminado- Protección contra bots- Restricción de IP- Filtrado geográfico- Limitación de velocidad",
@@ -78,7 +78,7 @@
"description": "TLS garantiza que los intercambios de datos entre el explorador, Azure Front Door y los orígenes de back-end estén cifrados para evitar la manipulación. Key Vault ofrece compatibilidad con certificados administrados y renovación y rotación sencillas de certificados.",
"guid": "a34600e2-cbae-4bf6-b272-377ec3232184",
"service": "Azure Front Door",
- "text": "Habilite TLS de extremo a extremo, redireccionamiento de HTTP a HTTPS y certificados TLS administrados cuando corresponda. Revise los procedimientos recomendados de TLS para Azure Front Door. Utilice la versión 1.2 de TLS como la versión mínima permitida con cifrados que sean relevantes para su aplicación. Los certificados administrados de Azure Front Door deben ser la opción predeterminada para facilitar las operaciones. Sin embargo, si desea administrar el ciclo de vida de los certificados, use sus propios certificados en los puntos de conexión de dominio personalizado de Azure Front Door y almacénelos en Key Vault.",
+ "text": "Habilite TLS de extremo a extremo, redireccionamiento de HTTP a HTTPS y certificados TLS administrados cuando corresponda. Revise los procedimientos recomendados de TLS para Azure Front Door. Utilice la versión 1.2 de TLS como la versión mínima permitida con cifrados que sean relevantes para su aplicación. Los certificados administrados de Azure Front Door deben ser la opción predeterminada para facilitar las operaciones. Sin embargo, si desea administrar el ciclo de vida de los certificados, use sus propios certificados en los puntos de conexión de dominio personalizados de Azure Front Door y almacénelos en Key Vault.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -131,7 +131,7 @@
"waf": "Operaciones"
},
{
- "description": "Azure Front Door puede emitir y administrar certificados por usted. Esta función elimina la necesidad de renovar certificados y minimiza el riesgo de una interrupción debido a un certificado TLS no válido o caducado.",
+ "description": "Azure Front Door puede emitir y administrar certificados automáticamente. Esta función elimina la necesidad de renovar certificados y minimiza el riesgo de una interrupción debido a un certificado TLS no válido o caducado.",
"guid": "99d4c43f-e603-49ad-bf1e-47cec531a2f3",
"service": "Azure Front Door",
"text": "Utilice certificados TLS administrados cuando sea posible.",
@@ -150,7 +150,7 @@
"description": "Azure Front Door ofrece una solución de red de entrega de contenido sólida que almacena en caché el contenido en el perímetro de la red. El almacenamiento en caché reduce la carga en los servidores back-end y reduce el movimiento de datos a través de la red, lo que ayuda a descargar el uso del ancho de banda.",
"guid": "e8d431d1-8549-4d6d-a1da-ec67e7ef897e",
"service": "Azure Front Door",
- "text": "Habilite el almacenamiento en caché. Puede optimizar las cadenas de consulta para el almacenamiento en caché. En el caso de contenido puramente estático, omita las cadenas de consulta para maximizar el uso de la memoria caché. Si la aplicación usa cadenas de consulta, considere la posibilidad de incluirlas en la clave de caché. La inclusión de las cadenas de consulta en la clave de caché permite a Azure Front Door servir respuestas almacenadas en caché u otras respuestas, en función de la configuración.",
+ "text": "Habilite el almacenamiento en caché. Puede optimizar las cadenas de consulta para el almacenamiento en caché. En el caso de contenido puramente estático, omita las cadenas de consulta para maximizar el uso de la memoria caché. Si la aplicación usa cadenas de consulta, considere incluirlas en la clave de caché. La inclusión de las cadenas de consulta en la clave de caché permite a Azure Front Door servir respuestas almacenadas en caché u otras respuestas, en función de la configuración.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -174,7 +174,7 @@
"description": "Optimice el rendimiento y mantenga la continuidad de las sesiones de usuario, especialmente cuando las aplicaciones dependen del mantenimiento de la información de estado localmente.",
"guid": "7dd5da03-4e98-440f-9bfa-a60428db96a0",
"service": "Azure Front Door",
- "text": "Evalúe si debe habilitar la afinidad de sesión cuando las solicitudes del mismo usuario deben dirigirse al mismo servidor back-end. Desde el punto de vista de la confiabilidad, no recomendamos este enfoque. Si usa esta opción, la aplicación debería recuperarse correctamente sin interrumpir las sesiones de usuario. También hay una compensación en el equilibrio de carga, ya que restringe la flexibilidad de distribuir el tráfico entre varios back-ends de manera uniforme.",
+ "text": "Evalúe si debe habilitar la afinidad de sesión cuando las solicitudes del mismo usuario deben dirigirse al mismo servidor back-end. Desde el punto de vista de la confiabilidad, no se recomienda este enfoque. Si usa esta opción, la aplicación debería recuperarse correctamente sin interrumpir las sesiones de usuario. También hay una compensación en el equilibrio de carga, ya que restringe la flexibilidad de distribuir el tráfico entre varios back-ends de manera uniforme.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -182,7 +182,7 @@
"metadata": {
"name": "Azure Front Door Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -209,31 +209,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.ja.json b/checklists-ext/azurefrontdoor_sg_checklist.ja.json
index ac876bb90..e55faaecc 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.ja.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.ja.json
@@ -182,7 +182,7 @@
"metadata": {
"name": "Azure Front Door Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -209,31 +209,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.ko.json b/checklists-ext/azurefrontdoor_sg_checklist.ko.json
index 2d866992f..f0861c69b 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.ko.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.ko.json
@@ -3,10 +3,10 @@
"categories": [],
"items": [
{
- "description": "일련의 결정 단계와 설계를 사용하여 최상의 원본 리소스를 선택할 수 있습니다. 선택한 오리진은 지정된 가중치 비율로 허용 가능한 지연 시간 범위 내에서 트래픽을 처리합니다.",
+ "description": "일련의 의사 결정 단계와 설계를 사용하여 최상의 원본 리소스를 선택할 수 있습니다. 선택한 오리진은 지정된 가중치 비율로 허용 가능한 지연 시간 범위 내에서 트래픽을 처리합니다.",
"guid": "00d75bec-38c3-456d-86e6-42031076f429",
"service": "Azure Front Door",
- "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 보조 지역으로 트래픽을 백업으로 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 앞의 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
+ "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 적용 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 백업으로 보조 지역으로 트래픽을 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 이전 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -14,7 +14,7 @@
"description": "다중 오리진은 애플리케이션의 여러 인스턴스에 트래픽을 분산하여 중복성을 지원합니다. 한 인스턴스를 사용할 수 없는 경우 다른 백 엔드 오리진은 여전히 트래픽을 수신할 수 있습니다.",
"guid": "96530f4b-ba7a-4288-aaa0-9167975de796",
"service": "Azure Front Door",
- "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 가지고 있으며 각 인스턴스가 끝점 또는 원본을 노출하는지 확인하십시오. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
+ "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 사용하고 각 인스턴스가 끝점 또는 원본을 노출하는지 확인합니다. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -35,10 +35,10 @@
"waf": "신뢰도"
},
{
- "description": "세션 어피니티(affinity), 인증(authentication), 권한 부여(authorization)로 인한 오작동을 방지하기 위해 동일한 호스트 이름을 설정합니다. 자세한 내용은 역방향 프록시와 해당 백 엔드 웹 응용 프로그램 간의 원래 HTTP 호스트 이름 유지를 참조하세요.",
+ "description": "세션 어피니티(affinity), 인증(authentication), 권한 부여(authorization)로 인한 오작동을 방지하기 위해 동일한 호스트 이름을 설정합니다. 자세한 내용은 역방향 프록시와 해당 백 엔드 웹 응용 프로그램 간에 원래 HTTP 호스트 이름 유지를 참조하세요.",
"guid": "dd9e850c-0ce5-4ac2-8d8b-53cd21925a8d",
"service": "Azure Front Door",
- "text": "Azure Front Door 및 원본에서 동일한 호스트 이름을 사용합니다. Azure Front Door는 들어오는 요청의 호스트 헤더를 다시 쓸 수 있으며, 이는 하나의 원본으로 라우팅되는 여러 사용자 지정 도메인 이름이 있는 경우에 유용합니다. 그러나 호스트 헤더를 다시 작성하면 요청 쿠키 및 URL 리디렉션에 문제가 발생할 수 있습니다.",
+ "text": "Azure Front Door 및 원본에서 동일한 호스트 이름을 사용합니다. Azure Front Door는 들어오는 요청의 호스트 헤더를 다시 작성할 수 있으며, 이는 하나의 원본으로 라우팅되는 여러 사용자 지정 도메인 이름이 있는 경우에 유용합니다. 그러나 호스트 헤더를 다시 작성하면 요청 쿠키 및 URL 리디렉션에 문제가 발생할 수 있습니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -51,7 +51,7 @@
"waf": "신뢰도"
},
{
- "description": "클라이언트가 애플리케이션에 너무 많은 트래픽을 보내는 것을 방지하기 위해 요청을 제한합니다. 속도 제한은 재시도 폭풍과 같은 문제를 방지하는 데 도움이 될 수 있습니다.",
+ "description": "요청을 제한하여 클라이언트가 애플리케이션에 너무 많은 트래픽을 보내지 않도록 합니다. 속도 제한은 재시도 폭풍과 같은 문제를 방지하는 데 도움이 될 수 있습니다.",
"guid": "d9ea6be6-aed9-48ef-8774-7a10eb669286",
"service": "Azure Front Door",
"text": "WAF(웹 애플리케이션 방화벽)에 포함된 속도 제한 규칙을 활용합니다.",
@@ -62,7 +62,7 @@
"description": "기본 규칙 집합은 OWASP 상위 10개 공격 유형 및 Microsoft 위협 인텔리전스의 정보에 따라 자주 업데이트됩니다. 특수 규칙 집합은 특정 사용 사례를 감지합니다. 예를 들어, 봇 규칙은 클라이언트 IP 주소를 기반으로 봇을 양호, 불량 또는 알 수 없음으로 분류합니다. 또한 악성 봇과 알려진 IP 주소를 차단하고 호출자의 지리적 위치에 따라 트래픽을 제한합니다. 규칙 집합을 조합하여 사용하면 다양한 의도를 가진 공격을 탐지하고 차단할 수 있습니다.",
"guid": "56baca49-9e07-4ea8-983f-6a580cee1b4b",
"service": "Azure Front Door",
- "text": "잠재적으로 악의적인 트래픽을 탐지하고 차단하는 WAF 규칙 집합을 사용하도록 설정합니다. 이 기능은 프리미엄 계층에서 사용할 수 있습니다. - 기본- 봇 보호- IP 제한- 지역 필터링- 속도 제한 규칙 집합을 사용하는 것이 좋습니다.",
+ "text": "잠재적으로 악의적인 트래픽을 감지하고 차단하는 WAF 규칙 집합을 사용하도록 설정합니다. 이 기능은 프리미엄 계층에서 사용할 수 있습니다. - 기본- 봇 보호- IP 제한- 지역 필터링- 속도 제한 규칙 집합을 사용하는 것이 좋습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -70,7 +70,7 @@
"description": "거짓 긍정을 줄이고 애플리케이션에 대한 합법적인 요청을 허용합니다.",
"guid": "214d73c2-77e5-4000-81fb-7463d9183beb",
"service": "Azure Front Door",
- "text": "관리형 규칙 집합에 대한 제외를 만듭니다. 몇 주 동안 검색 모드에서 WAF 정책을 테스트하고 배포하기 전에 가양성을 조정합니다.",
+ "text": "관리되는 규칙 집합에 대한 제외를 만듭니다. 몇 주 동안 검색 모드에서 WAF 정책을 테스트하고 배포하기 전에 가양성을 조정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -78,7 +78,7 @@
"description": "TLS는 변조를 방지하기 위해 브라우저, Azure Front Door 및 백 엔드 원본 간의 데이터 교환이 암호화되도록 합니다. Key Vault는 관리형 인증서 지원과 간단한 인증서 갱신 및 회전을 제공합니다.",
"guid": "a34600e2-cbae-4bf6-b272-377ec3232184",
"service": "Azure Front Door",
- "text": "엔드투엔드 TLS, HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서(해당하는 경우)를 사용하도록 설정합니다. Azure Front Door에 대한 TLS 모범 사례를 검토합니다. TLS 버전 1.2를 애플리케이션과 관련된 암호와 함께 허용되는 최소 버전으로 사용합니다. Azure Front Door 관리형 인증서는 작업을 쉽게 하기 위해 기본 선택이어야 합니다. 그러나 인증서의 수명 주기를 관리하려면 Azure Front Door 사용자 지정 도메인 엔드포인트에서 사용자 고유의 인증서를 사용하고 Key Vault에 저장합니다.",
+ "text": "해당되는 경우 엔드투엔드 TLS, HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서를 사용하도록 설정합니다. Azure Front Door에 대한 TLS 모범 사례를 검토합니다. TLS 버전 1.2를 애플리케이션과 관련된 암호와 함께 허용되는 최소 버전으로 사용합니다. Azure Front Door 관리형 인증서는 작업을 쉽게 하기 위해 기본 선택이어야 합니다. 그러나 인증서의 수명 주기를 관리하려면 Azure Front Door 사용자 지정 도메인 엔드포인트에서 사용자 고유의 인증서를 사용하고 Key Vault에 저장합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -102,7 +102,7 @@
"description": "라우팅 결정을 내리는 데 필요하지 않은 요청을 비활성화하여 대역폭 비용을 절약할 수 있습니다.",
"guid": "8d573a21-8a95-455f-9c6b-d3df3ef7b64f",
"service": "Azure Front Door",
- "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성된 경우 이러한 호출이 필요하지 않습니다.",
+ "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성되어 있는 경우 이러한 호출이 필요하지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -147,7 +147,7 @@
"waf": "작업"
},
{
- "description": "Azure Front Door는 네트워크 에지에서 콘텐츠를 캐시하는 강력한 콘텐츠 배달 네트워크 솔루션을 제공합니다. 캐싱은 백 엔드 서버의 부하를 줄이고 네트워크를 통한 데이터 이동을 줄여 대역폭 사용을 오프로드하는 데 도움이 됩니다.",
+ "description": "Azure Front Door는 네트워크 에지에서 콘텐츠를 캐시하는 강력한 콘텐츠 배달 네트워크 솔루션을 제공합니다. 캐싱은 백엔드 서버의 부하를 줄이고 네트워크를 통한 데이터 이동을 줄여 대역폭 사용량을 오프로드하는 데 도움이 됩니다.",
"guid": "e8d431d1-8549-4d6d-a1da-ec67e7ef897e",
"service": "Azure Front Door",
"text": "캐싱을 활성화합니다. 캐싱을 위해 쿼리 문자열을 최적화할 수 있습니다. 순전히 정적인 콘텐츠의 경우 쿼리 문자열을 무시하여 캐시 사용을 최대화합니다. 응용 프로그램에서 쿼리 문자열을 사용하는 경우 캐시 키에 포함하는 것이 좋습니다. 캐시 키에 쿼리 문자열을 포함하면 Azure Front Door가 구성에 따라 캐시된 응답 또는 기타 응답을 제공할 수 있습니다.",
@@ -155,7 +155,7 @@
"waf": "공연"
},
{
- "description": "Azure Front Door의 압축은 최적의 형식으로 콘텐츠를 제공하고, 페이로드가 더 작고, 사용자에게 콘텐츠를 더 빠르게 전달하는 데 도움이 됩니다.",
+ "description": "Azure Front Door의 압축은 최적의 형식으로 콘텐츠를 제공하고, 페이로드가 더 작고, 사용자에게 콘텐츠를 더 빠르게 제공하는 데 도움이 됩니다.",
"guid": "55ac8a69-b68f-4d07-a94b-65a9eecb11d3",
"service": "Azure Front Door",
"text": "다운로드 가능한 콘텐츠에 액세스할 때 파일 압축을 사용합니다.",
@@ -174,7 +174,7 @@
"description": "성능을 최적화하고 사용자 세션의 연속성을 유지하며, 특히 응용 프로그램이 로컬에서 상태 정보를 유지 관리하는 데 의존하는 경우 더욱 그렇습니다.",
"guid": "7dd5da03-4e98-440f-9bfa-a60428db96a0",
"service": "Azure Front Door",
- "text": "동일한 사용자의 요청이 동일한 백엔드 서버로 전달되어야 하는 경우 세션 선호도를 사용하도록 설정해야 하는지 여부를 평가합니다. 안정성 관점에서는 이 방법을 사용하지 않는 것이 좋습니다. 이 옵션을 사용하면 응용 프로그램이 사용자 세션을 중단하지 않고 정상적으로 복구되어야 합니다. 또한 부하 분산에 대한 절충안이 있는데, 이는 여러 백 엔드에 트래픽을 균등하게 분산하는 유연성을 제한하기 때문입니다.",
+ "text": "동일한 사용자의 요청이 동일한 백엔드 서버로 전달되어야 하는 경우 세션 선호도를 사용하도록 설정해야 하는지 여부를 평가합니다. 안정성 관점에서는 이 방법을 권장하지 않습니다. 이 옵션을 사용하면 응용 프로그램이 사용자 세션을 중단하지 않고 정상적으로 복구되어야 합니다. 또한 부하 분산에는 여러 백엔드에 트래픽을 균등하게 분산하는 유연성을 제한하기 때문에 절충안이 있습니다.",
"type": "recommendation",
"waf": "공연"
}
@@ -182,7 +182,7 @@
"metadata": {
"name": "Azure Front Door Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -209,31 +209,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.pt.json b/checklists-ext/azurefrontdoor_sg_checklist.pt.json
index cdd3f1d14..16264048a 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.pt.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.pt.json
@@ -182,7 +182,7 @@
"metadata": {
"name": "Azure Front Door Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -209,31 +209,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azurefrontdoor_sg_checklist.zh-Hant.json b/checklists-ext/azurefrontdoor_sg_checklist.zh-Hant.json
index 4737ae15b..b7021a10f 100644
--- a/checklists-ext/azurefrontdoor_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azurefrontdoor_sg_checklist.zh-Hant.json
@@ -182,7 +182,7 @@
"metadata": {
"name": "Azure Front Door Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -209,31 +209,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.en.json b/checklists-ext/azurekubernetesservice_sg_checklist.en.json
index 10fd2600d..667f7fa78 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.en.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.en.json
@@ -437,6 +437,6 @@
"name": "Azure Kubernetes Service Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.es.json b/checklists-ext/azurekubernetesservice_sg_checklist.es.json
index 0dfcbeb47..c02d42fb8 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.es.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.es.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "Permite que el programador de Kubernetes aísle lógicamente las cargas de trabajo por hardware en el nodo. A diferencia de las tolerancias, los pods sin un selector de nodos coincidentes se pueden programar en nodos etiquetados, lo que permite que se consuman los recursos no utilizados en los nodos, pero da prioridad a los pods que definen el selector de nodos coincidentes. Utilice la afinidad de nodo para obtener más flexibilidad, lo que le permite definir qué sucede si el pod no puede coincidir con un nodo.",
+ "description": "Permite que el programador de Kubernetes aísle lógicamente las cargas de trabajo por hardware en el nodo. A diferencia de las tolerancias, los pods sin un selector de nodos coincidente se pueden programar en nodos etiquetados, lo que permite que los recursos no utilizados de los nodos se consuman, pero da prioridad a los pods que definen el selector de nodos coincidente. Utilice la afinidad de nodo para obtener más flexibilidad, lo que le permite definir qué sucede si el pod no se puede hacer coincidir con un nodo.",
"guid": "79d7a487-b319-40ef-b55f-94c265986865",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: controle la programación de pods mediante selectores de nodos y afinidad.",
@@ -38,7 +38,7 @@
"description": "Las cargas de trabajo orientadas a Internet deben aprovechar Azure Front Door o Azure Traffic Manager para enrutar el tráfico globalmente a través de clústeres de AKS.",
"guid": "72c0719b-444b-49fa-b3fb-598de4c4a99d",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: adopte una estrategia de varias regiones mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
+ "text": "Arquitectura de clústeres: adopte una estrategia multirregional mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -46,7 +46,7 @@
"description": "Los límites de recursos de memoria y CPU del contenedor son necesarios para evitar el agotamiento de recursos en el clúster de Kubernetes.",
"guid": "f230e754-6818-4428-b2ad-7ad543723f80",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: defina las solicitudes y los límites de recursos de pods en los manifiestos de implementación de aplicaciones y aplíquelos con Azure Policy.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: defina las solicitudes y los límites de recursos de pod en los manifiestos de implementación de aplicaciones y aplíquelos con Azure Policy.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -59,10 +59,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Es posible que las aplicaciones compartan la misma configuración y necesiten máquinas virtuales habilitadas para GPU, máquinas virtuales optimizadas para CPU o memoria, o la capacidad de escalar a cero. Evite un gran número de grupos de nodos para reducir la sobrecarga de administración adicional.",
+ "description": "Las aplicaciones pueden compartir la misma configuración y necesitar máquinas virtuales habilitadas para GPU, máquinas virtuales optimizadas para CPU o memoria, o la capacidad de escalar a cero. Evite un gran número de grupos de nodos para reducir la sobrecarga de administración adicional.",
"guid": "e303e4a0-0b81-47bd-bd44-bede44825fa2",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: separe las aplicaciones de los grupos de nodos dedicados en función de requisitos específicos.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: separe las aplicaciones en grupos de nodos dedicados en función de requisitos específicos.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -102,7 +102,7 @@
"description": "Al utilizar clústeres públicos, aún puede limitar el tráfico que puede llegar al servidor de API de clústeres mediante la característica de rango de IP autorizado. Incluya orígenes como las direcciones IP públicas de los agentes de compilación de implementación, la administración de operaciones y el punto de salida de los grupos de nodos (como Azure Firewall).",
"guid": "0418c965-c483-41bc-933c-9289108b8ad0",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: en el caso de los clústeres de AKS no privados, use intervalos de direcciones IP autorizados por el servidor de API.",
+ "text": "Arquitectura de clúster: en el caso de los clústeres de AKS no privados, use los intervalos IP autorizados por el servidor de API.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -123,10 +123,10 @@
"waf": "Seguridad"
},
{
- "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a gran escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo va en contra de la política de la empresa.",
+ "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo se ejecuta en contra de la política de la empresa.",
"guid": "c99d155b-6a13-4f61-8672-356b1ed3a922",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clústeres: proteja clústeres y pods con Azure Policy.",
+ "text": "Arquitectura de clústeres: proteja los clústeres y los pods con Azure Policy.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -147,7 +147,7 @@
"waf": "Seguridad"
},
{
- "description": "Asegúrese de que el tráfico de salida del clúster pasa a través de un punto de seguridad de red, como Azure Firewall o un proxy HTTP.",
+ "description": "Asegúrese de que el tráfico saliente del clúster pasa a través de un punto de seguridad de red, como Azure Firewall o un proxy HTTP.",
"guid": "d67db716-6569-4a40-b18f-01052c02399f",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: controle el tráfico de salida del clúster.",
@@ -155,7 +155,7 @@
"waf": "Seguridad"
},
{
- "description": "Proteja y rote secretos, certificados y cadenas de conexión en Azure Key Vault con un cifrado seguro. Proporciona un registro de auditoría de acceso y mantiene los secretos principales fuera de la canalización de implementación.",
+ "description": "Proteja y rote secretos, certificados y cadenas de conexión en Azure Key Vault con cifrado seguro. Proporciona un registro de auditoría de acceso y mantiene los secretos principales fuera de la canalización de implementación.",
"guid": "bc5240f0-9c6d-469e-bf71-9f8d4bf18c29",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: use el identificador de carga de trabajo de Microsoft Entra de código abierto y el controlador CSI del almacén de secretos con Azure Key Vault.",
@@ -179,7 +179,7 @@
"waf": "Costar"
},
{
- "description": "La selección del tipo de instancia de máquina virtual correcto es fundamental, ya que afecta directamente al costo de ejecutar aplicaciones en AKS. La elección de una instancia de alto rendimiento sin una utilización adecuada puede generar gastos innecesarios, mientras que la elección de una instancia menos potente puede provocar problemas de rendimiento y un mayor tiempo de inactividad. Para determinar el tipo de instancia de máquina virtual adecuado, tenga en cuenta las características de la carga de trabajo, los requisitos de recursos y las necesidades de disponibilidad.",
+ "description": "La selección del tipo de instancia de máquina virtual correcto es fundamental, ya que afecta directamente al costo de ejecutar aplicaciones en AKS. La elección de una instancia de alto rendimiento sin la utilización adecuada puede generar gastos innecesarios, mientras que la elección de una instancia menos potente puede provocar problemas de rendimiento y un mayor tiempo de inactividad. Para determinar el tipo de instancia de máquina virtual adecuado, tenga en cuenta las características de la carga de trabajo, los requisitos de recursos y las necesidades de disponibilidad.",
"guid": "f16a2684-c225-4fd5-8202-8ea1db7f18e7",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: seleccione el tipo de instancia de máquina virtual adecuado.",
@@ -195,7 +195,7 @@
"waf": "Costar"
},
{
- "description": "Las máquinas virtuales de acceso puntual le permiten aprovechar la capacidad de Azure no utilizada con importantes descuentos (hasta un 90 % en comparación con los precios de pago por uso). Si Azure necesita recuperar capacidad, la infraestructura de Azure expulsa los nodos de acceso puntual.",
+ "description": "Las máquinas virtuales de acceso puntual le permiten aprovechar la capacidad de Azure no utilizada con importantes descuentos (hasta el 90 % en comparación con los precios de pago por uso). Si Azure necesita recuperar capacidad, la infraestructura de Azure expulsa los nodos de acceso puntual.",
"guid": "15372689-94ad-4247-a157-fde418217ce4",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: seleccione Azure Spot Virtual Machines.",
@@ -211,7 +211,7 @@
"waf": "Costar"
},
{
- "description": "La optimización de las imágenes ayuda a reducir los costos, ya que los nuevos nodos necesitan descargar estas imágenes. Cree imágenes de forma que permita que el contenedor se inicie lo antes posible para ayudar a evitar errores de solicitud de usuario o tiempos de espera mientras se inicia la aplicación, lo que podría provocar un sobreaprovisionamiento.",
+ "description": "La optimización de las imágenes ayuda a reducir los costos, ya que los nuevos nodos necesitan descargar estas imágenes. Cree imágenes de forma que permita que el contenedor se inicie lo antes posible para ayudar a evitar errores de solicitud de usuario o tiempos de espera mientras se inicia la aplicación, lo que podría provocar un aprovisionamiento excesivo.",
"guid": "e689c267-1eaa-444d-806e-c5a0735658de",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de carga de trabajo: Mantenga imágenes pequeñas y optimizadas.",
@@ -219,7 +219,7 @@
"waf": "Costar"
},
{
- "description": "Reducir automáticamente el número de nodos del clúster de AKS permite ejecutar un clúster eficaz cuando la demanda es baja y escalar verticalmente cuando vuelve la demanda.",
+ "description": "La reducción vertical automática del número de nodos del clúster de AKS permite ejecutar un clúster eficaz cuando la demanda es baja y escalar verticalmente cuando se recupera la demanda.",
"guid": "e770ea75-690d-4dc0-a0e4-43c17b6bb56f",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: habilite el escalador automático de clústeres para reducir automáticamente el número de nodos de agente en respuesta al exceso de capacidad de recursos.",
@@ -235,26 +235,26 @@
"waf": "Costar"
},
{
- "description": "Ajuste el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas, que admitan operaciones de reducción horizontal de clústeres.",
+ "description": "Ajuste el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas, que admiten operaciones de reducción horizontal de clústeres.",
"guid": "1321c176-e53a-4451-91cf-e4e50c637d07",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de cargas de trabajo: usa el escalador automático horizontal de pods.",
+ "text": "Arquitectura de carga de trabajo: use el escalador automático de pods horizontal.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Ajusta el tamaño de tus pods y establece dinámicamente solicitudes y límites en función del uso histórico.",
+ "description": "Ajusta el tamaño de tus pods y establece dinámicamente las solicitudes y los límites en función del uso histórico.",
"guid": "554e18fe-b835-4e78-8d27-6f49999855ad",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de carga de trabajo: use el escalador automático de pods verticales (versión preliminar).",
+ "text": "Arquitectura de carga de trabajo: use el escalador automático de pods vertical (versión preliminar).",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Escala en función del número de eventos que se están procesando. Elija entre un amplio catálogo de 50+ escaladores KEDA.",
+ "description": "Escale en función del número de eventos que se están procesando. Elija entre un amplio catálogo de 50+ escaladores KEDA.",
"guid": "fe15f362-a48d-4a25-aa3e-7938b3d1f5e2",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de carga de trabajo: use el escalado automático basado en eventos (KEDA) de Kubernetes.",
+ "text": "Arquitectura de carga de trabajo: use el escalado automático controlado por eventos (KEDA) de Kubernetes.",
"type": "recommendation",
"waf": "Costar"
},
@@ -283,7 +283,7 @@
"waf": "Costar"
},
{
- "description": "Para compilar y ejecutar aplicaciones correctamente en AKS, hay que comprender e implementar consideraciones clave. Estas áreas incluyen funciones de multiusuario y programador, seguridad de clústeres y pods, o continuidad del negocio y recuperación ante desastres.",
+ "description": "Para compilar y ejecutar aplicaciones correctamente en AKS, hay consideraciones clave que se deben comprender e implementar. Estas áreas incluyen funciones de multiusuario y programador, seguridad de clústeres y pods, o continuidad del negocio y recuperación ante desastres.",
"guid": "4ea51e35-26bb-4a2b-a7ca-435eb6d857b9",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: consulte la documentación de procedimientos recomendados de AKS.",
@@ -294,7 +294,7 @@
"description": "Azure Chaos Studio puede ayudar a simular errores y desencadenar situaciones de recuperación ante desastres.",
"guid": "d38b720a-0b27-409f-9dfa-28f698067a19",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: Revisión de Azure Chaos Studio.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: revise Azure Chaos Studio.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -302,12 +302,12 @@
"description": "Las cargas de trabajo orientadas a Internet deben aprovechar Azure Front Door o Azure Traffic Manager para enrutar el tráfico globalmente a través de clústeres de AKS.",
"guid": "72c0719b-444b-49fa-b3fb-598de4c4a99d",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: adopte una estrategia de varias regiones mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
+ "text": "Arquitectura de clústeres: adopte una estrategia multirregional mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a gran escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo va en contra de la política de la empresa.",
+ "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo se ejecuta en contra de la política de la empresa.",
"guid": "4fa55d17-b08b-4885-8d5b-d8cfbe3eda59",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clústeres: ponga en funcionamiento los estándares de configuración de clústeres y pods con Azure Policy.",
@@ -315,7 +315,7 @@
"waf": "Operaciones"
},
{
- "description": "Los controladores de entrada y Kubernetes admiten muchos patrones de implementación avanzados para su inclusión en el proceso de ingeniería de versiones. Tenga en cuenta patrones como las implementaciones azul-verde o las versiones controladas.",
+ "description": "Los controladores de entrada y Kubernetes admiten muchos patrones de implementación avanzados para su inclusión en el proceso de ingeniería de versiones. Considere patrones como las implementaciones azul-verde o las versiones canary.",
"guid": "40bf5a02-ca6a-410d-9b6a-87fe75ff0873",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de carga de trabajo: utilice las capacidades de la plataforma en el proceso de ingeniería de versiones.",
@@ -339,7 +339,7 @@
"waf": "Rendimiento"
},
{
- "description": "La capacidad de escalar o reducir verticalmente automáticamente el número de nodos del clúster de AKS le permite ejecutar un clúster eficaz y rentable.",
+ "description": "La capacidad de escalar o reducir verticalmente automáticamente el número de nodos del clúster de AKS permite ejecutar un clúster eficaz y rentable.",
"guid": "d50d653b-0d8d-44ca-8ba6-9963321d1f24",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: habilite el escalador automático de clústeres para ajustar automáticamente el número de nodos de agente en respuesta a las restricciones de recursos.",
@@ -347,7 +347,7 @@
"waf": "Rendimiento"
},
{
- "description": "A diferencia de los grupos de nodos del sistema que siempre requieren nodos en ejecución, los grupos de nodos de usuario permiten escalar o reducir verticalmente.",
+ "description": "A diferencia de los grupos de nodos del sistema que siempre requieren la ejecución de nodos, los grupos de nodos de usuario permiten escalar o reducir verticalmente.",
"guid": "cd14e737-9478-4fb4-9556-586b03d5e248",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: separe las cargas de trabajo en diferentes grupos de nodos y considere la posibilidad de escalar los grupos de nodos de usuario.",
@@ -374,7 +374,7 @@
"metadata": {
"name": "Azure Kubernetes Service Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -401,31 +401,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.ja.json b/checklists-ext/azurekubernetesservice_sg_checklist.ja.json
index 8fb09ef2e..deb42570d 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.ja.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.ja.json
@@ -374,7 +374,7 @@
"metadata": {
"name": "Azure Kubernetes Service Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -401,31 +401,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.ko.json b/checklists-ext/azurekubernetesservice_sg_checklist.ko.json
index b03685833..90d77d5e9 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.ko.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.ko.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "쿠버네티스 스케줄러가 노드의 하드웨어별로 워크로드를 논리적으로 격리할 수 있도록 한다. 허용 오차와 달리, 일치하는 노드 선택기가 없는 Pod는 레이블이 지정된 노드에서 예약할 수 있으며, 이렇게 하면 노드에서 사용되지 않는 리소스를 사용할 수 있지만 일치하는 노드 선택기를 정의하는 Pod에 우선 순위가 부여됩니다. 유연성을 높이기 위해 노드 어피니티를 사용하면 Pod를 노드와 일치시킬 수 없는 경우 발생하는 작업을 정의할 수 있습니다.",
+ "description": "Kubernetes 스케줄러가 노드의 하드웨어별로 워크로드를 논리적으로 격리할 수 있습니다. 허용 오차와 달리, 일치하는 노드 선택기가 없는 Pod는 레이블이 지정된 노드에서 예약할 수 있으며, 이렇게 하면 노드에서 사용되지 않는 리소스를 사용할 수 있지만 일치하는 노드 선택기를 정의하는 Pod에 우선 순위가 부여됩니다. 유연성을 높이기 위해 노드 어피니티를 사용하면 Pod를 노드와 일치시킬 수 없는 경우 발생하는 작업을 정의할 수 있습니다.",
"guid": "79d7a487-b319-40ef-b55f-94c265986865",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 노드 선택기 및 선호도를 사용하여 Pod 스케줄링을 제어합니다.",
@@ -19,7 +19,7 @@
"waf": "신뢰도"
},
{
- "description": "AKS 작동 시간 SLA는 - Azure 가용성 영역을 사용하는 AKS 클러스터에 대한 Kubernetes API 서버 엔드포인트의 '99.95%' 가용성 또는 Azure 가용성 영역을 사용하지 않는 AKS 클러스터에 대한 '99.9%' 가용성을 보장합니다.",
+ "description": "AKS 작동 시간 SLA는 Azure 가용성 영역을 사용하는 AKS 클러스터에 대한 Kubernetes API 서버 엔드포인트의 '99.95%' 가용성 또는 Azure 가용성 영역을 사용하지 않는 AKS 클러스터에 대한 '99.9%' 가용성을 보장합니다.",
"guid": "99cc0fc7-138a-452f-a4dd-fd79daa5049e",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 프로덕션 등급 클러스터에 AKS 작동 시간 SLA를 사용합니다.",
@@ -30,7 +30,7 @@
"description": "노드 풀을 여러 영역에 분산하면 다른 영역이 다운되더라도 한 노드 풀의 노드가 계속 실행됩니다. 공동 지역성 요구 사항이 있는 경우 단일 영역에 대한 일반 VMSS 기반 AKS 배포 또는 근접 배치 그룹을 사용하여 노드 간 대기 시간을 최소화할 수 있습니다.",
"guid": "29400c1f-e4ff-4ab5-89ff-be93d51d5fa8",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 가용성 영역을 사용하여 AKS 에이전트 노드를 물리적으로 분리된 데이터 센터에 분산하여 Azure 지역 내에서 복원력을 최대화합니다.",
+ "text": "클러스터 아키텍처: 가용성 영역을 사용하여 AKS 에이전트 노드를 물리적으로 분리된 데이터 센터에 분산하여 Azure 지역 내의 복원력을 최대화합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -54,7 +54,7 @@
"description": "시스템 노드 풀에는 2개 이상의 vCPU와 4GB 메모리의 VM SKU가 필요하지만 4개 이상의 vCPU를 사용하는 것이 좋습니다. 자세한 요구 사항은 시스템 및 사용자 노드 풀을 참조하십시오.",
"guid": "f51b6cdd-3914-4e11-a8e8-f2cf61788e84",
"service": "Azure Kubernetes Service",
- "text": "클러스터 및 워크로드 아키텍처: 시스템 노드 풀을 애플리케이션 워크로드와 격리된 상태로 유지합니다.",
+ "text": "클러스터 및 워크로드 아키텍처: 시스템 노드 풀을 애플리케이션 워크로드로부터 격리된 상태로 유지합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -67,7 +67,7 @@
"waf": "신뢰도"
},
{
- "description": "동시 아웃바운드 트래픽이 많은 Azure Load Balancer 제한과 관련된 안정성 문제를 방지하려면 대신 NAT Gateway를 사용하여 대규모로 신뢰할 수 있는 송신 트래픽을 지원합니다.",
+ "description": "동시 아웃바운드 트래픽이 높은 Azure Load Balancer 제한으로 인한 안정성 문제를 방지하려면 대신 NAT Gateway를 사용하여 대규모로 신뢰할 수 있는 송신 트래픽을 지원합니다.",
"guid": "ff84fa04-ee66-4605-85f3-803dd2cab3c4",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 동시 아웃바운드 연결이 많은 워크로드를 실행하는 클러스터에 NAT 게이트웨이를 사용합니다.",
@@ -75,7 +75,7 @@
"waf": "신뢰도"
},
{
- "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소를 중앙 집중화할 수 있습니다. 사용자 계정 또는 그룹 상태의 모든 변경 내용은 AKS 클러스터에 대한 액세스에서 자동으로 업데이트됩니다. 쿠버네티스 클러스터의 개발자와 애플리케이션 소유자는 서로 다른 리소스에 액세스해야 합니다.",
+ "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화됩니다. 사용자 계정 또는 그룹 상태의 모든 변경 내용은 AKS 클러스터에 대한 액세스에서 자동으로 업데이트됩니다. 쿠버네티스 클러스터의 개발자와 애플리케이션 소유자는 서로 다른 리소스에 액세스해야 한다.",
"guid": "03a24546-1e4a-46d6-ad0c-63e80d157b51",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Microsoft Entra 통합을 사용합니다.",
@@ -91,7 +91,7 @@
"waf": "안전"
},
{
- "description": "기본적으로 노드 풀과 API 서버 간의 네트워크 트래픽은 Microsoft 백본 네트워크를 이동합니다. 개인 클러스터를 사용하면 API 서버에 대한 네트워크 트래픽이 개인 네트워크에서만 유지되도록 할 수 있습니다.",
+ "description": "기본적으로 노드 풀과 API 서버 간의 네트워크 트래픽은 Microsoft 백본 네트워크를 이동합니다. 개인 클러스터를 사용하면 API 서버에 대한 네트워크 트래픽이 개인 네트워크에만 유지되도록 할 수 있습니다.",
"guid": "3d11d647-363f-469c-bea9-9ef27a9bee70",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 프라이빗 AKS 클러스터를 사용하여 API 서버에 대한 네트워크 트래픽을 보호합니다.",
@@ -102,7 +102,7 @@
"description": "공용 클러스터를 사용하는 경우에도 권한 있는 IP 범위 기능을 사용하여 클러스터 API 서버에 도달할 수 있는 트래픽을 제한할 수 있습니다. 배포 빌드 에이전트의 공용 IP, 작업 관리 및 노드 풀의 송신 지점(예: Azure Firewall)과 같은 원본을 포함합니다.",
"guid": "0418c965-c483-41bc-933c-9289108b8ad0",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 프라이빗이 아닌 AKS 클러스터의 경우 API 서버 권한이 있는 IP 범위를 사용합니다.",
+ "text": "클러스터 아키텍처: 프라이빗이 아닌 AKS 클러스터의 경우 API 서버 권한이 부여된 IP 범위를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -123,10 +123,10 @@
"waf": "안전"
},
{
- "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 것이 있는지 여부를 제어할 수 있습니다.",
+ "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 항목이 있는지 제어할 수 있습니다.",
"guid": "c99d155b-6a13-4f61-8672-356b1ed3a922",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터와 Pod를 보호합니다.",
+ "text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터 및 Pod를 보호합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -158,7 +158,7 @@
"description": "강력한 암호화를 사용하여 Azure Key Vault에서 비밀, 인증서 및 연결 문자열을 보호하고 회전합니다. 액세스 감사 로그를 제공하고 핵심 비밀을 배포 파이프라인에서 제외합니다.",
"guid": "bc5240f0-9c6d-469e-bf71-9f8d4bf18c29",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Azure Key Vault에서 오픈 소스 Microsoft Entra Workload ID 및 Secrets Store CSI 드라이버를 사용합니다.",
+ "text": "클러스터 아키텍처: Azure Key Vault와 함께 오픈 소스 Microsoft Entra 워크로드 ID 및 비밀 저장소 CSI 드라이버를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -171,7 +171,7 @@
"waf": "안전"
},
{
- "description": "워크로드 요구 사항에 맞게 선택 항목을 일치시키면 불필요한 리소스에 대한 비용을 지불하지 않아도 됩니다.",
+ "description": "선택 항목을 워크로드 요구 사항에 맞추면 불필요한 리소스에 대한 비용을 지불하지 않아도 됩니다.",
"guid": "93a3ae7a-6f04-471b-bb3f-5eb4e6664c5b",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: SKU 선택 및 관리 디스크 크기를 워크로드 요구 사항에 맞게 조정합니다.",
@@ -179,7 +179,7 @@
"waf": "비용"
},
{
- "description": "올바른 가상 머신 인스턴스 유형을 선택하는 것은 AKS에서 애플리케이션을 실행하는 비용에 직접적인 영향을 미치므로 중요합니다. 적절한 사용률 없이 고성능 인스턴스를 선택하면 낭비적인 지출이 발생할 수 있으며, 덜 강력한 인스턴스를 선택하면 성능 문제와 가동 중지 시간이 증가할 수 있습니다. 올바른 가상 머신 인스턴스 유형을 결정하려면 워크로드 특성, 리소스 요구 사항 및 가용성 요구 사항을 고려합니다.",
+ "description": "올바른 가상 머신 인스턴스 유형을 선택하는 것은 AKS에서 애플리케이션을 실행하는 비용에 직접적인 영향을 미치므로 중요합니다. 적절한 사용률 없이 고성능 인스턴스를 선택하면 낭비적인 지출로 이어질 수 있으며, 덜 강력한 인스턴스를 선택하면 성능 문제와 가동 중지 시간이 증가할 수 있습니다. 올바른 가상 머신 인스턴스 유형을 결정하려면 워크로드 특성, 리소스 요구 사항 및 가용성 요구 사항을 고려합니다.",
"guid": "f16a2684-c225-4fd5-8202-8ea1db7f18e7",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 올바른 가상 머신 인스턴스 유형을 선택합니다.",
@@ -203,7 +203,7 @@
"waf": "비용"
},
{
- "description": "많은 요인으로 인해 리소스 비용은 Azure의 지역마다 다릅니다. 비용, 지연 시간 및 규정 준수 요구 사항을 평가하여 워크로드를 비용 효율적으로 실행하고 있는지, 최종 사용자에게 영향을 미치거나 추가 네트워킹 비용이 발생하지 않는지 확인합니다.",
+ "description": "여러 요인으로 인해 리소스 비용은 Azure의 지역마다 다릅니다. 비용, 대기 시간 및 규정 준수 요구 사항을 평가하여 워크로드를 비용 효율적으로 실행하고 있으며 최종 사용자에게 영향을 미치거나 추가 네트워킹 요금이 발생하지 않는지 확인합니다.",
"guid": "41a6e1ef-d63a-4e26-842f-1a0cde3abaa6",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 적절한 지역을 선택합니다.",
@@ -211,7 +211,7 @@
"waf": "비용"
},
{
- "description": "이미지를 간소화하면 새 노드가 이러한 이미지를 다운로드해야 하므로 비용을 줄이는 데 도움이 됩니다. 컨테이너가 가능한 한 빨리 시작될 수 있는 방식으로 이미지를 빌드하여 애플리케이션이 시작되는 동안 사용자 요청 실패 또는 시간 초과를 방지하여 잠재적으로 오버프로비저닝으로 이어질 수 있습니다.",
+ "description": "이미지를 간소화하면 새 노드가 이러한 이미지를 다운로드해야 하므로 비용을 줄이는 데 도움이 됩니다. 애플리케이션이 시작되는 동안 사용자 요청 실패 또는 시간 초과를 방지하는 데 도움이 되도록 가능한 한 빨리 컨테이너를 시작할 수 있는 방식으로 이미지를 빌드하여 잠재적으로 오버프로비저닝으로 이어질 수 있습니다.",
"guid": "e689c267-1eaa-444d-806e-c5a0735658de",
"service": "Azure Kubernetes Service",
"text": "워크로드 아키텍처: 작고 최적화된 이미지를 유지 관리합니다.",
@@ -222,7 +222,7 @@
"description": "AKS 클러스터의 노드 수를 자동으로 축소하면 수요가 낮을 때 효율적인 클러스터를 실행하고 수요가 돌아올 때 스케일 업할 수 있습니다.",
"guid": "e770ea75-690d-4dc0-a0e4-43c17b6bb56f",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Cluster Autoscaler를 활성화하여 과도한 리소스 용량에 대한 응답으로 에이전트 노드 수를 자동으로 줄일 수 있습니다.",
+ "text": "클러스터 아키텍처: Cluster Autoscaler를 활성화하여 과도한 리소스 용량에 대한 응답으로 에이전트 노드 수를 자동으로 줄입니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -254,12 +254,12 @@
"description": "처리 중인 이벤트 수에 따라 크기를 조정합니다. 50+ KEDA 스케일러의 풍부한 카탈로그에서 선택하십시오.",
"guid": "fe15f362-a48d-4a25-aa3e-7938b3d1f5e2",
"service": "Azure Kubernetes Service",
- "text": "워크로드 아키텍처: Kubernetes KEDA(Event Driven Autoscaling)를 사용합니다.",
+ "text": "워크로드 아키텍처: KEDA(Kubernetes Event Driven Autoscaling)를 사용합니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "비용 최적화를 가능하게 하는 기반은 비용 절감 클러스터의 확산입니다. 재무 운영 접근 방식(FinOps)은 조직이 클라우드 비용을 절감하는 데 도움이 되는 데 자주 사용됩니다. 이는 재무, 운영 및 엔지니어링 팀 간의 협업을 통해 비용 절감 목표를 조정하고 클라우드 비용에 대한 투명성을 확보하는 관행입니다.",
+ "description": "비용 최적화를 가능하게 하는 기반은 비용 절감 클러스터의 확산입니다. 재무 운영 접근 방식(FinOps)은 조직이 클라우드 비용을 절감하는 데 도움이 되는 데 자주 사용됩니다. 이는 재무, 운영 및 엔지니어링 팀 간의 협업을 포함하여 비용 절감 목표를 조정하고 클라우드 비용에 대한 투명성을 확보하는 관행입니다.",
"guid": "d0ed8b85-2072-4952-a00c-697135e435a2",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 클라우드 재무 규율과 문화적 관행을 채택하여 클라우드 사용에 대한 소유권을 촉진합니다.",
@@ -267,7 +267,7 @@
"waf": "비용"
},
{
- "description": "용량을 적절하게 계획한 경우 워크로드를 예측할 수 있고 장기간 동안 존재하므로 Azure 예약 또는 절약 플랜에 등록하여 리소스 비용을 더욱 줄입니다.",
+ "description": "용량을 적절하게 계획한 경우 워크로드를 예측할 수 있고 장기간 존재하므로 Azure 예약 또는 절약 플랜에 등록하여 리소스 비용을 더욱 줄입니다.",
"guid": "9d4b8d27-c793-4862-94c8-c2505205f07f",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Azure Reservations 또는 Azure Savings Plan에 등록합니다.",
@@ -283,7 +283,7 @@
"waf": "비용"
},
{
- "description": "AKS에서 애플리케이션을 성공적으로 빌드하고 실행하려면 이해하고 구현해야 할 주요 고려 사항이 있습니다. 이러한 영역에는 멀티 테넌시 및 스케줄러 기능, 클러스터 및 Pod 보안 또는 비즈니스 연속성 및 재해 복구가 포함됩니다.",
+ "description": "AKS에서 애플리케이션을 성공적으로 빌드하고 실행하려면 이해하고 구현해야 하는 주요 고려 사항이 있습니다. 이러한 영역에는 멀티 테넌시 및 스케줄러 기능, 클러스터 및 Pod 보안 또는 비즈니스 연속성 및 재해 복구가 포함됩니다.",
"guid": "4ea51e35-26bb-4a2b-a7ca-435eb6d857b9",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: AKS 모범 사례 설명서를 검토합니다.",
@@ -307,7 +307,7 @@
"waf": "작업"
},
{
- "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 것이 있는지 여부를 제어할 수 있습니다.",
+ "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 항목이 있는지 제어할 수 있습니다.",
"guid": "4fa55d17-b08b-4885-8d5b-d8cfbe3eda59",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터 및 Pod 구성 표준을 운영합니다.",
@@ -363,7 +363,7 @@
"waf": "공연"
},
{
- "description": "모든 크기 조정 결정을 CPU 또는 메모리 메트릭에서 파생할 수 있는 것은 아닙니다. 규모 조정 고려 사항은 더 복잡하거나 외부 데이터 요소에서 오는 경우가 많습니다. KEDA를 사용하여 워크로드와 관련된 신호를 기반으로 의미 있는 자동 크기 조정 규칙 집합을 빌드합니다.",
+ "description": "모든 크기 조정 결정이 CPU 또는 메모리 메트릭에서 파생될 수 있는 것은 아닙니다. 규모 조정 고려 사항은 더 복잡하거나 외부 데이터 요소에서 오는 경우가 많습니다. KEDA를 사용하여 워크로드와 관련된 신호를 기반으로 의미 있는 자동 크기 조정 규칙 집합을 빌드합니다.",
"guid": "43df6223-dfca-447d-9b00-f4742ef18be1",
"service": "Azure Kubernetes Service",
"text": "워크로드 아키텍처: 의미 있는 워크로드 확장 메트릭을 사용합니다.",
@@ -374,7 +374,7 @@
"metadata": {
"name": "Azure Kubernetes Service Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -401,31 +401,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.pt.json b/checklists-ext/azurekubernetesservice_sg_checklist.pt.json
index 597ab1a3d..17c16a70b 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.pt.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.pt.json
@@ -374,7 +374,7 @@
"metadata": {
"name": "Azure Kubernetes Service Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -401,31 +401,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azurekubernetesservice_sg_checklist.zh-Hant.json b/checklists-ext/azurekubernetesservice_sg_checklist.zh-Hant.json
index 385a004ed..690f362b3 100644
--- a/checklists-ext/azurekubernetesservice_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azurekubernetesservice_sg_checklist.zh-Hant.json
@@ -374,7 +374,7 @@
"metadata": {
"name": "Azure Kubernetes Service Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -401,31 +401,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.en.json b/checklists-ext/azuremachinelearning_sg_checklist.en.json
index d42e8c4be..ae18d1f37 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.en.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.en.json
@@ -333,6 +333,6 @@
"name": "Azure Machine Learning Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.es.json b/checklists-ext/azuremachinelearning_sg_checklist.es.json
index bbb3fea55..2bfbd687a 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.es.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.es.json
@@ -6,7 +6,7 @@
"description": "Una implementación en varias regiones garantiza que las cargas de trabajo de Machine Learning continúen ejecutándose incluso si una región experimenta una interrupción. La implementación en varias regiones mejora la distribución de la carga entre regiones, lo que podría mejorar el rendimiento para los usuarios ubicados en diferentes áreas geográficas. Para obtener más información, consulte Conmutación por error para la continuidad empresarial y la recuperación ante desastres.",
"guid": "f0411b34-73cc-4026-a3e0-495204a7f02b",
"service": "Azure Machine Learning",
- "text": "Implementación de modelos en varias regiones: para mejorar la confiabilidad y la disponibilidad, considere la posibilidad de utilizar un entorno de implementación en varias regiones cuando sea posible.",
+ "text": "Implementación de modelos de varias regiones: para mejorar la confiabilidad y la disponibilidad, considere la posibilidad de utilizar un entorno de implementación de varias regiones cuando sea posible.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -14,7 +14,7 @@
"description": "Los puntos de control del modelo guardan periódicamente el estado del modelo de aprendizaje automático durante el entrenamiento, de modo que se pueda restaurar en caso de interrupción, error o finalización. Para obtener más información, consulte Aumentar la velocidad de los puntos de control y reducir el costo con Nebula.",
"guid": "2d3126b3-dae2-4938-b558-9fbb05ec6342",
"service": "Azure Machine Learning",
- "text": "Resistencia de entrenamiento de modelos: use las características de puntos de control compatibles con Machine Learning, como Azure Container for PyTorch, la clase TensorFlow Estimator o el objeto Run y la clase FileDataset que admiten puntos de control de modelos.",
+ "text": "Resistencia de entrenamiento del modelo: use las características de puntos de control compatibles con Machine Learning, como Azure Container for PyTorch, la clase TensorFlow Estimator o el objeto Run y la clase FileDataset que admiten puntos de control del modelo.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -27,7 +27,7 @@
"waf": "Fiabilidad"
},
{
- "description": "La línea de base de seguridad proporciona orientación personalizada sobre aspectos de seguridad cruciales, como la seguridad de la red, la gestión de identidades, la protección de datos y el acceso con privilegios. Para una seguridad óptima, use Microsoft Defender for Cloud para supervisar estos aspectos.",
+ "description": "La línea de base de seguridad proporciona orientación personalizada sobre aspectos de seguridad cruciales, como la seguridad de la red, la administración de identidades, la protección de datos y el acceso con privilegios. Para una seguridad óptima, use Microsoft Defender for Cloud para supervisar estos aspectos.",
"guid": "9195a712-feaf-4aa9-ac8e-6cfe01423d34",
"service": "Azure Machine Learning",
"text": "Línea base de seguridad: para mejorar la seguridad y el cumplimiento de su servicio de Machine Learning, aplique la línea base de seguridad de Azure para Machine Learning.",
@@ -35,10 +35,10 @@
"waf": "Seguridad"
},
{
- "description": "El aislamiento de red virtual administrado mejora la seguridad al aislar el área de trabajo de otras redes, lo que reduce el riesgo de acceso no autorizado. En un escenario en el que se produce una infracción en otra red dentro de la organización, la red aislada del área de trabajo de Machine Learning no se ve afectada, lo que protege las cargas de trabajo de machine learning.",
+ "description": "El aislamiento de red virtual administrado mejora la seguridad al aislar el área de trabajo de otras redes, lo que reduce el riesgo de acceso no autorizado. En un escenario en el que se produce una infracción en otra red de la organización, la red aislada del área de trabajo de Machine Learning no se ve afectada, lo que protege las cargas de trabajo de machine learning.",
"guid": "01b471f4-3d3d-498c-86b2-9b1b0ef458e3",
"service": "Azure Machine Learning",
- "text": "Aislamiento de red virtual administrada: configure el aislamiento de red virtual administrada para Machine Learning. Al habilitar el aislamiento de red virtual administrada, se crea una red virtual administrada para el área de trabajo. Los recursos de proceso administrados que cree para el área de trabajo usan automáticamente esta red virtual administrada. Si no puede implementar el aislamiento de red virtual administrado, debe seguir las recomendaciones de topología de red para separar el proceso en una subred dedicada lejos del resto de los recursos de la solución, incluidos los puntos de conexión privados para los recursos del área de trabajo.",
+ "text": "Aislamiento de red virtual administrada: configure el aislamiento de red virtual administrada para Machine Learning. Al habilitar el aislamiento de red virtual administrada, se crea una red virtual administrada para el área de trabajo. Los recursos de proceso administrados que cree para el área de trabajo usarán automáticamente esta red virtual administrada. Si no puede implementar el aislamiento de red virtual administrado, debe seguir las recomendaciones de topología de red para separar el proceso en una subred dedicada del resto de los recursos de la solución, incluidos los puntos de conexión privados para los recursos del área de trabajo.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -54,7 +54,7 @@
"description": "Esta configuración minimiza el riesgo de exfiltración de datos, mejorando la seguridad de los datos. Con esta configuración habilitada, un actor malintencionado que obtenga acceso a su sistema no puede enviar sus datos a un destino externo no aprobado.",
"guid": "fb08378f-3b8a-4991-bb1f-f7c3a026fecf",
"service": "Azure Machine Learning",
- "text": "Permitir solo el acceso saliente aprobado: configure el modo de salida en el acceso saliente administrado del área de trabajo de Machine Learning en \"Permitir solo el acceso saliente aprobado\" para minimizar el riesgo de filtración de datos. Configure puntos de conexión privados, etiquetas de servicio o nombres de dominio completos (FQDN) para los recursos a los que necesita acceder.",
+ "text": "Permitir solo el acceso saliente aprobado: configure el modo de salida en el acceso saliente administrado del área de trabajo de Machine Learning a \"Permitir solo el acceso saliente aprobado\" para minimizar el riesgo de filtración de datos. Configure puntos de conexión privados, etiquetas de servicio o nombres de dominio completos (FQDN) para los recursos a los que necesita acceder.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -75,7 +75,7 @@
"waf": "Seguridad"
},
{
- "description": "La deshabilitación de la autenticación local aumenta la seguridad del proceso de Machine Learning y proporciona un control y una administración centralizados de las identidades y las credenciales de recursos.",
+ "description": "La deshabilitación de la autenticación local aumenta la seguridad del proceso de Machine Learning y proporciona un control y una administración centralizados de las identidades y las credenciales de los recursos.",
"guid": "50500732-feb1-42a7-a5ce-271443cd7eeb",
"service": "Azure Machine Learning",
"text": "Deshabilitar la autenticación local: deshabilite la autenticación local para clústeres e instancias de proceso de Machine Learning.",
@@ -99,7 +99,7 @@
"waf": "Seguridad"
},
{
- "description": "El uso de las imágenes más recientes garantiza que se mantenga un entorno coherente, estable y seguro, lo que incluye asegurarse de tener los parches de seguridad más recientes.",
+ "description": "El uso de las imágenes más recientes garantiza que mantenga un entorno coherente, estable y seguro, lo que incluye asegurarse de tener los parches de seguridad más recientes.",
"guid": "9772d2de-8ffe-4918-88d3-4385c6f3b852",
"service": "Azure Machine Learning",
"text": "Obtener la imagen más reciente del sistema operativo: vuelva a crear instancias informáticas para obtener la imagen más reciente del sistema operativo.",
@@ -123,7 +123,7 @@
"waf": "Seguridad"
},
{
- "description": "El cifrado de datos en reposo mejora la seguridad de los datos al garantizar que los datos confidenciales se cifren mediante el uso de claves administradas directamente por usted. Si tiene un requisito normativo para administrar sus propias claves de cifrado, utilice esta función para cumplir con ese requisito.",
+ "description": "El cifrado de datos en reposo mejora la seguridad de los datos, ya que garantiza que los datos confidenciales se cifren mediante el uso de claves administradas directamente por usted. Si tiene un requisito normativo para administrar sus propias claves de cifrado, use esta función para cumplir con ese requisito.",
"guid": "44edeb32-99a9-4c6b-a941-2c4bf8e815ac",
"service": "Azure Machine Learning",
"text": "Cifrar datos en reposo: considere la posibilidad de usar claves administradas por el cliente con Machine Learning.",
@@ -139,18 +139,18 @@
"waf": "Seguridad"
},
{
- "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al costo de ejecución de la carga de trabajo. Elegir una GPU o una SKU de alto rendimiento sin un uso adecuado puede generar gastos innecesarios, mientras que elegir un proceso de tamaño insuficiente puede provocar tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento.",
+ "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al costo de ejecución de la carga de trabajo. La elección de una GPU o una SKU de alto rendimiento sin un uso adecuado puede dar lugar a un gasto innecesario, mientras que la elección de un proceso de tamaño insuficiente puede dar lugar a tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento.",
"guid": "04967265-74a1-4b44-a559-a2b64ab9b67b",
"service": "Azure Machine Learning",
- "text": "Optimice los recursos informáticos: optimice los recursos informáticos en función de los requisitos de la carga de trabajo. Elija la SKU que mejor se adapte a su carga de trabajo:- Propósito general: relación equilibrada entre CPU y memoria, buena para todos los propósitos.
- Optimizado para cómputo: alta relación entre CPU y memoria, buena para cálculos matemáticos pesados.
- Optimizado para memoria: alta memoria para CPU, buena para cálculos en memoria o aplicaciones de bases de datos.
- Serie M: máquinas muy grandes que tienen grandes cantidades de memoria y CPU.
- GPU: mejor para modelos con un gran número de variables que pueden beneficiarse de un mayor paralelismo e instrucciones de núcleo especializadas. Las aplicaciones típicas son el aprendizaje profundo, el procesamiento de imágenes o vídeos, las simulaciones científicas, la minería de datos y el aprovechamiento de los marcos de desarrollo de GPU. Pruebe con varias familias y documente los resultados como referencia. A medida que el modelo y los datos evolucionan, es posible que cambie el recurso informático más adecuado. Supervise los tiempos de ejecución y reevalúe según sea necesario.",
+ "text": "Optimice los recursos informáticos: optimice los recursos informáticos en función de los requisitos de la carga de trabajo. Elija la SKU que mejor se adapte a su carga de trabajo:
- Propósito general: relación equilibrada entre CPU y memoria, buena para todos los propósitos.
- Optimizado para computación: alta relación entre CPU y memoria, buena para cálculos matemáticos pesados.
- Optimizado para memoria: alta memoria para la CPU, buena para cálculos en memoria o aplicaciones de bases de datos.
- Serie M: máquinas muy grandes que tienen grandes cantidades de memoria y CPU.
- GPU: mejor para modelos con un gran número de variables que pueden beneficiarse de un mayor paralelismo e instrucciones básicas especializadas. Las aplicaciones típicas son el aprendizaje profundo, el procesamiento de imágenes o vídeos, las simulaciones científicas, la minería de datos y el aprovechamiento de los marcos de desarrollo de GPU. Pruebe con varias familias y documente los resultados como referencia. A medida que el modelo y los datos evolucionan, es posible que cambie el recurso informático más adecuado. Supervise los tiempos de ejecución y reevalúe según sea necesario.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Configure el escalado automático para que los clústeres de proceso reduzcan verticalmente cuando su uso sea bajo. Establezca el número mínimo de nodos en 0 para que los clústeres de entrenamiento se reduzcan verticalmente a 0 cuando no estén en uso.",
+ "description": "Configure el escalado automático para que los clústeres de proceso se reduzcan verticalmente cuando su uso sea bajo. Establezca el número mínimo de nodos en 0 para que los clústeres de entrenamiento se reduzcan verticalmente a 0 cuando no estén en uso.",
"guid": "052b07f8-ae5a-4425-8c1c-7b2eda14d127",
"service": "Azure Machine Learning",
- "text": "Optimice el escalado de proceso: configure los clústeres de proceso para el escalado automático a fin de asegurarse de que solo usa lo que necesita. Para los clústeres de entrenamiento, establezca el número mínimo de nodos en 0 y configure la cantidad de tiempo que el nodo está inactivo en un tiempo adecuado. Para una experimentación menos iterativa, reduzca el tiempo para ahorrar costos. Para una experimentación más iterativa, use un tiempo más alto para evitar pagar por escalar hacia arriba o hacia abajo después de cada cambio.",
+ "text": "Optimice el escalado de proceso: configure los clústeres de proceso para el escalado automático a fin de asegurarse de que solo usa lo que necesita. Para los clústeres de entrenamiento, establezca el número mínimo de nodos en 0 y configure la cantidad de tiempo que el nodo está inactivo en un tiempo adecuado. Para una experimentación menos iterativa, reduzca el tiempo para ahorrar costos. Para una experimentación más iterativa, use un tiempo mayor para evitar pagar por escalar hacia arriba o hacia abajo después de cada cambio.",
"type": "recommendation",
"waf": "Costar"
},
@@ -158,20 +158,20 @@
"description": "La configuración de directivas de terminación puede ayudarle a ahorrar costos al detener las ejecuciones que no funcionan antes de tiempo.",
"guid": "84efffef-23ff-465c-bb2a-f01d88e73c7e",
"service": "Azure Machine Learning",
- "text": "Establecer políticas de finalización del entrenamiento: establezca políticas de finalización anticipada para limitar la duración de las ejecuciones de entrenamiento o finalizarlas antes de tiempo.",
+ "text": "Establecer directivas de finalización del entrenamiento: establezca directivas de finalización anticipada para limitar la duración de las ejecuciones de entrenamiento o finalizarlas antes de tiempo.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Las máquinas virtuales de baja prioridad permiten utilizar una gran cantidad de potencia de proceso a bajo costo. Aprovechan el excedente de capacidad de Azure.",
+ "description": "Las máquinas virtuales de baja prioridad permiten usar una gran cantidad de potencia de proceso a bajo costo. Aprovechan el excedente de capacidad de Azure.",
"guid": "dc2f2c28-1da5-4b18-9ffc-69ebc766d184",
"service": "Azure Machine Learning",
- "text": "Usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes: considere la posibilidad de usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes que no sean urgentes y en las que las interrupciones sean recuperables.",
+ "text": "Usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes: considere la posibilidad de usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes que no sean sensibles al tiempo y en las que se puedan recuperar las interrupciones.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "De forma predeterminada, las instancias de proceso están disponibles para usted, acumulando costos. Configurar instancias de proceso para que se apaguen cuando estén inactivas o configurar una programación para ellas ahorra costos cuando no están en uso.",
+ "description": "De forma predeterminada, las instancias informáticas están disponibles para usted, acumulando costos. La configuración de instancias informáticas para que se apaguen cuando estén inactivas o la configuración de una programación para ellas ahorra costos cuando no están en uso.",
"guid": "379134e1-c92f-4b18-9a3e-0f944a973aa4",
"service": "Azure Machine Learning",
"text": "Habilitar el apagado inactivo para instancias informáticas: habilite el apagado inactivo para instancias informáticas o programe una hora de inicio y finalización si se conoce el tiempo de uso.",
@@ -187,7 +187,7 @@
"waf": "Costar"
},
{
- "description": "Compre Azure Reserved VM Instances para pagar por adelantado el uso de máquinas virtuales y ofrecer descuentos con precios de pago por uso. El descuento se aplica automáticamente por el uso de la máquina virtual que coincida con la reserva.",
+ "description": "Compre Azure Reserved VM Instances para pagar por adelantado el uso de máquinas virtuales y ofrecer descuentos con precios de pago por uso. El descuento se aplica automáticamente al uso de la máquina virtual que coincida con la reserva.",
"guid": "da87b89e-6218-4bf7-8d4b-b988fd2b3156",
"service": "Azure Machine Learning",
"text": "Azure Reserved VM Instances: compre Azure Reserved VM Instances si tiene una buena estimación del uso durante los próximos uno a tres años. Aproveche las opciones de capacidad reservada para los servicios cuando tenga buenas estimaciones de uso.",
@@ -203,10 +203,10 @@
"waf": "Operaciones"
},
{
- "description": "Use los registros de modelos de Machine Learning para almacenar y versionar los modelos de Machine Learning para realizar un seguimiento de los cambios y mantener el linaje con el trabajo y los conjuntos de datos utilizados para el entrenamiento. Con los catálogos de modelos de Machine Learning, los equipos de ciencia de datos pueden descubrir, evaluar y ajustar modelos fundamentales de aprendizaje automático preentrenados. El almacenamiento de modelos con versiones en registros de modelos de Machine Learning admite estrategias de implementación como versiones A/B, versiones Canary y reversiones.",
+ "description": "Use los registros de modelos de Machine Learning para almacenar y versionar los modelos de Machine Learning para realizar un seguimiento de los cambios y mantener el linaje con el trabajo y los conjuntos de datos utilizados para el entrenamiento. Con los catálogos de modelos de Machine Learning, los equipos de ciencia de datos pueden detectar, evaluar y ajustar modelos fundamentales de aprendizaje automático preentrenados. El almacenamiento de modelos con versiones en registros de modelos de Machine Learning admite estrategias de implementación como versiones A/B, versiones canary y reversiones.",
"guid": "796e23ec-1071-4131-b0d3-77121aae8e33",
"service": "Azure Machine Learning",
- "text": "Aproveche los catálogos y registros de modelos: aproveche los catálogos y registros de modelos de Machine Learning para almacenar, versionar y compartir activos de Machine Learning. Utilice los catálogos de modelos de Machine Learning para ayudarle a implementar las pruebas A/B y la implementación de modelos.",
+ "text": "Aproveche los catálogos y registros de modelos: aproveche los catálogos y registros de modelos de Machine Learning para almacenar, versionar y compartir activos de Machine Learning. Use los catálogos de modelos de Machine Learning para ayudarle a implementar pruebas A/B e implementación de modelos.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -219,7 +219,7 @@
"waf": "Operaciones"
},
{
- "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos de proceso en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarte si te estás acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir horizontalmente, escalar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
+ "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos informáticos en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarle si se está acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir verticalmente, aumentar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
"guid": "1d6384f8-a394-46f3-acf0-caf1f82b15c0",
"service": "Azure Machine Learning",
"text": "Supervisar la infraestructura: si los modelos se implementan en puntos de conexión en línea, habilite Application Insights para supervisar los puntos de conexión y las implementaciones en línea. Supervise la infraestructura de formación para asegurarse de que cumple con los requisitos básicos. Asegúrese de recopilar registros de recursos para Machine Learning.",
@@ -235,10 +235,10 @@
"waf": "Operaciones"
},
{
- "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al tiempo de entrenamiento. La elección de la SKU y la CPU correctas en comparación con la GPU garantiza que el entrenamiento de su modelo pueda cumplir con sus requisitos y objetivos de rendimiento. Elegir una SKU de bajo rendimiento que se use en exceso puede provocar tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento. Los clústeres de proceso proporcionan la capacidad de mejorar el rendimiento mediante el escalado horizontal de las cargas de trabajo que admiten el escalado horizontal. Este método proporciona flexibilidad para manejar cargas de trabajo con diferentes demandas y le permite agregar o quitar máquinas según sea necesario.",
+ "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al tiempo de entrenamiento. Elegir la SKU y la CPU correctas en lugar de la GPU garantiza que el entrenamiento de su modelo pueda cumplir con sus requisitos y objetivos de rendimiento. Elegir una SKU de bajo rendimiento que se use en exceso puede provocar tiempos de entrenamiento prohibitivos y problemas de rendimiento. Los clústeres de proceso proporcionan la capacidad de mejorar el rendimiento mediante el escalado horizontal de las cargas de trabajo que admiten el escalado horizontal. Este método proporciona flexibilidad para manejar cargas de trabajo con diferentes demandas y le permite agregar o quitar máquinas según sea necesario.",
"guid": "7ff0753e-559c-4872-9b46-056600d393b9",
"service": "Azure Machine Learning",
- "text": "Seleccione los servicios de proceso adecuados para el entrenamiento de modelos: considere la posibilidad de utilizar clústeres de proceso de Machine Learning en lugar de instancias de proceso para el entrenamiento de modelos si necesita escalado automático. Optimice sus recursos informáticos en función de los requisitos de formación. En primer lugar, elija entre CPU y GPU. De forma predeterminada, utilice CPU, pero considere las GPU para cargas de trabajo como el aprendizaje profundo, el procesamiento de imágenes o vídeos, o grandes cantidades de datos. A continuación, elija la SKU de imagen que mejor se adapte a su carga de trabajo. Use las pruebas para elegir la opción de proceso que optimiza el costo en función del tiempo de entrenamiento al determinar la línea base.",
+ "text": "Seleccione los servicios de proceso adecuados para el entrenamiento de modelos: considere la posibilidad de utilizar clústeres de proceso de Machine Learning en lugar de instancias de proceso para el entrenamiento de modelos si necesita el escalado automático. Optimice sus recursos informáticos en función de los requisitos de formación. En primer lugar, elija entre CPU y GPU. De forma predeterminada, utilice CPU, pero considere las GPU para cargas de trabajo como el aprendizaje profundo, el procesamiento de imágenes o vídeos, o grandes cantidades de datos. A continuación, elija la SKU de imagen que mejor se adapte a su carga de trabajo. Use las pruebas para elegir la opción de proceso que optimiza el costo en función del tiempo de entrenamiento al determinar la línea base.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -254,15 +254,15 @@
"description": "El seguimiento del rendimiento de los modelos en producción le alerta de posibles problemas, como el desfase de datos, el desfase de predicción, la calidad de los datos y el desfase de atribución de características. La supervisión del desfase de datos le ayuda a detectar cambios en los datos de entrada que pueden provocar una disminución en el rendimiento del modelo. La administración del desfase de datos le ayuda a garantizar que el modelo proporcione resultados precisos a lo largo del tiempo.",
"guid": "c1d46066-94b8-4482-800d-1c9f7f5704ad",
"service": "Azure Machine Learning",
- "text": "Supervise el rendimiento del modelo: supervise el rendimiento de los modelos implementados.",
+ "text": "Supervisar el rendimiento del modelo: supervise el rendimiento de los modelos implementados.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos de proceso en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarte si te estás acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir horizontalmente, escalar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
+ "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos informáticos en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarle si se está acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir verticalmente, aumentar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
"guid": "60fc9cf9-8eec-422c-9894-70a364e63ece",
"service": "Azure Machine Learning",
- "text": "Supervise la infraestructura: supervise los puntos finales en línea e intégrelos con Monitor para realizar un seguimiento y supervisar las métricas y los registros adecuados. Habilite Application Insights al crear implementaciones en línea. Supervise la infraestructura de entrenamiento y revise el uso de recursos, como la memoria y el uso de CPU o GPU, al entrenar modelos para asegurarse de que cumple con los requisitos básicos.",
+ "text": "Supervise la infraestructura: supervise los puntos finales en línea e intégrelo con Monitor para realizar un seguimiento y supervisar las métricas y los registros adecuados. Habilite Application Insights al crear implementaciones en línea. Supervise la infraestructura de entrenamiento y revise el uso de recursos, como la memoria y el uso de CPU o GPU, al entrenar modelos para asegurarse de que cumple con los requisitos básicos.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -270,7 +270,7 @@
"metadata": {
"name": "Azure Machine Learning Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -297,31 +297,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.ja.json b/checklists-ext/azuremachinelearning_sg_checklist.ja.json
index eea2bef9b..00e9060cd 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.ja.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.ja.json
@@ -270,7 +270,7 @@
"metadata": {
"name": "Azure Machine Learning Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -297,31 +297,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.ko.json b/checklists-ext/azuremachinelearning_sg_checklist.ko.json
index 8b9286ed8..0d96fa5cf 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.ko.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.ko.json
@@ -14,20 +14,20 @@
"description": "모델 체크포인트는 훈련 중에 기계 학습 모델의 상태를 주기적으로 저장하므로 중단, 실패 또는 종료 시 복원할 수 있습니다. 자세한 내용은 Boost checkpoint speed and reduce cost with Nebula를 참조하십시오.",
"guid": "2d3126b3-dae2-4938-b558-9fbb05ec6342",
"service": "Azure Machine Learning",
- "text": "모델 학습 복원력: 모델 검사점을 지원하는 Azure Container for PyTorch, TensorFlow Estimator 클래스 또는 Run 개체 및 FileDataset 클래스를 포함하여 Machine Learning에서 지원하는 검사점 지정 기능을 사용합니다.",
+ "text": "모델 학습 복원력: Azure Container for PyTorch, TensorFlow Estimator 클래스 또는 모델 검사점을 지원하는 Run 개체 및 FileDataset 클래스를 포함하여 Machine Learning에서 지원하는 검사점 지정 기능을 사용합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "우선 순위가 낮은 가상 머신은 가격이 저렴하지만 선점할 수 있습니다. 전용 가상 머신 계층을 사용하는 클러스터는 선점되지 않습니다.",
+ "description": "우선 순위가 낮은 가상 머신은 할인된 가격으로 제공되지만 선점할 수 있습니다. 전용 가상 머신 계층을 사용하는 클러스터는 선점되지 않습니다.",
"guid": "d9a0f9e6-a89c-4516-83ec-6f22ae29aaaf",
"service": "Azure Machine Learning",
- "text": "컴퓨팅 클러스터에 전용 가상 머신 계층 사용: 일괄 처리 추론을 위한 컴퓨팅 클러스터에 전용 가상 머신 계층을 사용하여 일괄 처리 작업이 선점되지 않도록 합니다.",
+ "text": "계산 클러스터에 전용 가상 머신 계층 사용: 일괄 처리 유추를 위해 계산 클러스터에 전용 가상 머신 계층을 사용하여 일괄 처리 작업이 선점되지 않도록 합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "보안 기준은 네트워크 보안, ID 관리, 데이터 보호 및 권한 있는 액세스와 같은 중요한 보안 측면에 대한 맞춤형 지침을 제공합니다. 최적의 보안을 위해 클라우드용 Microsoft Defender를 사용하여 이러한 측면을 모니터링합니다.",
+ "description": "보안 기준은 네트워크 보안, ID 관리, 데이터 보호 및 권한 있는 액세스와 같은 중요한 보안 측면에 대한 맞춤형 지침을 제공합니다. 최적의 보안을 위해 클라우드용 Microsoft Defender 사용하여 이러한 측면을 모니터링합니다.",
"guid": "9195a712-feaf-4aa9-ac8e-6cfe01423d34",
"service": "Azure Machine Learning",
"text": "보안 기준: Machine Learning Service의 보안 및 규정 준수를 강화하려면 Machine Learning에 대한 Azure 보안 기준을 적용합니다.",
@@ -35,7 +35,7 @@
"waf": "안전"
},
{
- "description": "관리형 가상 네트워크 격리는 작업 영역을 다른 네트워크로부터 격리하여 보안을 강화하고 무단 액세스의 위험을 줄입니다. 조직 내의 다른 네트워크에서 위반이 발생하는 시나리오에서 Machine Learning 작업 영역의 격리된 네트워크는 영향을 받지 않고 유지되어 기계 학습 워크로드를 보호합니다.",
+ "description": "관리형 가상 네트워크 격리는 작업 영역을 다른 네트워크와 격리하여 무단 액세스의 위험을 줄여 보안을 강화합니다. 조직 내의 다른 네트워크에서 위반이 발생하는 시나리오에서 Machine Learning 작업 영역의 격리된 네트워크는 영향을 받지 않고 유지되어 기계 학습 워크로드를 보호합니다.",
"guid": "01b471f4-3d3d-498c-86b2-9b1b0ef458e3",
"service": "Azure Machine Learning",
"text": "관리형 가상 네트워크 격리: Machine Learning에 대한 관리형 가상 네트워크 격리를 구성합니다. 관리형 가상 네트워크 격리를 사용하도록 설정하면 작업 영역에 대한 관리형 가상 네트워크가 만들어집니다. 작업 영역에 대해 만드는 관리형 컴퓨팅 리소스는 이 관리형 가상 네트워크를 자동으로 사용합니다. 관리형 가상 네트워크 격리를 구현할 수 없는 경우 네트워크 토폴로지 권장 사항에 따라 작업 영역 리소스에 대한 프라이빗 엔드포인트를 포함하여 솔루션의 나머지 리소스와 떨어진 전용 서브넷으로 컴퓨팅을 분리해야 합니다.",
@@ -75,7 +75,7 @@
"waf": "안전"
},
{
- "description": "로컬 인증을 사용하지 않도록 설정하면 Machine Learning 컴퓨팅의 보안이 강화되고 ID 및 리소스 자격 증명을 중앙 집중식으로 제어하고 관리할 수 있습니다.",
+ "description": "로컬 인증을 사용하지 않도록 설정하면 Machine Learning 컴퓨팅의 보안이 강화되고 ID 및 리소스 자격 증명을 중앙 집중식으로 제어 및 관리할 수 있습니다.",
"guid": "50500732-feb1-42a7-a5ce-271443cd7eeb",
"service": "Azure Machine Learning",
"text": "로컬 인증 사용 안 함: Machine Learning 컴퓨팅 클러스터 및 인스턴스에 대한 로컬 인증을 사용하지 않도록 설정합니다.",
@@ -83,7 +83,7 @@
"waf": "안전"
},
{
- "description": "SSH 액세스를 비활성화하면 권한이 없는 개인이 액세스 권한을 얻어 잠재적으로 시스템에 해를 끼치는 것을 방지하고 무차별 암호 대입 공격으로부터 사용자를 보호할 수 있습니다.",
+ "description": "SSH 액세스를 비활성화하면 권한이 없는 개인이 액세스 권한을 얻어 잠재적으로 시스템에 해를 끼치는 것을 방지하고 무차별 암호 대입 공격으로부터 보호할 수 있습니다.",
"guid": "3e537535-ca7e-4669-a580-92819410e4d4",
"service": "Azure Machine Learning",
"text": "공용 SSH 포트 사용 안 함: 'remoteLoginPortPublicAccess'를 '사용 안 함'으로 설정하여 Machine Learning 컴퓨팅 클러스터에서 공용 SSH(Secure Shell) 포트가 닫혀 있는지 확인합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
@@ -94,12 +94,12 @@
"description": "컴퓨팅 인스턴스 또는 클러스터에 대한 무단 액세스 가능성을 제한하여 보안을 강화하기 위해 공용 IP 주소를 프로비저닝하지 마세요.",
"guid": "4ed5455d-c887-4075-9f11-16408abdffd9",
"service": "Azure Machine Learning",
- "text": "Machine Learning 컴퓨팅에 대한 공용 IP 주소 프로비저닝 안 함: Machine Learning 컴퓨팅 클러스터 또는 컴퓨팅 인스턴스를 프로비저닝할 때 enableNodePublicIP를 'false'로 설정합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
+ "text": "Machine Learning 컴퓨팅에 대한 공용 IP 주소를 프로비전하지 않음: Machine Learning 컴퓨팅 클러스터 또는 컴퓨팅 인스턴스를 프로비전할 때 enableNodePublicIp를 'false'로 설정합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "최신 이미지를 사용하면 최신 보안 패치를 사용하는 것을 포함하여 일관되고 안정적이며 안전한 환경을 유지할 수 있습니다.",
+ "description": "최신 이미지를 사용하면 최신 보안 패치를 포함하여 일관되고 안정적이며 안전한 환경을 유지할 수 있습니다.",
"guid": "9772d2de-8ffe-4918-88d3-4385c6f3b852",
"service": "Azure Machine Learning",
"text": "최신 운영 체제 이미지 가져오기: 컴퓨트 인스턴스를 다시 만들어 최신 운영 체제 이미지를 가져옵니다.",
@@ -107,7 +107,7 @@
"waf": "안전"
},
{
- "description": "엄격한 작업 영역 액세스 제어는 개인이 자신의 역할에 필요한 권한만 갖도록 하여 보안을 강화합니다. 예를 들어 데이터 사이언티스트는 실험을 실행할 수 있는 액세스 권한이 있지만 보안 설정을 수정할 수는 없어 잠재적인 보안 위험을 최소화할 수 있습니다.",
+ "description": "엄격한 작업 영역 액세스 제어는 개인이 자신의 역할에 필요한 권한만 갖도록 하여 보안을 강화합니다. 예를 들어 데이터 사이언티스트는 실험을 실행할 수 있는 액세스 권한이 있지만 보안 설정을 수정할 수는 없으므로 잠재적인 보안 위험을 최소화할 수 있습니다.",
"guid": "6d277dc0-7569-4ef5-b7b5-3958e102ef3b",
"service": "Azure Machine Learning",
"text": "엄격한 Machine Learning 작업 영역 액세스 제어: Microsoft Entra ID 그룹을 사용하여 작업 영역 액세스를 관리하고 RBAC에 대한 최소 권한 원칙을 준수합니다.",
@@ -123,7 +123,7 @@
"waf": "안전"
},
{
- "description": "미사용 데이터를 암호화하면 사용자가 직접 관리하는 키를 사용하여 중요한 데이터를 암호화하여 데이터 보안을 강화할 수 있습니다. 자체 암호화 키를 관리해야 하는 규정 요구 사항이 있는 경우 이 기능을 사용하여 해당 요구 사항을 준수합니다.",
+ "description": "미사용 데이터를 암호화하면 사용자가 직접 관리하는 키를 사용하여 중요한 데이터를 암호화하여 데이터 보안을 강화할 수 있습니다. 자체 암호화 키를 관리하기 위한 규정 요구 사항이 있는 경우 이 기능을 사용하여 해당 요구 사항을 준수합니다.",
"guid": "44edeb32-99a9-4c6b-a941-2c4bf8e815ac",
"service": "Azure Machine Learning",
"text": "미사용 데이터 암호화: Machine Learning에서 고객 관리형 키를 사용하는 것이 좋습니다.",
@@ -139,15 +139,15 @@
"waf": "안전"
},
{
- "description": "올바른 컴퓨팅을 선택하는 것은 워크로드 실행 비용에 직접적인 영향을 미치므로 매우 중요합니다. 적절하게 사용하지 않고 GPU 또는 고성능 SKU를 선택하면 낭비적인 지출로 이어질 수 있으며, 크기가 작은 컴퓨팅을 선택하면 엄청나게 긴 훈련 시간과 성능 문제가 발생할 수 있습니다.",
+ "description": "올바른 컴퓨팅을 선택하는 것은 워크로드 실행 비용에 직접적인 영향을 미치므로 매우 중요합니다. 적절한 사용 없이 GPU 또는 고성능 SKU를 선택하면 낭비적인 지출로 이어질 수 있으며, 크기가 작은 컴퓨팅을 선택하면 엄청나게 긴 훈련 시간과 성능 문제가 발생할 수 있습니다.",
"guid": "04967265-74a1-4b44-a559-a2b64ab9b67b",
"service": "Azure Machine Learning",
- "text": "Optimize compute resources(계산 리소스 최적화): 워크로드의 요구 사항에 따라 계산 리소스를 최적화합니다. 워크로드에 가장 적합한 SKU 선택:
- 범용 – 균형 잡힌 CPU 대 메모리 비율, 모든 용도에 적합합니다.
- 컴퓨팅 최적화 – CPU 대 메모리 비율이 높아 수학이 많이 필요한 계산에 적합합니다.
- 메모리 최적화 – CPU 대비 메모리가 높아 메모리 내 계산 또는 데이터베이스 애플리케이션에 적합합니다.
- M 시리즈 – 엄청난 양의 메모리와 CPU를 가진 매우 큰 컴퓨터.
- GPU – 더 높은 병렬 처리와 전문화된 핵심 명령의 이점을 누릴 수 있는 변수 수가 많은 모델에 더 좋습니다. 일반적인 응용 분야는 딥 러닝, 이미지 또는 비디오 처리, 과학 시뮬레이션, 데이터 마이닝, GPU 개발 프레임워크 활용 등입니다. 여러 패밀리로 테스트하고 결과를 기준선으로 문서화합니다. 모델과 데이터가 발전함에 따라 가장 적절한 컴퓨팅 리소스가 변경될 수 있습니다. 실행 시간을 모니터링하고 필요에 따라 다시 평가합니다.",
+ "text": "Optimize compute resources(계산 리소스 최적화): 워크로드의 요구 사항에 따라 계산 리소스를 최적화합니다. 워크로드에 가장 적합한 SKU 선택:
- 범용 – 균형 잡힌 CPU 대 메모리 비율, 모든 용도에 적합합니다.
- 컴퓨팅 최적화 – CPU 대 메모리 비율이 높아 수학이 많이 필요한 계산에 적합합니다.
- 메모리 최적화 – CPU 대비 메모리가 높아 메모리 내 계산 또는 데이터베이스 애플리케이션에 적합합니다.
- M 시리즈 – 엄청난 양의 메모리와 CPU를 가진 매우 큰 기계.
- GPU – 더 높은 병렬 처리와 전문화된 핵심 명령의 이점을 누릴 수 있는 변수 수가 많은 모델에 더 좋습니다. 일반적인 응용 분야는 딥 러닝, 이미지 또는 비디오 처리, 과학 시뮬레이션, 데이터 마이닝, GPU 개발 프레임워크 활용 등입니다. 여러 패밀리로 테스트하고 결과를 기준선으로 문서화합니다. 모델과 데이터가 발전함에 따라 가장 적절한 컴퓨팅 리소스가 변경될 수 있습니다. 실행 시간을 모니터링하고 필요에 따라 다시 평가합니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "사용량이 적을 때 컴퓨팅 클러스터가 축소되도록 자동 크기 조정을 구성합니다. 학습 클러스터가 사용하지 않을 때 0으로 축소되도록 최소 노드 수를 0으로 설정합니다.",
+ "description": "사용량이 낮을 때 축소하도록 컴퓨팅 클러스터에 대한 자동 크기 조정을 구성합니다. 사용하지 않을 때 학습 클러스터가 0으로 축소되도록 최소 노드 수를 0으로 설정합니다.",
"guid": "052b07f8-ae5a-4425-8c1c-7b2eda14d127",
"service": "Azure Machine Learning",
"text": "컴퓨팅 크기 조정 최적화: 필요한 항목만 사용하도록 자동 크기 조정을 위해 컴퓨팅 클러스터를 구성합니다. 학습 클러스터의 경우 최소 노드 수를 0으로 설정하고 노드가 유휴 상태인 시간을 적절한 시간으로 구성합니다. 반복적인 실험을 줄이려면 시간을 줄여 비용을 절감하십시오. 더 반복적인 실험의 경우 각 변경 후 확장 또는 축소에 대한 비용을 지불하지 않도록 더 많은 시간을 사용합니다.",
@@ -195,7 +195,7 @@
"waf": "비용"
},
{
- "description": "작업 공간 수를 제한하면 유지 관리 노력과 운영 비용이 절감됩니다. 보안과 같은 요구 사항의 경우 여러 개의 개별 작업 영역이 필요할 수 있습니다. 가능한 경우 작업 영역 수를 최소화합니다.",
+ "description": "작업 공간 수를 제한하면 유지 관리 작업과 운영 비용이 절감됩니다. 보안과 같은 요구 사항의 경우 여러 개의 개별 작업 영역이 필요할 수 있습니다. 가능한 경우 작업 영역 수를 최소화합니다.",
"guid": "e8d7df42-a0cf-49ea-9f9a-d01849c92a2b",
"service": "Azure Machine Learning",
"text": "Machine Learning 작업 영역 인스턴스 최소화: 가능한 경우 작업 영역 수를 최소화하여 유지 관리를 줄입니다.",
@@ -203,15 +203,15 @@
"waf": "작업"
},
{
- "description": "Machine Learning 모델 레지스트리를 사용하여 기계 학습 모델을 저장하고 버전을 관리하여 변경 사항을 추적하고 교육에 사용되는 작업 및 데이터 세트와의 계보를 유지 관리합니다. Machine Learning 모델 카탈로그를 사용하면 데이터 과학 팀이 사전 훈련된 기본 기계 학습 모델을 검색, 평가 및 미세 조정할 수 있습니다. 버전이 지정된 모델을 Machine Learning 모델 레지스트리에 저장하면 A/B 릴리스, 카나리아 릴리스 및 롤백과 같은 배포 전략을 지원할 수 있습니다.",
+ "description": "Machine Learning 모델 레지스트리를 사용하여 기계 학습 모델을 저장하고 버전을 관리하여 변경 사항을 추적하고 교육에 사용되는 작업 및 데이터 세트와의 계보를 유지 관리합니다. Machine Learning 모델 카탈로그를 사용하면 데이터 과학 팀이 사전 훈련된 기본 기계 학습 모델을 검색, 평가 및 미세 조정할 수 있습니다. 버전이 지정된 모델을 Machine Learning 모델 레지스트리에 저장하면 A/B 릴리스, 카나리아 릴리스 및 롤백과 같은 배포 전략이 지원됩니다.",
"guid": "796e23ec-1071-4131-b0d3-77121aae8e33",
"service": "Azure Machine Learning",
- "text": "모델 카탈로그 및 레지스트리 활용: Machine Learning 모델 카탈로그 및 레지스트리를 활용하여 기계 학습 자산을 저장, 버전 관리 및 공유합니다. Machine Learning 모델 카탈로그를 사용하여 모델의 A/B 테스트 및 배포를 구현할 수 있습니다.",
+ "text": "모델 카탈로그 및 레지스트리 활용: Machine Learning 모델 카탈로그 및 레지스트리를 활용하여 Machine Learning 자산을 저장, 버전 관리 및 공유합니다. Machine Learning 모델 카탈로그를 사용하여 A/B 테스트 및 모델 배포를 구현할 수 있습니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "배포된 모델을 모니터링하면 모델이 성능 요구 사항을 충족하는지 확인할 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하도록 할 수 있습니다.",
+ "description": "배포된 모델을 모니터링하면 모델이 성능 요구 사항을 충족하는지 확인할 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하는지 확인할 수 있습니다.",
"guid": "295dae47-5380-41c6-b1bd-bfa3605a4e10",
"service": "Azure Machine Learning",
"text": "모델 성능 모니터링: 배포된 모델의 성능을 모니터링하고 데이터 세트에서 데이터 드리프트를 감지합니다.",
@@ -219,7 +219,7 @@
"waf": "작업"
},
{
- "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 메트릭에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는지 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 이 정보를 사용하여 규모 확대 또는 축소를 결정하거나, 다양한 성능의 SKU로 규모 축소를 결정하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
+ "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 지표에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는 경우 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 해당 정보를 사용하여 규모 감축 또는 축소를 결정하거나, 다양한 성능의 SKU로 확장 또는 축소하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
"guid": "1d6384f8-a394-46f3-acf0-caf1f82b15c0",
"service": "Azure Machine Learning",
"text": "인프라 모니터링: 모델이 온라인 엔드포인트에 배포된 경우 Application Insights를 사용하여 온라인 엔드포인트 및 배포를 모니터링할 수 있습니다. 교육 인프라를 모니터링하여 기준 요구 사항을 충족하고 있는지 확인합니다. Machine Learning에 대한 리소스 로그를 수집하고 있는지 확인합니다.",
@@ -235,10 +235,10 @@
"waf": "작업"
},
{
- "description": "올바른 컴퓨팅을 선택하는 것은 학습 시간에 직접적인 영향을 미치므로 매우 중요합니다. 올바른 SKU 및 CPU와 GPU를 선택하면 모델 학습이 요구 사항과 성능 목표를 충족할 수 있습니다. 과도하게 사용되는 저성능 SKU를 선택하면 학습 시간이 엄청나게 길어지고 성능 문제가 발생할 수 있습니다. 컴퓨팅 클러스터는 수평적 확장을 지원하는 워크로드를 확장하여 성능을 개선할 수 있는 기능을 제공합니다. 이 방법은 다양한 요구 사항이 있는 워크로드를 처리할 수 있는 유연성을 제공하며 필요에 따라 컴퓨터를 추가하거나 제거할 수 있습니다.",
+ "description": "올바른 컴퓨팅을 선택하는 것은 학습 시간에 직접적인 영향을 미치므로 매우 중요합니다. GPU와 비교하여 올바른 SKU 및 CPU를 선택하면 모델 학습이 요구 사항과 성능 목표를 충족할 수 있습니다. 과도하게 사용되는 저성능 SKU를 선택하면 학습 시간이 엄청나게 길어지고 성능 문제가 발생할 수 있습니다. 컴퓨팅 클러스터는 수평적 확장을 지원하는 워크로드를 확장하여 성능을 개선할 수 있는 기능을 제공합니다. 이 방법은 다양한 요구 사항이 있는 워크로드를 처리할 수 있는 유연성을 제공하며 필요에 따라 컴퓨터를 추가하거나 제거할 수 있습니다.",
"guid": "7ff0753e-559c-4872-9b46-056600d393b9",
"service": "Azure Machine Learning",
- "text": "모델 학습에 적합한 컴퓨팅 서비스 선택: 자동 크기 조정이 필요한 경우 모델 학습을 위해 컴퓨팅 인스턴스보다 Machine Learning 컴퓨팅 클러스터를 고려합니다. 학습 요구 사항에 따라 컴퓨팅 리소스를 최적화합니다. 먼저 CPU와 GPU 중에서 선택합니다. 기본적으로 CPU를 사용하지만 딥 러닝, 이미지 또는 비디오 처리 또는 대용량 데이터와 같은 워크로드에는 GPU를 사용하는 것이 좋습니다. 다음으로, 워크로드에 가장 적합한 이미지 SKU를 선택합니다. 테스트를 사용하여 기준선을 결정할 때 학습 시간 대비 비용을 최적화하는 컴퓨팅 옵션을 선택합니다.",
+ "text": "모델 학습에 적합한 컴퓨팅 서비스 선택: 자동 크기 조정이 필요한 경우 모델 학습을 위해 컴퓨팅 인스턴스보다 Machine Learning 컴퓨팅 클러스터를 고려합니다. 학습 요구 사항에 따라 컴퓨팅 리소스를 최적화합니다. 먼저 CPU와 GPU 중에서 선택합니다. 기본적으로 CPU를 사용하지만 딥 러닝, 이미지 또는 비디오 처리 또는 대용량 데이터와 같은 워크로드에는 GPU를 사용하는 것이 좋습니다. 다음으로, 워크로드에 가장 적합한 이미지 SKU를 선택합니다. 테스트를 사용하여 기준선을 결정할 때 학습 시간에 대한 비용을 최적화하는 컴퓨팅 옵션을 선택합니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -251,7 +251,7 @@
"waf": "공연"
},
{
- "description": "프로덕션에서 모델의 성능을 추적하면 데이터 드리프트, 예측 드리프트, 데이터 품질 및 기능 속성 드리프트와 같은 잠재적인 문제에 대한 경고를 받을 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하도록 할 수 있습니다.",
+ "description": "프로덕션에서 모델의 성능을 추적하면 데이터 드리프트, 예측 드리프트, 데이터 품질 및 기능 속성 드리프트와 같은 잠재적인 문제에 대한 경고를 받을 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하는지 확인할 수 있습니다.",
"guid": "c1d46066-94b8-4482-800d-1c9f7f5704ad",
"service": "Azure Machine Learning",
"text": "모델 성능 모니터링: 배포된 모델의 성능을 모니터링합니다.",
@@ -259,7 +259,7 @@
"waf": "공연"
},
{
- "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 메트릭에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는지 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 이 정보를 사용하여 규모 확대 또는 축소를 결정하거나, 다양한 성능의 SKU로 규모 축소를 결정하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
+ "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 지표에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는 경우 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 해당 정보를 사용하여 규모 감축 또는 축소를 결정하거나, 다양한 성능의 SKU로 확장 또는 축소하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
"guid": "60fc9cf9-8eec-422c-9894-70a364e63ece",
"service": "Azure Machine Learning",
"text": "인프라 모니터링: 온라인 엔드포인트를 모니터링하고 Monitor와 통합하여 적절한 메트릭 및 로그를 추적하고 모니터링합니다. 온라인 배포를 만들 때 Application Insights를 사용하도록 설정합니다. 학습 인프라를 모니터링하고 모델을 학습할 때 메모리 및 CPU 또는 GPU 사용량과 같은 리소스 사용량을 검토하여 기준 요구 사항을 충족하고 있는지 확인합니다.",
@@ -270,7 +270,7 @@
"metadata": {
"name": "Azure Machine Learning Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -297,31 +297,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.pt.json b/checklists-ext/azuremachinelearning_sg_checklist.pt.json
index 80e6deeda..0064649b0 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.pt.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.pt.json
@@ -270,7 +270,7 @@
"metadata": {
"name": "Azure Machine Learning Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -297,31 +297,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azuremachinelearning_sg_checklist.zh-Hant.json b/checklists-ext/azuremachinelearning_sg_checklist.zh-Hant.json
index 4b5debf58..e9a2e6ca6 100644
--- a/checklists-ext/azuremachinelearning_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azuremachinelearning_sg_checklist.zh-Hant.json
@@ -270,7 +270,7 @@
"metadata": {
"name": "Azure Machine Learning Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -297,31 +297,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/azureopenai_sg_checklist.en.json b/checklists-ext/azureopenai_sg_checklist.en.json
index e2b1032dc..8a55f62d3 100644
--- a/checklists-ext/azureopenai_sg_checklist.en.json
+++ b/checklists-ext/azureopenai_sg_checklist.en.json
@@ -173,6 +173,6 @@
"name": "Azure Openai Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/azureopenai_sg_checklist.es.json b/checklists-ext/azureopenai_sg_checklist.es.json
index f28529928..4305adc56 100644
--- a/checklists-ext/azureopenai_sg_checklist.es.json
+++ b/checklists-ext/azureopenai_sg_checklist.es.json
@@ -6,15 +6,15 @@
"description": "Esta importante información de rendimiento proporciona la información necesaria para asegurarse de que asigna suficiente TPM de la cuota para satisfacer la demanda de las implementaciones. La asignación de una cuota suficiente evita la limitación de las llamadas a los modelos implementados.",
"guid": "58d920a1-7482-4367-aa69-c5326bcfd33d",
"service": "Azure Openai",
- "text": "Supervise los límites de frecuencia para el pago por uso: si usa el enfoque de pago por uso, administre los límites de velocidad para las implementaciones del modelo y supervise el uso de tokens por minuto (TPM) y solicitudes por minuto (RPM).",
+ "text": "Supervisión de los límites de frecuencia para el pago por uso: si usa el enfoque de pago por uso, administre los límites de velocidad para las implementaciones del modelo y supervise el uso de tokens por minuto (TPM) y solicitudes por minuto (RPM).",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Es importante supervisar el uso administrado por el aprovisionamiento para asegurarse de que no supera el 100 % para evitar la limitación de las llamadas a los modelos implementados.",
+ "description": "Es importante supervisar el uso administrado por el aprovisionamiento para asegurarse de que no supere el 100 % para evitar la limitación de las llamadas a los modelos implementados.",
"guid": "ff8fe762-af8f-464b-aed5-95fed612d087",
"service": "Azure Openai",
- "text": "Supervisión del uso administrado por aprovisionamiento para el rendimiento aprovisionado: si usa el modelo de pago por rendimiento aprovisionado, supervise el uso administrado por aprovisionamiento.",
+ "text": "Supervisión de la utilización administrada por el aprovisionamiento para el rendimiento aprovisionado: si usa el modelo de pago por el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -35,7 +35,7 @@
"waf": "Seguridad"
},
{
- "description": "Controlar el acceso a Azure OpenAI ayuda a evitar ataques de usuarios no autorizados. El uso de puntos de conexión privados garantiza que el tráfico de red permanezca privado entre la aplicación y la plataforma.",
+ "description": "El control del acceso a Azure OpenAI ayuda a evitar ataques de usuarios no autorizados. El uso de puntos de conexión privados garantiza que el tráfico de red permanezca privado entre la aplicación y la plataforma.",
"guid": "1a5c78fc-0890-4caf-af0f-ce85ad0fc659",
"service": "Azure Openai",
"text": "Restringir el acceso: deshabilite el acceso público a Azure OpenAI a menos que la carga de trabajo lo requiera. Cree puntos de conexión privados si se conecta desde consumidores en una red virtual de Azure.",
@@ -46,7 +46,7 @@
"description": "El uso de Microsoft Entra ID centraliza el componente de administración de identidades y elimina el uso de claves de API. El uso de RBAC con Microsoft Entra ID garantiza que los usuarios o grupos tengan exactamente los permisos que necesitan para realizar su trabajo. Este tipo de control de acceso detallado no es posible con las claves de API de Azure OpenAI.",
"guid": "703ee553-e905-4797-8999-a5d724c1f860",
"service": "Azure Openai",
- "text": "Id. de Microsoft Entra: use el id. de Microsoft Entra para la autenticación y para autorizar el acceso a Azure OpenAI mediante el control de acceso basado en roles (RBAC). Deshabilite la autenticación local en Azure AI Services y establezca 'disableLocalAuth' en 'true'. Otorgue a las identidades que realicen finalizaciones o generación de imágenes el rol de usuario de OpenAI de Cognitive Services. Otorgue a las canalizaciones de automatización de modelos y al acceso ad-hoc a la ciencia de datos un rol como el de Colaborador de OpenAI de Cognitive Services.",
+ "text": "Id. de Microsoft Entra: use el id. de Microsoft Entra para la autenticación y para autorizar el acceso a Azure OpenAI mediante el control de acceso basado en roles (RBAC). Deshabilite la autenticación local en Azure AI Services y establezca 'disableLocalAuth' en 'true'. Conceda a las identidades que realicen finalizaciones o generación de imágenes el rol de usuario de OpenAI de Cognitive Services. Otorgue a las canalizaciones de automatización de modelos y al acceso ad-hoc a la ciencia de datos un rol como el de Colaborador de OpenAI de Cognitive Services.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -54,7 +54,7 @@
"description": "El uso de claves administradas por el cliente le proporciona una mayor flexibilidad para crear, rotar, deshabilitar y revocar controles de acceso.",
"guid": "6d20b136-61df-4267-9578-d6045f452937",
"service": "Azure Openai",
- "text": "Use claves administradas por el cliente: use claves administradas por el cliente para los modelos optimizados y los datos de entrenamiento que se cargan en Azure OpenAI.",
+ "text": "Use claves administradas por el cliente: use claves administradas por el cliente para modelos ajustados y datos de entrenamiento que se cargan en Azure OpenAI.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -70,7 +70,7 @@
"description": "El uso de las funciones de la API para restringir el uso alinea el consumo de servicios con las necesidades del cliente. Esto ahorra dinero al garantizar que el modelo no genere una respuesta demasiado larga que consuma más tokens de los necesarios.",
"guid": "24b4af01-d5e7-4812-8d67-3cc69082a03e",
"service": "Azure Openai",
- "text": "Diseño del código de cliente para establecer límites: los clientes personalizados deben usar las características de límite de la API de finalizaciones de Azure OpenAI, como el límite máximo en el número de tokens por modelo ('max_tokens') o el número de finalizaciones hasta la generación ('n'). Establecer límites garantiza que el servidor no produzca más de lo que el cliente necesita.",
+ "text": "Diseño del código de cliente para establecer límites: los clientes personalizados deben usar las características de límite de la API de finalizaciones de Azure OpenAI, como el límite máximo en el número de tokens por modelo ('max_tokens') o el número de finalizaciones para la generación ('n'). Establecer límites garantiza que el servidor no produzca más de lo que el cliente necesita.",
"type": "recommendation",
"waf": "Costar"
},
@@ -83,10 +83,10 @@
"waf": "Costar"
},
{
- "description": "La supervisión continua del uso administrado por el aprovisionamiento le proporciona la información que necesita para comprender si está infrautilizando el rendimiento aprovisionado.",
+ "description": "La supervisión continua de la utilización administrada por el aprovisionamiento le proporciona la información que necesita para comprender si está infrautilizando el rendimiento aprovisionado.",
"guid": "e3a2b9f2-71b7-4fc4-8653-d34e51f97600",
"service": "Azure Openai",
- "text": "Supervise el uso del rendimiento aprovisionado: si usa el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento para asegurarse de que no está infrautilizando el rendimiento aprovisionado que adquirió.",
+ "text": "Supervise el uso del rendimiento aprovisionado: si usa el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento para asegurarse de que no está infrautilizando el rendimiento aprovisionado que compró.",
"type": "recommendation",
"waf": "Costar"
},
@@ -94,7 +94,7 @@
"description": "La supervisión de costos, el establecimiento de presupuestos y la configuración de alertas proporcionan a la gobernanza los procesos de responsabilidad adecuados.",
"guid": "bc568726-91cc-4397-8121-a6c7cc0ea3d2",
"service": "Azure Openai",
- "text": "Gestión de costes: Utilice las funciones de gestión de costes con OpenAI para supervisar los costes, establecer presupuestos para gestionarlos y crear alertas para notificar a las partes interesadas sobre riesgos o anomalías.",
+ "text": "Gestión de costes: Utilice las funciones de gestión de costes con OpenAI para supervisar los costes, establecer presupuestos para gestionar los costes y crear alertas para notificar a las partes interesadas los riesgos o anomalías.",
"type": "recommendation",
"waf": "Costar"
},
@@ -110,7 +110,7 @@
"metadata": {
"name": "Azure Openai Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -137,31 +137,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/azureopenai_sg_checklist.ja.json b/checklists-ext/azureopenai_sg_checklist.ja.json
index 154aa74cc..bd6e190d4 100644
--- a/checklists-ext/azureopenai_sg_checklist.ja.json
+++ b/checklists-ext/azureopenai_sg_checklist.ja.json
@@ -110,7 +110,7 @@
"metadata": {
"name": "Azure Openai Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -137,31 +137,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/azureopenai_sg_checklist.ko.json b/checklists-ext/azureopenai_sg_checklist.ko.json
index bbe996288..def5d3737 100644
--- a/checklists-ext/azureopenai_sg_checklist.ko.json
+++ b/checklists-ext/azureopenai_sg_checklist.ko.json
@@ -6,12 +6,12 @@
"description": "이 중요한 처리량 정보는 배포 수요를 충족하기 위해 할당량에서 충분한 TPM을 할당하는 데 필요한 정보를 제공합니다. 충분한 할당량을 할당하면 배포된 모델에 대한 호출 제한을 방지할 수 있습니다.",
"guid": "58d920a1-7482-4367-aa69-c5326bcfd33d",
"service": "Azure Openai",
- "text": "종량제에 대한 속도 제한 모니터링: 종량제 방식을 사용하는 경우 모델 배포에 대한 속도 제한을 관리하고 TPM(분당 토큰) 및 RPM(분당 요청 수)의 사용량을 모니터링합니다.",
+ "text": "종량제에 대한 속도 제한 모니터링: 종량제 접근 방식을 사용하는 경우 모델 배포에 대한 속도 제한을 관리하고 TPM(분당 토큰) 및 RPM(분당 요청 수)의 사용량을 모니터링합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "배포된 모델에 대한 호출 제한을 방지하기 위해 프로비저닝 관리 사용률을 모니터링하여 100%를 초과하지 않도록 하는 것이 중요합니다.",
+ "description": "프로비저닝 관리 사용률을 모니터링하여 100%를 초과하지 않도록 하여 배포된 모델에 대한 호출 제한을 방지하는 것이 중요합니다.",
"guid": "ff8fe762-af8f-464b-aed5-95fed612d087",
"service": "Azure Openai",
"text": "프로비저닝된 처리량에 대한 프로비저닝 관리 사용률 모니터링: 프로비저닝된 처리량 결제 모델을 사용하는 경우 프로비저닝 관리 사용률을 모니터링합니다.",
@@ -22,12 +22,12 @@
"description": "콘텐츠 필터는 불투명한 위험 분석을 기반으로 프롬프트 또는 완료를 차단합니다. 워크로드에 대한 예상 사용량을 허용하도록 콘텐츠 필터가 조정되어 있는지 확인합니다.",
"guid": "2c498456-15f9-4893-b9c2-310b37bee2c3",
"service": "Azure Openai",
- "text": "콘텐츠 필터 조정: 콘텐츠 필터를 조정하여 지나치게 공격적인 필터로 인한 오탐을 최소화합니다.",
+ "text": "콘텐츠 필터 조정: 콘텐츠 필터를 조정하여 과도하게 공격적인 필터로 인한 오탐을 최소화합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "Key Vault에 저장하여 코드에서 비밀을 분리하면 비밀이 유출될 가능성이 줄어듭니다. 또한 분리는 비밀의 중앙 관리를 용이하게 하여 키 회전과 같은 책임을 완화합니다.",
+ "description": "비밀을 Key Vault에 저장하여 코드에서 분리하면 비밀이 유출될 가능성이 줄어듭니다. 또한 분리는 비밀의 중앙 관리를 용이하게 하여 키 회전과 같은 책임을 완화합니다.",
"guid": "77aaf205-389f-49ae-bd15-00b46c95b6c2",
"service": "Azure Openai",
"text": "보안 키: 아키텍처에 Azure OpenAI 키 기반 인증이 필요한 경우 해당 키를 애플리케이션 코드가 아닌 Azure Key Vault에 저장합니다.",
@@ -43,7 +43,7 @@
"waf": "안전"
},
{
- "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화되고 API 키를 사용할 필요가 없습니다. Microsoft Entra ID와 함께 RBAC를 사용하면 사용자 또는 그룹이 작업을 수행하는 데 필요한 권한을 정확히 가질 수 있습니다. 이러한 종류의 세분화된 액세스 제어는 Azure OpenAI API 키에서는 불가능합니다.",
+ "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화되고 API 키를 사용할 필요가 없습니다. Microsoft Entra ID와 함께 RBAC를 사용하면 사용자 또는 그룹이 작업을 수행하는 데 필요한 권한을 정확하게 가질 수 있습니다. 이러한 종류의 세분화된 액세스 제어는 Azure OpenAI API 키에서는 사용할 수 없습니다.",
"guid": "703ee553-e905-4797-8999-a5d724c1f860",
"service": "Azure Openai",
"text": "Microsoft Entra ID: RBAC(역할 기반 액세스 제어)를 사용하여 Azure OpenAI에 대한 액세스 권한을 부여하고 인증에 Microsoft Entra ID를 사용합니다. Azure AI Services에서 로컬 인증을 사용하지 않도록 설정하고 'disableLocalAuth'를 'true'로 설정합니다. 완성 또는 이미지 생성을 수행하는 ID에 Cognitive Services OpenAI 사용자 역할을 부여합니다. 모델 자동화 파이프라인 및 임시 데이터 과학 액세스 권한에 Cognitive Services OpenAI 기여자와 같은 역할을 부여합니다.",
@@ -70,7 +70,7 @@
"description": "API 기능을 사용하여 사용을 제한하면 서비스 사용량이 클라이언트 요구 사항에 맞게 조정됩니다. 이렇게 하면 모델이 필요한 것보다 더 많은 토큰을 사용하는 지나치게 긴 응답을 생성하지 않도록 하여 비용을 절약할 수 있습니다.",
"guid": "24b4af01-d5e7-4812-8d67-3cc69082a03e",
"service": "Azure Openai",
- "text": "제한을 설정하도록 클라이언트 코드 디자인: 사용자 지정 클라이언트는 모델당 토큰 수에 대한 최대 제한('max_tokens') 또는 생성까지의 완료 수('n')와 같은 Azure OpenAI 완성 API의 제한 기능을 사용해야 합니다. 제한을 설정하면 서버가 클라이언트에 필요한 것보다 더 많이 생성되지 않습니다.",
+ "text": "제한을 설정하도록 클라이언트 코드 설계: 사용자 지정 클라이언트는 모델당 토큰 수에 대한 최대 제한('max_tokens') 또는 생성 완료 수('n')와 같은 Azure OpenAI 완성 API의 제한 기능을 사용해야 합니다. 제한을 설정하면 서버가 클라이언트에 필요한 것보다 더 많이 생성되지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -99,7 +99,7 @@
"waf": "비용"
},
{
- "description": "진단은 메트릭과 로그를 수집하고 분석하여 Azure OpenAI의 가용성, 성능 및 작업을 모니터링하는 데 도움이 됩니다.",
+ "description": "진단은 메트릭 및 로그를 수집하고 분석하여 Azure OpenAI의 가용성, 성능 및 작업을 모니터링하는 데 도움이 됩니다.",
"guid": "b2b0ff3d-4e03-4d68-9389-7d29ebeb8710",
"service": "Azure Openai",
"text": "Azure 진단 사용 및 구성: Azure OpenAI 서비스에 대한 진단을 사용하도록 설정하고 구성합니다.",
@@ -110,7 +110,7 @@
"metadata": {
"name": "Azure Openai Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -137,31 +137,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/azureopenai_sg_checklist.pt.json b/checklists-ext/azureopenai_sg_checklist.pt.json
index d78d5dac9..556ef021c 100644
--- a/checklists-ext/azureopenai_sg_checklist.pt.json
+++ b/checklists-ext/azureopenai_sg_checklist.pt.json
@@ -110,7 +110,7 @@
"metadata": {
"name": "Azure Openai Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -137,31 +137,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/azureopenai_sg_checklist.zh-Hant.json b/checklists-ext/azureopenai_sg_checklist.zh-Hant.json
index b0f1d9396..713fac800 100644
--- a/checklists-ext/azureopenai_sg_checklist.zh-Hant.json
+++ b/checklists-ext/azureopenai_sg_checklist.zh-Hant.json
@@ -110,7 +110,7 @@
"metadata": {
"name": "Azure Openai Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -137,31 +137,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/fullwaf_checklist.en.json b/checklists-ext/fullwaf_checklist.en.json
index 62bebea18..3778bcacc 100644
--- a/checklists-ext/fullwaf_checklist.en.json
+++ b/checklists-ext/fullwaf_checklist.en.json
@@ -1,10289 +1,11057 @@
{
"items": [
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
- "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
- "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
+ "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
+ "service": "Container Apps",
"severity": "High",
- "text": "Disable Azure Container Registry image export",
+ "text": "Leverage Availability Zones if regionally applicable",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
- "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
+ "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
+ "service": "Container Apps",
"severity": "High",
- "text": "Enable Azure Policies for Azure Container Registry",
+ "text": "Use more than one replica and enable Zone Redundancy.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
- "guid": "d345293c-7639-4637-a551-c5c04e401955",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"severity": "High",
- "text": "Sign and Verify containers with notation (Notary v2)",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
- "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
- "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
- "service": "ACR",
- "severity": "Medium",
- "text": "Encrypt registry with a customer managed key",
+ "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
- "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"severity": "High",
- "text": "Use Managed Identities to connect instead of Service Principals",
+ "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
- "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
- "severity": "High",
- "text": "Disable local authentication for management plane access",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
+ "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Leverage FTA Resillency Handbook",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
- "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "High",
- "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
+ "text": "Plan for Data Center level outage",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable anonymous pull/push access",
- "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
- "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
+ "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Anonymous pull access",
+ "text": "Practice Failover for BCDR",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
- "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "High",
- "text": "Disable repository-scoped access tokens",
+ "text": "Plan a backup strategy and take regular backups",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
- "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
- "service": "ACR",
- "severity": "High",
- "text": "Deploy images from a trusted environment",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
+ "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
- "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
+ "link": "https://learn.microsoft.com/purview/deployment-best-practices",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Azure ARM audience tokens for authentication",
+ "text": "Follow Purview accounts architectures and deployment best practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
- "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
- "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
+ "service": "Purview",
"severity": "Medium",
- "text": "Enable diagnostics logging",
+ "text": "Follow Collection Architectures and best practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
- "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
+ "service": "Purview",
"severity": "Medium",
- "text": "Control inbound network access with Private Link",
+ "text": "Follow Assest lifecycle best practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable public network access if inbound network access is secured using Private Link",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Public Network access",
+ "text": "Follow automation best practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only the ACR Premium SKU supports Private Link access",
- "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "Medium",
- "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
+ "text": "Follow Backup and Migration Best practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
- "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
- "service": "ACR",
- "severity": "Low",
- "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Follow Purview Glossary Best Practices",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
- "service": "ACR",
- "severity": "Medium",
- "text": "Deploy validated container images",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
+ "link": "https://learn.microsoft.com/purview/concept-workflow",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Workflows ",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
- "service": "ACR",
- "severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Follow Purview Security Best Practices",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
+ "service": "Purview",
"severity": "Medium",
- "text": "Use Standard SKU for production scenarios.",
+ "text": "Follow Purview Data Lineage Best Practices",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
+ "service": "Purview",
"severity": "Medium",
- "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
+ "text": "Follow Best Practices for Scanning Registered Sources",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
- "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
+ "service": "Purview",
"severity": "Medium",
- "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
+ "text": "Follow Classification Best Practices in Governance Portal",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
+ "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
+ "service": "Purview",
"severity": "Medium",
- "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
+ "text": "Perform Sensitivity Labelling in the Purview Data Map",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
+ "link": "https://learn.microsoft.com/purview/concept-data-share",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
- "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Data Estate Insights",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
+ "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Data stewardship and Catalog adoption",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Inventory and Ownership",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
+ "link": "https://learn.microsoft.com/purview/glossary-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
- "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
+ "link": "https://learn.microsoft.com/purview/compliance-manager",
+ "service": "Purview",
"severity": "Medium",
- "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
+ "text": "Generate assessment scores",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "001cbb6f-d88d-4431-8434-d01333397776",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
+ "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
+ "service": "Purview",
"severity": "Medium",
- "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "text": "Profiling- get summaries of data content",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
+ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow Microsoft Purview Data Owner access policies",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
- "link": "",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
+ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow Self-service access policies",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
- "link": "",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
+ "link": "https://learn.microsoft.com/purview/concept-policies-devops",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow DevOps policies",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
+ "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
+ "checklist": "Resiliency Review",
+ "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
+ "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
+ "service": "VMSS",
+ "severity": "Low",
+ "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
+ "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
+ "service": "VM",
+ "severity": "High",
+ "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Ensure you are using Application Gateway v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
+ "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "VM",
+ "severity": "High",
+ "text": "Use Premium or Ultra disks for production VMs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
- "severity": "Medium",
- "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
+ "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
+ "service": "VM",
+ "severity": "High",
+ "text": "Ensure Managed Disks are used for all VMs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
+ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
+ "service": "VM",
"severity": "Medium",
- "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "AppGW",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
+ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "VM",
"severity": "Medium",
- "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Leverage Availability Zones for your VMs in regions where they are supported",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "AppGW",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
+ "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "VM",
"severity": "Medium",
- "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
+ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "VM",
+ "severity": "High",
+ "text": "Avoid running a production workload on a single VM",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Configure autoscaling with a minimum amount of instances of two.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
+ "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "High",
+ "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Deploy Application Gateway across Availability Zones",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
+ "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
+ "service": "VM",
+ "severity": "Low",
+ "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
+ "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
+ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
+ "service": "VM",
"severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
- },
- {
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
- "severity": "High",
- "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Increase quotas in DR region before testing failover with ASR",
"waf": "Reliability"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
+ "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
+ "service": "VM",
"severity": "Low",
- "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "text": "Utilize Scheduled Events to prepare for VM maintenance",
"waf": "Reliability"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
+ "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Storage",
"severity": "Medium",
- "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
- },
- {
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
- "severity": "High",
- "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
+ "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
"waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "AppGW",
- "severity": "High",
- "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
+ "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Storage",
+ "severity": "Low",
+ "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
"waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "AppGW",
- "severity": "High",
- "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Storage",
+ "severity": "Low",
+ "text": "Enable soft delete for Storage Account Containers",
"waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "AppGW",
- "severity": "High",
- "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Storage",
+ "severity": "Low",
+ "text": "Enable soft delete for blobs",
"waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "AppGW",
- "severity": "High",
- "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
+ "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "service": "Backup",
+ "severity": "Medium",
+ "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
+ "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
+ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
+ "service": "Backup",
+ "severity": "Low",
+ "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
+ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
+ "service": "Backup",
+ "severity": "Low",
+ "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "AppGW",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Resiliency Review",
+ "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
+ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
+ "service": "DNS",
"severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "text": "Implement DNS Failover using Azure DNS Private Resolvers",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "AppGW",
+ "arm-service": "Microsoft.PowerBI/gateways",
+ "checklist": "Resiliency Review",
+ "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
+ "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
+ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
+ "service": "Data Gateways",
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
+ "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "severity": "High",
+ "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Storage",
"severity": "Medium",
- "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
- "waf": "Operations"
+ "text": "Consider the 'Azure security baseline for storage'",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Consider using private endpoints for Azure Storage",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Storage",
"severity": "Medium",
- "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use WAF Policies instead of the legacy WAF configuration.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Storage",
"severity": "Medium",
- "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "text": "Enable 'soft delete' for blobs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "AppGW",
- "severity": "High",
- "text": "You should encrypt traffic to the backend servers.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Disable 'soft delete' for blobs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Storage",
"severity": "High",
- "text": "You should use a Web Application Firewall.",
+ "text": "Enable 'soft delete' for containers",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Storage",
"severity": "Medium",
- "text": "Redirect HTTP to HTTPS",
+ "text": "Disable 'soft delete' for containers",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable resource locks on storage accounts",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Storage",
"severity": "High",
- "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
+ "text": "Consider immutable blobs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "AppGW",
- "severity": "Low",
- "text": "Create custom error pages to display a personalized user experience",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Storage",
+ "severity": "High",
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Storage",
"severity": "Medium",
- "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
- "waf": "Performance"
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Use transport layer load balancing",
- "waf": "Performance"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "AppGW",
- "severity": "Medium",
- "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Use Microsoft Entra ID tokens for blob access",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "AppGW",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Storage",
"severity": "Medium",
- "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "text": "Least privilege in IaM permissions",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "AppGW",
- "severity": "Low",
- "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Storage",
+ "severity": "High",
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
- "service": "PostgreSQL",
- "severity": "Medium",
- "text": "Leverage Flexible Server",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
- "service": "PostgreSQL",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Storage",
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "31b67c67-be59-4519-8083-845d587cb391",
- "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
- "service": "PostgreSQL",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Storage",
"severity": "Medium",
- "text": "Leverage cross-region read replicas for BCDR",
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Storage",
"severity": "Medium",
- "text": "Leverage FTA HandBook for Cognitive Services",
+ "text": "Consider configuring an SAS expiration policy",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Storage",
"severity": "Medium",
- "text": "Backup Your Prompts",
+ "text": "Consider linking SAS to a stored access policy",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Storage",
"severity": "High",
- "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
- "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Strive for short validity periods for ad-hoc SAS",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Storage",
"severity": "Medium",
- "text": "Backup Your ChatGPT conversations",
+ "text": "Apply a narrow scope to a SAS",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
- "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Storage",
"severity": "Medium",
- "text": "CI/CD for custom speech",
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "3687a046-7a1f-4893-9bda-43324f248116",
- "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
- "service": "Cognitive Services",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Storage",
"severity": "Low",
- "text": "Move a knowledge base using export-import",
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Storage",
"severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Storage",
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "text": "Avoid overly broad CORS policies",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Storage",
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Storage",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "text": "Determine which/if platform encryption should be used.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Functions",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Determine which/if client-side encryption should be used.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Storage",
"severity": "High",
- "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
- "service": "Functions",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Storage",
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "text": "Leverage a storagev2 account type for better performance and reliability",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Functions",
- "severity": "Medium",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Functions",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "For write operation after failover, use customer-Managed Failover ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
- "service": "Functions",
- "severity": "High",
- "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Understand Microsoft-Managed Failover details",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Functions",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Storage",
"severity": "Medium",
- "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
+ "text": "Enable Soft Delete",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Functions",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
- "service": "CosmosDB",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"severity": "Medium",
- "text": "FTA Resiliency Playbook",
- "waf": "Reliability"
+ "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
- "severity": "High",
- "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
- "service": "CosmosDB",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"severity": "Medium",
- "text": "Run multiple replicas of the database (>1 ) in Prod",
+ "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
- "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Leverage Multi-Region Writes",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
+ "severity": "High",
+ "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Span Cosmos account across two or more regions with multi-region writes",
- "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "Medium",
- "text": "Distribute your data globally",
+ "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
- "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
- "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
- "service": "CosmosDB",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"severity": "High",
- "text": "Choose from several well-defined consistency models",
+ "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
- "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
- "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Enable Service managed failover",
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
- "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
- "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
- "service": "CosmosDB",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"severity": "Medium",
- "text": "Enable Automatic Backups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
- "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
- "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Perform Periodic Backups",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
- "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
- "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
+ "severity": "High",
+ "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
+ "severity": "High",
+ "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
+ "severity": "High",
+ "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "severity": "High",
+ "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Leverage FTA Resillency HandBook",
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Make sure the Floating IP is enabled on the Load balancer",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
+ "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Use the Premium or Dedicated SKUs for predicable performance",
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "High",
+ "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"severity": "High",
- "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
+ "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "Medium",
- "text": "For Business Critical Applications, use Active Active configuration",
+ "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Design Resilient Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "Low",
- "text": "If required for AKS Windows workloads HostProcess containers can be used",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "High",
+ "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
- "severity": "Low",
- "text": "Use KEDA if running event-driven workloads",
- "waf": "Performance"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Dapr to ease microservice development",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "High",
- "text": "Use the SLA-backed AKS offering",
+ "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Disruption Budgets in your pod and deployment definitions",
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
- "severity": "High",
- "text": "If using a private registry, configure region replication to store images in multiple regions",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "Low",
- "text": "Use an external application such as kubecost to allocate costs to different users",
- "waf": "Cost"
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
- "severity": "Low",
- "text": "Use scale down mode to delete/deallocate nodes",
- "waf": "Cost"
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
+ "severity": "High",
+ "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"severity": "Medium",
- "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "text": "Automate SAP System Start-Stop to manage costs.",
"waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "Low",
- "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
"waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"severity": "Medium",
- "text": "Separate applications from the control plane with user/system node pools",
+ "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "Low",
- "text": "Add taint to your system nodepool to make it dedicated",
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use a private registry for your images, such as ACR",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"severity": "Medium",
- "text": "Scan your images for vulnerabilities",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
- "severity": "High",
- "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
"severity": "Medium",
- "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
- "severity": "High",
- "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"severity": "Medium",
- "text": "If required add Key Management Service etcd encryption",
+ "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
- "severity": "Low",
- "text": "If required consider using Confidential Compute for AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP HANA",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
"severity": "Medium",
- "text": "Consider using Defender for Containers",
+ "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
- "severity": "High",
- "text": "Use managed identities instead of Service Principals",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
"severity": "Medium",
- "text": "Integrate authentication with AAD (using the managed integration)",
+ "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
"severity": "Medium",
- "text": "Limit access to admin kubeconfig (get-credentials --admin)",
+ "text": "Implement SSO to SAP BTP",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
"severity": "Medium",
- "text": "Integrate authorization with AAD RBAC",
+ "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
- "severity": "High",
- "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "description": "Keep your management group hierarchy reasonably flat, no more than four.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"severity": "Medium",
- "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
- "waf": "Reliability"
+ "text": "enforce existing Management Group policies to SAP Subscriptions",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
- "severity": "Medium",
- "text": "For AKS non-interactive logins use kubelogin (preview)",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
- "severity": "Medium",
- "text": "Disable AKS local accounts",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Configure if required Just-in-time cluster access",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"severity": "Low",
- "text": "Configure if required AAD conditional access for AKS",
- "waf": "Reliability"
+ "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
- "severity": "Low",
- "text": "If required for Windows AKS workloads configure gMSA ",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
+ "severity": "High",
+ "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
- "severity": "Medium",
- "text": "For finer control consider using a managed Kubelet Identity",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using AGIC, do not share an AppGW across clusters",
- "waf": "Reliability"
+ "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "High",
- "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
+ "text": "Help protect your HANA database by using the Azure Backup service.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"severity": "Medium",
- "text": "For Windows workloads use Accelerated Networking",
- "waf": "Performance"
+ "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "High",
- "text": "Use the standard ALB (as opposed to the basic one)",
- "waf": "Reliability"
+ "text": "Ensure time-zone matches between the operating system and the SAP system.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using Azure CNI, consider using different Subnets for NodePools",
+ "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "High",
- "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "High",
- "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "High",
- "text": "If using Azure CNI, check the maximum pods/node (default 30)",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
- "severity": "Low",
- "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"severity": "High",
- "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
- "waf": "Reliability"
+ "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "Low",
- "text": "If required add your own CNI plugin",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
- "severity": "Low",
- "text": "If required configure Public IP per node in AKS",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
- "waf": "Reliability"
+ "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "High",
+ "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
+ "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
- "severity": "High",
- "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using a public API endpoint, restrict the IP addresses that can access it",
- "waf": "Reliability"
+ "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
- "severity": "High",
- "text": "Use private clusters if your requirements mandate it",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "Medium",
- "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "High",
- "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "High",
- "text": "Use Kubernetes network policies to increase intra-cluster security",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "High",
- "text": "Use a WAF for web workloads (UIs or APIs)",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use DDoS Standard in the AKS Virtual Network",
- "waf": "Reliability"
+ "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
- "severity": "Low",
- "text": "If required add company HTTP Proxy",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Consider using a service mesh for advanced microservice communication management",
+ "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
- "severity": "High",
- "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "Low",
- "text": "Check regularly Azure Advisor for recommendations on your cluster",
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
- "severity": "Low",
- "text": "Enable AKS auto-certificate rotation",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "High",
- "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
- "waf": "Operations"
+ "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
- "severity": "High",
- "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
- "severity": "High",
- "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider using AKS command invoke on private clusters",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Public IP assignment to VM running SAP Workload is not recommended.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "Low",
- "text": "For planned events consider using Node Auto Drain",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Consider reserving IP address on DR side when configuring ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"severity": "High",
- "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "text": "Avoid using overlapping IP address ranges for production and DR sites.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "Low",
- "text": "Use custom Node RG (aka 'Infra RG') name",
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"severity": "Medium",
- "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
- "waf": "Operations"
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
- "severity": "Low",
- "text": "Taint Windows nodes",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "Low",
- "text": "Keep windows containers patch level in sync with host patch level",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
- "severity": "Low",
- "text": "If required use nodePool snapshots",
- "waf": "Cost"
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider spot node pools for non time-sensitive workloads",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider AKS virtual node for quick bursting",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"severity": "High",
- "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
- "waf": "Operations"
+ "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
- "severity": "High",
- "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"severity": "Medium",
- "text": "Monitor CPU and memory utilization of the nodes",
- "waf": "Operations"
+ "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
- "waf": "Operations"
+ "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "High",
+ "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "High",
+ "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
+ "severity": "High",
+ "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"severity": "Medium",
- "text": "Monitor OS disk queue depth in nodes",
- "waf": "Operations"
+ "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Review SAP HANA database backups for Azure VMs.",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Medium",
- "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "text": "Review Site Recovery built-in monitoring, where used for SAP.",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"severity": "Medium",
- "text": "Subscribe to resource health notifications for your AKS cluster",
+ "text": "Review Oracle Database in Azure Linux VM backup strategies.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "High",
- "text": "Configure requests and limits in your pod specs",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"severity": "Medium",
- "text": "Enforce resource quotas for namespaces",
+ "text": "Review the use of Automated Backup v2 for Azure VMs.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "text": "Enabling Write accelerator for M series when using premium disks(V1)",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
- "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
- "service": "AKS",
- "severity": "High",
- "text": "Configure Liveness and Readiness probes for all deployments",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Test availability zone latency.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use the Cluster Autoscaler",
+ "text": "Activate SAP EarlyWatch Alert for all SAP components.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
- "severity": "Low",
- "text": "Customize node configuration for AKS node pools",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use the Horizontal Pod Autoscaler when required",
+ "text": "Review SQL Server performance monitoring using CCMS.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
- "severity": "High",
- "text": "Consider an appropriate node size, not too large or too small",
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "Low",
- "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Review SAP HANA studio alerts.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "Low",
- "text": "For long running operation on an AKS cluster consider event termination",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
- "severity": "Low",
- "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "High",
- "text": "Use ephemeral OS disks",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"severity": "High",
- "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
- "waf": "Performance"
+ "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "Low",
- "text": "For hyper performance storage option use Ultra Disks on AKS",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
"severity": "Medium",
- "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
- "waf": "Performance"
+ "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
- "severity": "Medium",
- "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
- "waf": "Performance"
+ "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
- "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Leverage FTA Resillency Handbook",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
"severity": "High",
- "text": "Plan for Data Center level outage",
+ "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
- "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
- "severity": "Medium",
- "text": "Practice Failover for BCDR",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "High",
+ "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"severity": "High",
- "text": "Plan a backup strategy and take regular backups",
+ "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
- "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "Low",
- "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
+ "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
- "link": "https://learn.microsoft.com/purview/deployment-best-practices",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "Medium",
- "text": "Follow Purview accounts architectures and deployment best practices",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Collection Architectures and best practices",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Assest lifecycle best practices",
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
+ "severity": "High",
+ "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow automation best practices",
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Backup and Migration Best practices",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Purview Glossary Best Practices",
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
- "link": "https://learn.microsoft.com/purview/concept-workflow",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
"severity": "Low",
- "text": "Leverage Workflows ",
+ "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Purview Security Best Practices",
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Purview Data Lineage Best Practices",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
- "service": "Purview",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Medium",
- "text": "Follow Best Practices for Scanning Registered Sources",
+ "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Classification Best Practices in Governance Portal",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Service",
+ "severity": "Low",
+ "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
- "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
- "service": "Purview",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
+ "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Service",
"severity": "Medium",
- "text": "Perform Sensitivity Labelling in the Purview Data Map",
+ "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
- "link": "https://learn.microsoft.com/purview/concept-data-share",
- "service": "Purview",
- "severity": "Low",
- "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Leverage Data Estate Insights",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
- "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Use Data stewardship and Catalog adoption",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Use Inventory and Ownership",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
- "link": "https://learn.microsoft.com/purview/glossary-insights",
- "service": "Purview",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Service",
"severity": "Low",
- "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
+ "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
- "link": "https://learn.microsoft.com/purview/compliance-manager",
- "service": "Purview",
- "severity": "Medium",
- "text": "Generate assessment scores",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
- "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
- "service": "Purview",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Service",
"severity": "Medium",
- "text": "Profiling- get summaries of data content",
+ "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
- "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
- "service": "Purview",
- "severity": "Low",
- "text": "Follow Microsoft Purview Data Owner access policies",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
- "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
- "service": "Purview",
- "severity": "Low",
- "text": "Follow Self-service access policies",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
- "link": "https://learn.microsoft.com/purview/concept-policies-devops",
- "service": "Purview",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Service",
"severity": "Low",
- "text": "Follow DevOps policies",
+ "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
- "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
- "service": "Container Apps",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Service",
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
+ "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
- "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
- "service": "Container Apps",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Service",
"severity": "High",
- "text": "Use more than one replica and enable Zone Redundancy.",
+ "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Service",
"severity": "High",
- "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
+ "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
- "severity": "High",
- "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Service",
"severity": "Medium",
- "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "text": "Do not store sensitive data on local disk",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Service",
"severity": "Medium",
- "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
- "severity": "Medium",
- "text": "Custom brand assets should be hosted on a CDN",
- "waf": "Performance"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Deploy code to App Service from a trusted and secure environment.",
+ "waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "Low",
- "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "Medium",
- "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "Medium",
- "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Pull container images from Azure Container Registry using a Managed Identity.",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Service",
"severity": "Medium",
- "text": "Have active-active for multi-regions",
+ "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Service",
"severity": "Medium",
- "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "text": "Send App Service activity logs to Log Analytics",
"waf": "Reliability"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Service",
"severity": "Medium",
- "text": "Use Replica Sets for DR",
+ "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Service",
+ "severity": "Low",
+ "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
- "severity": "Medium",
- "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Service",
"severity": "High",
- "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "text": "Use a Web Application Firewall (WAF) in front of App Service.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
- "severity": "Medium",
- "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Service",
+ "severity": "High",
+ "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
- "severity": "Medium",
- "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
- "severity": "Medium",
- "text": "Has an RBAC model been created for use within VMware vSphere",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Service",
"severity": "Medium",
- "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
+ "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Service",
"severity": "High",
- "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
+ "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Service",
"severity": "High",
- "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
+ "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
- "severity": "High",
- "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Service",
"severity": "High",
- "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
- "waf": "Operations"
+ "text": "Turn off remote debugging in production environments.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Service",
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
- "waf": "Operations"
+ "text": "Enable Defender for Cloud - Defender for App Service",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Service",
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
- "severity": "High",
- "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
- "waf": "Operations"
+ "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
- "severity": "High",
- "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Pull container images over a Virtual Network from Azure Container Registry.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
- "severity": "High",
- "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Conduct a penetration test on the web application.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Service",
"severity": "Medium",
- "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
+ "text": "Deploy validated and vulnerability-scanned code.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Service",
"severity": "High",
- "text": "Limit use of CloudAdmin account to emergency access only",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
+ "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
+ "service": "App Service",
"severity": "Medium",
- "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
+ "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
+ "service": "App Service",
"severity": "Medium",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
+ "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
+ "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "App Service",
"severity": "High",
- "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
- "waf": "Reliability"
+ "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
+ "waf": "Governance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
- "severity": "Medium",
- "text": "Is East-West traffic filtering implemented within NSX-T",
- "waf": "Reliability"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
+ "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/",
+ "service": "App Service",
+ "severity": "Low",
+ "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
- "severity": "High",
- "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
- "waf": "Reliability"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
+ "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
+ "service": "App Service",
+ "severity": "Medium",
+ "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"severity": "High",
- "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
- "severity": "Medium",
- "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
- "severity": "Medium",
- "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
- "severity": "Medium",
- "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "Medium",
- "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT Hub",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT Hub",
"severity": "Medium",
- "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
- "severity": "Low",
- "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT Hub",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
- "severity": "Low",
- "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT Hub",
+ "severity": "High",
+ "text": "Learn how to trigger a manual failover.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
- "severity": "Medium",
- "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT Hub",
+ "severity": "High",
+ "text": "Learn how to fail back after a failover.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "High",
- "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
+ "text": "Enable 2 replicas to have 99.9% availability for read operations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "Medium",
+ "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
"severity": "High",
- "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "text": "Leverage Availability Zones by enabling read and/or write replicas",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "waf": "Operations"
+ "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
- "waf": "Operations"
+ "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
- "waf": "Cost"
+ "text": "Use Azure Traffic Manager to coordinate requests",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
- "severity": "Low",
- "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
- "waf": "Cost"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
+ "severity": "High",
+ "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"severity": "Medium",
- "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "text": "Follow reliability support recommendations in Azure Bot Service",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure all required resource reside within the same Azure availability zone(s)",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
"severity": "Medium",
- "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "text": "Deploying bots with local data residency and regional compliance",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
"severity": "Medium",
- "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
- "severity": "High",
- "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "waf": "Operations"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Backup",
"severity": "Medium",
- "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
- "waf": "Operations"
+ "text": "check backup instances with the underlying datasource not found",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
"severity": "Medium",
- "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "waf": "Operations"
+ "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Backup",
"severity": "Medium",
- "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
- "waf": "Reliability"
+ "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Monitor",
"severity": "Medium",
- "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
- "severity": "High",
- "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
- "waf": "Reliability"
+ "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
- "severity": "High",
- "text": "Are data processing implications (service provider / service consumer model) clear and documented",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
"severity": "Medium",
- "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
- "waf": "Reliability"
+ "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
- "severity": "High",
- "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
- "severity": "High",
- "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Make sure advisor is configured for VM right sizing ",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "check by searching the Meter Category Licenses in the Cost analysys",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "severity": "Medium",
+ "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
"severity": "Medium",
- "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
- "waf": "Operations"
+ "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
- "severity": "Low",
- "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Only larger disks can be reserved => 1 TiB -",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
"severity": "Medium",
- "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
- "waf": "Operations"
+ "text": "After the right-sizing optimization",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
"severity": "Medium",
- "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "waf": "Operations"
+ "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
- "waf": "Operations"
+ "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "waf": "Operations"
+ "text": "Consider using a VMSS to match demand rather than flat sizing",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
"severity": "Medium",
- "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
- "waf": "Operations"
+ "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Backup",
"severity": "Medium",
- "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "waf": "Operations"
+ "text": "Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
- "waf": "Reliability"
+ "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Functions",
"severity": "Medium",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
- "waf": "Reliability"
+ "text": "Functions - Reuse connections",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Functions",
"severity": "Medium",
- "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
- "waf": "Reliability"
+ "text": "Functions - Cache data locally",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Functions",
"severity": "Medium",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
- "waf": "Reliability"
+ "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
- "severity": "High",
- "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Functions",
+ "severity": "Medium",
+ "text": "Functions - Keep your functions warm",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Functions",
"severity": "Medium",
- "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
- "waf": "Reliability"
+ "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
- "severity": "High",
- "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Functions",
+ "severity": "Medium",
+ "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Functions",
"severity": "Medium",
- "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
- "waf": "Reliability"
+ "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
- "waf": "Reliability"
+ "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
- "waf": "Reliability"
+ "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
"severity": "Medium",
- "text": "Deploy your backup solution outside of vSan, on Azure native components",
- "waf": "Reliability"
+ "text": "Consider archiving tiers for less used data",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "Low",
- "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
- "severity": "Low",
- "text": "For manual deployments, all configuration and deployments must be documented",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Consider using standard SSD rather than Premium or Ultra where possible",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
- "severity": "Low",
- "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
- "severity": "Low",
- "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
- "waf": "Operations"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "severity": "Medium",
+ "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
- "severity": "Low",
- "text": "For automated deployments, request or reserve quota prior to starting the deployment",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Storage accounts: check hot tier and/or GRS necessary",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
- "severity": "Low",
- "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
- "severity": "Low",
- "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "waf": "Operations"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
- "severity": "Low",
- "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "waf": "Operations"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Export cost data to a storage account for additional data analysis.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
- "severity": "Low",
- "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
- "severity": "Low",
- "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
- "waf": "Operations"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
"severity": "Medium",
- "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "waf": "Performance"
+ "text": "Create multiple Apache Spark pool definitions of various sizes.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
"severity": "Medium",
- "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "waf": "Performance"
+ "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
"severity": "Medium",
- "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "waf": "Performance"
+ "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
"severity": "Medium",
- "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
- "waf": "Performance"
+ "text": "Right-sizing all VMs",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
"severity": "Medium",
- "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "waf": "Performance"
+ "text": "Swap VM sized with normalized and most recent sizes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"severity": "Medium",
- "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "waf": "Operations"
+ "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
- "severity": "High",
- "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
"severity": "High",
- "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
- "severity": "Medium",
- "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"severity": "Medium",
- "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
- "waf": "Performance"
+ "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"severity": "Medium",
- "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
+ "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "Medium",
- "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
+ "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
+ "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
- "severity": "High",
- "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"severity": "High",
- "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
+ "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
+ "text": "Avoid placing Traffic Manager behind Front Door.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
+ "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "service": "Front Door",
"severity": "High",
- "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
- "waf": "Reliability"
+ "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"severity": "High",
- "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
+ "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
- "severity": "Medium",
- "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=~'Enabled') and (mode=~'Prevention')), enabledState, mode",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
- "severity": "Medium",
- "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Data Factory",
- "severity": "Medium",
- "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Data Factory",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
"severity": "High",
- "text": "Use zone redundant pipelines in regions that support Availability Zones",
+ "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Data Factory",
- "severity": "Medium",
- "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Data Factory",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
+ "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Data Factory",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
+ "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Data Factory",
- "severity": "Low",
- "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
"severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Reliability"
+ "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
- "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"severity": "Medium",
- "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
- "severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use caching for endpoints that support it.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use wildcard TLS certificates when possible.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Storage",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Consider the 'Azure security baseline for storage'",
- "waf": "Reliability"
+ "text": "Use file compression when you're accessing downloadable content.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Storage",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
"severity": "High",
- "text": "Consider using private endpoints for Azure Storage",
- "waf": "Reliability"
+ "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Storage",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
+ "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Storage",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
"severity": "High",
- "text": "Enable Microsoft Defender for all of your storage accounts",
+ "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Storage",
- "severity": "Medium",
- "text": "Enable 'soft delete' for blobs",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required for AKS Windows workloads HostProcess containers can be used",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Storage",
- "severity": "Medium",
- "text": "Disable 'soft delete' for blobs",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use KEDA if running event-driven workloads",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Dapr to ease microservice development",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"severity": "High",
- "text": "Enable 'soft delete' for containers",
+ "text": "Use the SLA-backed AKS offering",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Storage",
- "severity": "Medium",
- "text": "Disable 'soft delete' for containers",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Disruption Budgets in your pod and deployment definitions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Storage",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"severity": "High",
- "text": "Enable resource locks on storage accounts",
+ "text": "If using a private registry, configure region replication to store images in multiple regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Storage",
- "severity": "High",
- "text": "Consider immutable blobs",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use an external application such as kubecost to allocate costs to different users",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
- "severity": "High",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use scale down mode to delete/deallocate nodes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Storage",
- "severity": "High",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"severity": "Medium",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "text": "Separate applications from the control plane with user/system node pools",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Storage",
- "severity": "High",
- "text": "Enforce the latest TLS version for a storage account",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Add taint to your system nodepool to make it dedicated",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Storage",
- "severity": "High",
- "text": "Use Microsoft Entra ID tokens for blob access",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Use a private registry for your images, such as ACR",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Storage",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"severity": "Medium",
- "text": "Least privilege in IaM permissions",
+ "text": "Scan your images for vulnerabilities",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"severity": "High",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "text": "Define app separation requirements (namespace/nodepool/cluster)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Storage",
- "severity": "High",
- "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"severity": "High",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Storage",
- "severity": "Medium",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"severity": "Medium",
- "text": "Consider configuring an SAS expiration policy",
+ "text": "If required add Key Management Service etcd encryption",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Storage",
- "severity": "Medium",
- "text": "Consider linking SAS to a stored access policy",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required consider using Confidential Compute for AKS",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"severity": "Medium",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Storage",
- "severity": "High",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "text": "Consider using Defender for Containers",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"severity": "High",
- "text": "Strive for short validity periods for ad-hoc SAS",
+ "text": "Use managed identities instead of Service Principals",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"severity": "Medium",
- "text": "Apply a narrow scope to a SAS",
+ "text": "Integrate authentication with AAD (using the managed integration)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"severity": "Medium",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Storage",
- "severity": "Low",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Storage",
- "severity": "High",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
+ "text": "Limit access to admin kubeconfig (get-credentials --admin)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"severity": "Medium",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
+ "text": "Integrate authorization with AAD RBAC",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"severity": "High",
- "text": "Avoid overly broad CORS policies",
+ "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Storage",
- "severity": "High",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
"severity": "Medium",
- "text": "Determine which/if platform encryption should be used.",
+ "text": "For AKS non-interactive logins use kubelogin (preview)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"severity": "Medium",
- "text": "Determine which/if client-side encryption should be used.",
+ "text": "Disable AKS local accounts",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Storage",
- "severity": "High",
- "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Configure if required Just-in-time cluster access",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Storage",
- "severity": "High",
- "text": "Leverage a storagev2 account type for better performance and reliability",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Configure if required AAD conditional access for AKS",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Storage",
- "severity": "High",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required for Windows AKS workloads configure gMSA ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"severity": "Medium",
- "text": "For write operation after failover, use customer-Managed Failover ",
+ "text": "For finer control consider using a managed Kubelet Identity",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"severity": "Medium",
- "text": "Understand Microsoft-Managed Failover details",
+ "text": "If using AGIC, do not share an AppGW across clusters",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Storage",
- "severity": "Medium",
- "text": "Enable Soft Delete",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "Follow reliability support recommendations in Azure Bot Service",
- "waf": "Reliability"
+ "text": "For Windows workloads use Accelerated Networking",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "severity": "Medium",
- "text": "Deploying bots with local data residency and regional compliance",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use the standard ALB (as opposed to the basic one)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"severity": "Medium",
- "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "text": "If using Azure CNI, consider using different Subnets for NodePools",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
+ "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "High",
+ "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "Use more than 1 app instance for your apps",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "High",
+ "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "Set up autoscaling in Spring Cloud Gateway",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
"severity": "Low",
- "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "text": "If required add your own CNI plugin",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required configure Public IP per node in AKS",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Device Update for IoT Hub",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Device Update for IoT Hub",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "If using a public API endpoint, restrict the IP addresses that can access it",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "text": "Use private clusters if your requirements mandate it",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "Medium",
- "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
- "severity": "Medium",
- "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
- "waf": "Operations"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "Low",
- "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "Operations"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "High",
- "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
- "waf": "Operations"
+ "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "High",
- "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "Cost"
+ "text": "Use Kubernetes network policies to increase intra-cluster security",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "High",
- "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Use a WAF for web workloads (UIs or APIs)",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Use DDoS Standard in the AKS Virtual Network",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
- "severity": "Medium",
- "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required add company HTTP Proxy",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
- "severity": "High",
- "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Consider using a service mesh for advanced microservice communication management",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"severity": "High",
- "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "Reliability"
+ "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
- "severity": "Medium",
- "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Check regularly Azure Advisor for recommendations on your cluster",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "Medium",
- "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Enable AKS auto-certificate rotation",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "Medium",
- "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
- "severity": "Medium",
- "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
+ "waf": "Operations"
},
{
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"severity": "High",
- "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "Reliability"
+ "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
- "severity": "Medium",
- "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
- "severity": "Medium",
- "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider using AKS command invoke on private clusters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
- "severity": "Medium",
- "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "For planned events consider using Node Auto Drain",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"severity": "High",
- "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Cost"
+ "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
- "severity": "High",
- "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use custom Node RG (aka 'Infra RG') name",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"severity": "Medium",
- "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
- "waf": "Reliability"
+ "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
"severity": "Low",
- "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Reliability"
+ "text": "Taint Windows nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
"severity": "Low",
- "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
- "severity": "Medium",
- "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
- "waf": "Performance"
+ "text": "Keep windows containers patch level in sync with host patch level",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
- "severity": "Medium",
- "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Medium",
- "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required use nodePool snapshots",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Medium",
- "text": "Limit the number of routes per route table to 400.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider spot node pools for non time-sensitive workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
- "severity": "High",
- "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider AKS virtual node for quick bursting",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "High",
- "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
- "waf": "Reliability"
+ "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "High",
- "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
- "waf": "Reliability"
+ "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"severity": "Medium",
- "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Monitor CPU and memory utilization of the nodes",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "Medium",
- "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Reliability"
+ "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
- "severity": "High",
- "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Monitor OS disk queue depth in nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Reliability"
+ "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
- "severity": "High",
- "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Performance"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Subscribe to resource health notifications for your AKS cluster",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
- "severity": "High",
- "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "High",
- "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
- "severity": "Medium",
- "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Configure requests and limits in your pod specs",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "Medium",
- "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "Reliability"
+ "text": "Enforce resource quotas for namespaces",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
- "severity": "Low",
- "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Ensure your subscription has enough quota to scale out your nodepools",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
+ "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+ "service": "AKS",
"severity": "High",
- "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Configure Liveness and Readiness probes for all deployments",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medium",
- "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "text": "Use the Cluster Autoscaler",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
- "severity": "Medium",
- "text": "Use Azure Bastion to securely connect to your network.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Customize node configuration for AKS node pools",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Azure Bastion in a subnet /26 or larger.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Reliability"
+ "text": "Use the Horizontal Pod Autoscaler when required",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
- "severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Consider an appropriate node size, not too large or too small",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
"severity": "Low",
- "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "High",
- "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "High",
- "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "For long running operation on an AKS cluster consider event termination",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
- "severity": "High",
- "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"severity": "High",
- "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "text": "Use ephemeral OS disks",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
"severity": "High",
- "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
"waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"severity": "Medium",
- "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
"waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
- "severity": "High",
- "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
- "severity": "High",
- "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
"severity": "Medium",
- "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"severity": "Medium",
- "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
"waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Follow Metaprompting guardrails for resonsible AI",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
- "severity": "Medium",
- "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
- "severity": "Medium",
- "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Enable monitoring for your AOAI instances",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.insights/metricalerts' | extend compliant = (properties.targetResourceType =~ 'Microsoft.CognitiveServices/accounts') | project id, compliant",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "OpenAI",
"severity": "High",
- "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Monitor token usage to prevent service disruptions due to capacity",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "OpenAI",
+ "severity": "Low",
+ "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "OpenAI",
"severity": "High",
- "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
- "waf": "Reliability"
+ "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "OpenAI",
"severity": "High",
- "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Evaluate usage of Provisioned throughput model ",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Review and implement Azure AI content safety",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "OpenAI",
"severity": "High",
- "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
"waf": "Performance"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "OpenAI",
"severity": "Low",
- "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
- "waf": "Performance"
+ "text": "Deploy multiple OAI instances across regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "OpenAI",
"severity": "High",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Implement retry & healthchecks with Gateway pattern like APIM",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Ensure having adequate quotas of TPM & RPM for the workload",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
- "severity": "Low",
- "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Deploy separate fine tuned models across regions if finetuning is employed",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
- "severity": "High",
- "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.search/searchservices' | extend compliant = (sku.name != 'free' and properties.replicaCount >= 3) | project id, compliant",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "OpenAI",
"severity": "High",
- "text": "Use Azure Firewall Premium to enable additional security features.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "Azure AI search service tiers should be choosen to have a SLA ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
- "severity": "High",
- "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "OpenAI",
+ "severity": "Low",
+ "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "OpenAI",
"severity": "High",
- "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "OpenAI",
"severity": "High",
- "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
- "severity": "Important",
- "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/ai-onboarding",
+ "service": "OpenAI",
"severity": "High",
- "text": "Use a /26 prefix for your Azure Firewall subnets.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "Performance"
+ "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
- "waf": "Performance"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Implement Prompt shields and groundedness detection using Content Safety ",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "OpenAI",
"severity": "High",
- "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
- "severity": "Low",
- "text": "Use web categories to allow or deny outbound access to specific topics.",
- "waf": "Performance"
+ "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "Performance"
+ "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Enable Azure Firewall DNS proxy configuration.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "OpenAI",
"severity": "High",
- "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Operations"
+ "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "Low",
- "text": "Implement backups for your firewall rules",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.privateEndpointConnections != '[]' and properties.publicNetworkAccess !~ 'enabled')",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "OpenAI",
"severity": "High",
- "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "text": "Configure private endpoint for AI services to restrict service access within your network",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "OpenAI",
"severity": "High",
- "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
+ "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "AppGW",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "OpenAI",
"severity": "High",
- "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Use prompt compression tools like LLMLingua or gprtrim",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (isnotnull(identity))",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "OpenAI",
"severity": "High",
- "text": "Don't enable virtual network service endpoints by default on all subnets.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
- "severity": "High",
- "text": "Use at least a /27 prefix for your Gateway subnets.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
- "severity": "High",
- "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "severity": "Medium",
- "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (tags != '{}')",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "OpenAI",
+ "severity": "Low",
+ "text": "Azure AI Services are properly tagged for better management",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
- "severity": "Medium",
- "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "OpenAI",
+ "severity": "Low",
+ "text": "Azure AI Service accounts follows organizational naming conventions",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Diagnostic logs in Azure AI services resources should be enabled",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Performance"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.disableLocalAuth == true)",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
- "severity": "Medium",
- "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "OpenAI",
+ "severity": "High",
+ "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
- "severity": "High",
- "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "OpenAI",
"severity": "High",
- "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
- "waf": "Reliability"
+ "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
- "severity": "High",
- "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Plan and manage AI Search Vector storage",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "Low",
- "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "OpenAI",
"severity": "High",
- "text": "Use built-in policies where possible to minimize operational overhead.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "text": "Evaluate the quality of prompts and applications when switching between model versions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Reliability"
+ "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Reliability"
+ "text": "Evaluate your Azure AI Search results based on different search parameters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
- "waf": "Reliability"
+ "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
- "waf": "Reliability"
+ "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "text": "Red team your GenAI applications",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "text": "Provide end users with scoring options for LLM responses and track these scores. ",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
- "severity": "Medium",
- "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "OpenAI",
"severity": "High",
- "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Network Watcher to proactively monitor traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Operations"
+ "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure Monitor Logs for insights and reporting.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "Operations"
+ "text": "Tune content filters to minimize false positives from overly aggressive filters",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure Monitor alerts for the generation of operational alerts.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "Operations"
+ "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' and kind =~ 'contentsafety' | project id, compliant = 1",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "Operations"
+ "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
- "severity": "Low",
- "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
- "waf": "Reliability"
+ "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
+ "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Monitor VM security configuration drift via Azure Policy.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Reliability"
+ "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "Operations"
+ "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Operations"
+ "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
- "severity": "High",
- "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
+ "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
+ "service": "OpenAI",
"severity": "Medium",
- "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
- "severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5855",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
+ "service": "OpenAI",
+ "severity": "Medium",
+ "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
+ "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
+ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
+ "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable Azure Container Registry image export",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
+ "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Enable Azure Policies for Azure Container Registry",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
+ "guid": "d345293c-7639-4637-a551-c5c04e401955",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Sign and Verify containers with notation (Notary v2)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
+ "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
+ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
+ "service": "ACR",
"severity": "Medium",
- "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "Encrypt registry with a customer managed key",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Establish an automated process for key and certificate rotation.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
+ "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Use Managed Identities to connect instead of Service Principals",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable local authentication for management plane access",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable anonymous pull/push access",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
+ "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
+ "service": "ACR",
"severity": "Medium",
- "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "text": "Disable Anonymous pull access",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
+ "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable repository-scoped access tokens",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
+ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Deploy images from a trusted environment",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
+ "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
+ "service": "ACR",
"severity": "Medium",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "text": "Disable Azure ARM audience tokens for authentication",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
+ "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
+ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
+ "service": "ACR",
"severity": "Medium",
- "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "Enable diagnostics logging",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
+ "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "service": "ACR",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "Control inbound network access with Private Link",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable public network access if inbound network access is secured using Private Link",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
+ "service": "ACR",
"severity": "Medium",
- "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "text": "Disable Public Network access",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
- "severity": "High",
- "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only the ACR Premium SKU supports Private Link access",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
- "severity": "High",
- "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
+ "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "service": "ACR",
+ "severity": "Low",
+ "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
- "severity": "High",
- "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Deploy validated container images",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
+ "service": "ACR",
"severity": "High",
- "text": "Enable Endpoint Protection on IaaS Servers.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
- "severity": "Medium",
- "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
+ "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
+ "service": "Data Explorer",
+ "text": "Leverage External Tables and Continuous data export overview to reduce costs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
- "severity": "Medium",
- "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
+ "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
+ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
+ "service": "Data Explorer",
+ "text": "To share data, explore Leader-follower cluster configuration",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
- "severity": "High",
- "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
+ "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
+ "service": "Data Explorer",
+ "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
+ "service": "Data Explorer",
+ "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
"waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
+ "service": "Data Explorer",
+ "text": "Ingest data into each cluster in parallel",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
- "severity": "High",
- "text": "Enable secure transfer to storage accounts.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
+ "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
+ "service": "Data Explorer",
+ "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
- "severity": "High",
- "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
+ "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
+ "service": "Data Explorer",
+ "text": "For critical applications, create Active-Active configuration in two paired regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
- "severity": "High",
- "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Service",
- "severity": "Low",
- "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
- "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Service",
- "severity": "Medium",
- "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
+ "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
+ "service": "Data Explorer",
+ "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
- "service": "App Service",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
+ "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
+ "service": "Data Explorer",
+ "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Service",
- "severity": "Medium",
- "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
+ "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Data Explorer",
+ "text": "Wrap DevOps and source control around all your code",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
- "service": "App Service",
- "severity": "High",
- "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Data Explorer",
+ "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Service",
- "severity": "High",
- "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Data Explorer",
+ "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Service",
- "severity": "Low",
- "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Data Factory",
+ "severity": "Medium",
+ "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
- "service": "App Service",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Data Factory",
"severity": "High",
- "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
+ "text": "Use zone redundant pipelines in regions that support Availability Zones",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Service",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
+ "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Service",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
+ "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
- "service": "App Service",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
+ "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Service",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Data Factory",
"severity": "Low",
- "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
+ "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"severity": "High",
- "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
+ "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Service",
- "severity": "High",
- "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"severity": "High",
- "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
+ "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"severity": "Medium",
- "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
+ "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"severity": "Medium",
- "text": "Do not store sensitive data on local disk",
+ "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Service",
- "severity": "Medium",
- "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Service",
- "severity": "High",
- "text": "Deploy code to App Service from a trusted and secure environment.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Has an RBAC model been created for use within VMware vSphere",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Service",
- "severity": "High",
- "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"severity": "High",
- "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
+ "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"severity": "High",
- "text": "Pull container images from Azure Container Registry using a Managed Identity.",
+ "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Service",
- "severity": "Medium",
- "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Service",
- "severity": "Medium",
- "text": "Send App Service activity logs to Log Analytics",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"severity": "Medium",
- "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
- "waf": "Reliability"
+ "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Service",
- "severity": "Low",
- "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"severity": "High",
- "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
- "waf": "Reliability"
+ "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"severity": "High",
- "text": "Use a Web Application Firewall (WAF) in front of App Service.",
+ "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"severity": "High",
- "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
+ "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"severity": "Medium",
- "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Service",
- "severity": "High",
- "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
+ "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
"severity": "High",
- "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
+ "text": "Limit use of CloudAdmin account to emergency access only",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Service",
- "severity": "High",
- "text": "Turn off remote debugging in production environments.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
"severity": "Medium",
- "text": "Enable Defender for Cloud - Defender for App Service",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Service",
- "severity": "Medium",
- "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
"severity": "Medium",
- "text": "Pull container images over a Virtual Network from Azure Container Registry.",
+ "text": "Is East-West traffic filtering implemented within NSX-T",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Service",
- "severity": "Medium",
- "text": "Conduct a penetration test on the web application.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Service",
- "severity": "Medium",
- "text": "Deploy validated and vulnerability-scanned code.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
- "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
- "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
"severity": "Medium",
- "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
+ "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
- "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"severity": "Medium",
- "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
+ "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
- "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "App Service",
- "severity": "High",
- "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
- "waf": "Governance"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
- "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/",
- "service": "App Service",
- "severity": "Low",
- "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
- "waf": "Cost"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
- "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
- "service": "App Service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"severity": "Medium",
- "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
- "waf": "Cost"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT Hub",
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT Hub",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"severity": "Medium",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
+ "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT Hub",
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT Hub",
- "severity": "High",
- "text": "Learn how to trigger a manual failover.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT Hub",
- "severity": "High",
- "text": "Learn how to fail back after a failover.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
- "checklist": "Resiliency Review",
- "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
- "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
- "service": "VMSS",
- "severity": "Low",
- "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
- "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"severity": "High",
- "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
+ "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
- "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"severity": "High",
- "text": "Use Premium or Ultra disks for production VMs",
+ "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
- "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"severity": "High",
- "text": "Ensure Managed Disks are used for all VMs",
+ "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
- "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"severity": "Medium",
- "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
- "waf": "Reliability"
+ "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
- "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"severity": "Medium",
- "text": "Leverage Availability Zones for your VMs in regions where they are supported",
- "waf": "Reliability"
+ "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
- "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"severity": "Medium",
- "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
- "waf": "Reliability"
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
- "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "VM",
- "severity": "High",
- "text": "Avoid running a production workload on a single VM",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
- "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
- "severity": "High",
- "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
- "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
- "service": "VM",
- "severity": "Low",
- "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure all required resource reside within the same Azure availability zone(s)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
- "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
- "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"severity": "Medium",
- "text": "Increase quotas in DR region before testing failover with ASR",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
- "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
- "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
- "service": "VM",
- "severity": "Low",
- "text": "Utilize Scheduled Events to prepare for VM maintenance",
+ "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
- "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
"severity": "Medium",
- "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
+ "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
- "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Storage",
- "severity": "Low",
- "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
- "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Storage",
- "severity": "Low",
- "text": "Enable soft delete for Storage Account Containers",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
- "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Storage",
- "severity": "Low",
- "text": "Enable soft delete for blobs",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
- "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "service": "Backup",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"severity": "Medium",
- "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
- "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
- "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
- "service": "Backup",
- "severity": "Low",
- "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
- "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
- "service": "Backup",
- "severity": "Low",
- "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Resiliency Review",
- "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
- "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "service": "DNS",
- "severity": "Low",
- "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Are data processing implications (service provider / service consumer model) clear and documented",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.PowerBI/gateways",
- "checklist": "Resiliency Review",
- "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
- "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
- "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
- "service": "Data Gateways",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"severity": "Medium",
- "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
+ "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
- "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
"severity": "High",
- "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
- "waf": "Reliability"
+ "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"severity": "High",
- "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
- "waf": "Reliability"
+ "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"severity": "Medium",
- "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"severity": "High",
- "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
- "waf": "Reliability"
+ "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "Low",
- "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Low",
- "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Low",
- "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"severity": "Medium",
- "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
- "waf": "Reliability"
+ "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"severity": "Medium",
- "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
- "waf": "Reliability"
+ "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
- "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
- "service": "Data Explorer",
- "text": "Leverage External Tables and Continuous data export overview to reduce costs",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
- "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
- "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
- "service": "Data Explorer",
- "text": "To share data, explore Leader-follower cluster configuration",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
- "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
- "service": "Data Explorer",
- "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
- "service": "Data Explorer",
- "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
- "service": "Data Explorer",
- "text": "Ingest data into each cluster in parallel",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
- "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
- "service": "Data Explorer",
- "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
- "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
- "service": "Data Explorer",
- "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
- "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
- "service": "Data Explorer",
- "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
- "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
- "service": "Data Explorer",
- "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
- "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Data Explorer",
- "text": "Wrap DevOps and source control around all your code",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Data Explorer",
- "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Data Explorer",
- "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Deploy your backup solution outside of vSan, on Azure native components",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "Operations"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
- "severity": "Medium",
- "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
- "training": "https://github.com/Azure/sap-automation",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For manual deployments, all configuration and deployments must be documented",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
- "severity": "Medium",
- "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
- "severity": "Medium",
- "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
- "severity": "High",
- "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "Medium",
- "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
- "severity": "High",
- "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
"severity": "Low",
- "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
- "waf": "Reliability"
+ "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
- "severity": "Medium",
- "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
"severity": "Low",
- "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Reliability"
+ "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "High",
- "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "High",
- "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
- "severity": "High",
- "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "High",
- "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
- "severity": "High",
- "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "High",
- "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"severity": "High",
- "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"severity": "High",
- "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
- "severity": "High",
- "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
- "severity": "High",
- "text": "Make sure the Floating IP is enabled on the Load balancer",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
- "severity": "High",
- "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
- "severity": "High",
- "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "High",
- "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"severity": "Medium",
- "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
"severity": "High",
- "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
"severity": "High",
- "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
+ "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
"severity": "High",
- "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"severity": "High",
- "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
- "severity": "Medium",
- "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "High",
- "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"severity": "High",
- "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
- "severity": "High",
- "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "High",
- "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Automate SAP System Start-Stop to manage costs.",
- "waf": "Cost"
+ "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Low",
- "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
- "waf": "Cost"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Low",
- "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
- "waf": "Cost"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "Leverage FTA Resillency HandBook",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"severity": "High",
- "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Leverage Availability Zones if regionally applicable",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "Use the Premium or Dedicated SKUs for predicable performance",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "Medium",
- "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
+ "severity": "High",
+ "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "For Business Critical Applications, use Active Active configuration",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "text": "Design Resilient Event Hubs",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
+ "service": "Cognitive Services",
"severity": "Medium",
- "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "Leverage FTA HandBook for Cognitive Services",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Cognitive Services",
"severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "text": "Backup Your Prompts",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
- "severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Cognitive Services",
+ "severity": "High",
+ "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
+ "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
+ "service": "Cognitive Services",
"severity": "Medium",
- "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "text": "Backup Your ChatGPT conversations",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
+ "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
+ "service": "Cognitive Services",
"severity": "Medium",
- "text": "Implement SSO to SAP HANA",
+ "text": "CI/CD for custom speech",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "3687a046-7a1f-4893-9bda-43324f248116",
+ "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
+ "service": "Cognitive Services",
+ "severity": "Low",
+ "text": "Move a knowledge base using export-import",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "text": "Use Standard SKU for production scenarios.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
+ "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Implement SSO to SAP BTP",
+ "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "description": "Keep your management group hierarchy reasonably flat, no more than four.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
+ "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "enforce existing Management Group policies to SAP Subscriptions",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "Operations"
+ "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "High",
- "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
+ "waf": "Cost"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "High",
- "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
- "severity": "Low",
- "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
+ "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
- "severity": "High",
- "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "001cbb6f-d88d-4431-8434-d01333397776",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
+ "link": "",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "High",
- "text": "Help protect your HANA database by using the Azure Backup service.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
+ "link": "",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
+ "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure time-zone matches between the operating system and the SAP system.",
- "waf": "Operations"
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
+ "service": "Azure Service Fabric",
+ "severity": "Medium",
+ "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
- "severity": "Low",
- "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
- "waf": "Cost"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
+ "severity": "Medium",
+ "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
- "waf": "Operations"
+ "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "Operations"
+ "text": "Use more than 1 app instance for your apps",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
- "severity": "Low",
- "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
- "waf": "Operations"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
+ "severity": "Medium",
+ "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Operations"
+ "text": "Set up autoscaling in Spring Cloud Gateway",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
- "severity": "High",
- "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "Operations"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "Low",
+ "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
- "waf": "Operations"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
- "waf": "Operations"
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "High",
- "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Performance"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
+ "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
- "severity": "Medium",
- "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
- "waf": "Operations"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "severity": "Low",
- "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
- "waf": "Performance"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "severity": "High",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
- "waf": "Performance"
+ "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "severity": "Low",
- "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
- "waf": "Performance"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
+ "severity": "Medium",
+ "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
- "severity": "Medium",
- "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Performance"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "32d41e36-11c8-417b-8afb-c410d4391898",
+ "service": "Synapse",
+ "severity": "High",
+ "text": "Restrict use of local users on sql workloads on Synapse",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "cd289bed-6b17-4cb8-8454-61e1aee3453a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/synapse-service-identity?context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Synapse",
"severity": "Medium",
- "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Performance"
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "ec823923-7a15-42d6-ac5e-402925388e5d",
+ "service": "Synapse",
"severity": "High",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "Operations"
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse also includes Synapse role-based access control (RBAC) roles to manage different aspects of Synapse Studio. Leverage these built-in roles to assign permissions to users, groups, or other security principals to manage who can Publish code artifacts and list or access published code artifacts,Execute code on Apache Spark pools and integration runtimes,Access linked (data) services that are protected by credentials,Monitor or cancel job executions, review job output and execution logs.",
+ "guid": "a9c27d9c-42bb-46cd-8c79-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-understand-what-role-you-need",
+ "service": "Synapse",
"severity": "Medium",
- "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "text": "Use Azure RBAC to control access on storage and Synapse RBAC to control access on workspace level depending on the personas of the team to fine grain the access on data and compute",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "7f42c78e-78cb-46a2-8ad1-a0916e6a8d8f",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/row-level-security?view=sql-server-ver16&context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Synapse",
"severity": "Medium",
- "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "text": "Implement RLS, CLS and data masking on sql workloads in dedicated sql pool to add additional layer of security",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create your Azure Synapse workspace, you can choose to associate it to a Microsoft Azure Virtual Network. The Virtual Network associated with your workspace is managed by Azure Synapse. This Virtual Network is called a Managed workspace Virtual Network. This can be selected when deploying a workspace",
+ "guid": "e2436b03-36db-455e-8796-0eee0bdf4cc2",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-vnet?view=sql-server-ver16",
+ "service": "Synapse",
"severity": "Medium",
- "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "text": "Use managed vnet workspace to restrict the access over public internet",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "To protect any sensitive data, it's recommended to disable public access to the workspace endpoints entirely. By doing so, it ensures all workspace endpoints can only be accessed using�private endpoints.",
+ "guid": "efc4d761-c31d-425f-bbb4-7a393a040ed3",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-private-endpoints?view=sql-server-ver16",
+ "service": "Synapse",
"severity": "Medium",
- "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "text": "Configure private endpoints to connect to the external services and disable public access",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "High",
- "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "Performance"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If public access needs to be enabled, it's highly recommended to configure the IP firewall rules to allow inbound connections only from the specified list of public IP addresses.",
+ "guid": "294798b1-178a-42c5-a46c-eb544350d092",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-ip-firewall",
+ "service": "Synapse",
+ "text": "If enabling public access highly recommended to configure IP firewall rules",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "d234292b-7528-4537-a551-c5bf4e4f1854",
+ "link": "https://learn.microsoft.com/azure/data-factory/create-self-hosted-integration-runtime?tabs=data-factory",
+ "service": "Synapse",
"severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "Operations"
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This can be done only when deploying the workspace, but Python libraries installed from public repositories like PyPI are not supported. (Think about the limitation before enabling it)",
+ "guid": "287d5cdc-126c-4c03-8af5-b1fc6898a535",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/how-to-create-a-workspace-with-data-exfiltration-protection",
+ "service": "Synapse",
"severity": "Medium",
- "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operations"
+ "text": "Enable Data Exfiltration Protection (DEP)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "First layer of encryption is done by Microsoft managed keys, you can add a second layer of encryption using Customer managed Keys",
+ "guid": "e337897e-31b6-47d6-9be5-962a1193846d",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/workspaces-encryption",
+ "service": "Synapse",
"severity": "Medium",
- "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operations"
+ "text": "Data Encryption at rest using Customer managed Keys for workspace",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "High",
- "text": "Public IP assignment to VM running SAP Workload is not recommended.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse leverages TLS to ensure data is encrypted in motion. SQL dedicated pools support TLS 1.0, TLS 1.1, and TLS 1.2 versions for encryption wherein Microsoft-provided drivers use TLS 1.2 by default. Serverless SQL pool and Apache Spark pool use TLS 1.2 for all outbound connections.",
+ "guid": "697cc391-ed16-4b2d-886f-0a1241bddde6",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/guidance/security-white-paper-data-protection#data-in-transit",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Data Encryption in transit ",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Keyvaults to store your secrets and credentials",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25e4d5",
+ "service": "Synapse",
"severity": "High",
- "text": "Consider reserving IP address on DR side when configuring ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operations"
+ "text": "Store passwords, secerts and keys in Azure key vault",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "0bdf4cc2-efc4-4d76-8c31-d25ffbb47a39",
+ "service": "Data Factory",
"severity": "High",
- "text": "Avoid using overlapping IP address ranges for production and DR sites.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Operations"
+ "text": "Restrict use of local users whereever necessary",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed identities eliminate the need to manage credentials. Managed identities provide an identity for the service instance when connecting to resources that support Microsoft Entra authentication.",
+ "guid": "3a040ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://learn.microsoft.com/azure/data-factory/data-factory-service-identity",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "Operations"
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "service": "Data Factory",
+ "severity": "High",
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6898a535-e337-4897-b31b-67d67be5962a",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create an Azure integration runtime within a Data Factory managed virtual network, the integration runtime is provisioned with the managed virtual network. It uses private endpoints to securely connect to supported data stores.",
+ "guid": "1193846d-697c-4c39-8ed1-6b2d186f0a12",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "text": "Use managed vnet IR to restrict the access over public internet for Azure Integration Runtime",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed private endpoints are private endpoints created in the Data Factory managed virtual network that establishes a private link to Azure resources. Data Factory manages these private endpoints on your behalf.",
+ "guid": "41bddde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/data-factory/managed-virtual-network-private-endpoint#managed-private-endpoints",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "text": "Configure managed private endpoints to connect to resources using managed azure IR",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "6ceb5443-5135-4922-9442-93bb628637a5",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "text": "Data Encryption at rest by Microsoft managed keys",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "5119b08e-8f58-4543-a7e9-cec166cd072a",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Performance"
+ "text": "Data Encryption in transit by Microsoft managed keys",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you specify a customer-managed key, Data Factory uses�both�the factory system key and the CMK to encrypt customer data. Missing either would result in Deny of Access to data and factory.",
+ "guid": "f9b241a9-98a5-435e-9378-97e71ca7da8c",
+ "link": "https://learn.microsoft.com/azure/data-factory/enable-customer-managed-key",
+ "service": "Data Factory",
"severity": "Medium",
- "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "text": "Data Encryption in transit by BYOK (Customer managed keys)",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "faa62a15-9495-46da-a7dc-3a23267b2258",
+ "link": "https://learn.microsoft.com/azure/data-factory/store-credentials-in-key-vault, https:/learn.microsoft.com/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities",
+ "service": "Data Factory",
"severity": "High",
- "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Performance"
+ "text": "Store passwords, secrets in Azure Key Vault",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6db55f57-9603-4334-adf9-cc23418db612",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "text": "Define roles and responsibilities to manage Microsoft Purview in control plane and data plane",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Azure RBACs for this",
+ "guid": "8126504b-b47a-4393-a080-427294798b15",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "text": "Define roles and tasks required to deploy and manage Microsoft Purview inside an Azure subscription (control plane)",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "High",
- "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Purview roles for this.",
+ "guid": "78b219a4-6ceb-4544-9513-5922744293bb",
+ "link": "https://learn.microsoft.com/purview/classic-data-governance-permissions#roles, https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Define roles and task needed to perform data management and governance using Microsoft Purview. (Data plane for Data Map and Data Catalog.)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "628637a5-5119-4b08-b8f5-854387e9cec1",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "Performance"
+ "text": "Assign roles to Microsoft Entra groups instead of assigning roles to individual users.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "66cd072a-f9b2-441a-a98a-535e737897e7",
+ "link": "https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-overview",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Use Azure�Active Directory Entitlement Management�to map user access to Microsoft Entra groups using Access Packages.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "1ca7da8c-faa6-42a1-9949-56da97dc3a23",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "text": "Enforce multifactor authentication for Microsoft Purview users, especially, for users with privileged roles such as collection admins, data source admins or data curators.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "267b2258-6f4a-4165-8bdd-dea8a487cdec",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Cost"
+ "text": "Use Microsoft Entra ID to provide authentication and authorization to all users, security groups registered in Entra, service principal and managed identities inside collections in Microsoft Purview",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "4861bc3b-c14a-4eb7-b66e-8d9a3bec218e",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Performance"
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6436b173-6db5-45f5-9960-3334bdf9cc23",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
+ "text": "Enable�end-to-end network isolation�using Private Link Service. (Microsoft Purview Data Map)",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "High",
- "text": "Review SAP HANA database backups for Azure VMs.",
- "waf": "Cost"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "418db612-8126-4504-ab47-a393a0804272",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Use�Microsoft Purview Firewall�to disable Public access. (Microsoft Purview Data Map)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "94798b15-78b2-419a-96ce-b54435135922",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review Site Recovery built-in monitoring, where used for SAP.",
- "waf": "Cost"
+ "text": "Deploy�Network Security Group (NSG) rules�for subnets where Azure data sources private endpoints, Microsoft Purview private endpoints and self-hosted runtime VMs are deployed. (Microsoft Purview Data Map)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
- "severity": "High",
- "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
- "waf": "Operations"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "744293bb-6286-437a-9511-9b08e8f58543",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Implement Microsoft Purview with private endpoints managed by a Network Virtual Appliance, such as�Azure Firewall�for network inspection and network filtering. (Microsoft Purview Data Map)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This private endpoint is also a prerequisite for the portal private endpoint. The Microsoft Purview�portal�private endpoint is required to enable connectivity to Microsoft Purview governance portal using a private network. Microsoft Purview can scan data sources in Azure or an on-premises environment by using ingestion private endpoints. Limitations on using private endpoints https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "87e9cec1-66cd-4072-af9b-241a998a535e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-network",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review Oracle Database in Azure Linux VM backup strategies.",
- "waf": "Operations"
+ "text": "Deploy private endpoints for Microsoft Purview accounts to add another layer of security, so only client calls that are originated from within the virtual network are allowed to access the Microsoft Purview account",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access. Limitation to be reviewed: https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "b7bcdb3b-51eb-42ec-84ed-a6e59d8d9a2e",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
- "waf": "Operations"
+ "text": "Block public access using Microsoft Purview firewall",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "db217e67-6abf-4669-aa48-e5a96f2223ec",
+ "link": "https://learn.microsoft.com/azure/private-link/disable-private-endpoint-network-policy, https:/learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review the use of Automated Backup v2 for Azure VMs.",
- "waf": "Operations"
+ "text": "Use Network Security Groups to filter network traffic to and from Azure resources in an Azure virtual network",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-security#apply-security-best-practices-for-self-hosted-runtime-vms",
+ "guid": "e8cb1231-8ca5-4017-b158-e3fb3aa3c2de",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "Enabling Write accelerator for M series when using premium disks(V1)",
- "waf": "Operations"
+ "text": "If you have sensitive data that cannot leave the boundary of your on-prem vnet it is highly recommended to use SHIR VMs inside your corporate vnet to extract your metadata ",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Metadata is extracted and stored in Microsoft Purview Data Map, if you are not using managed storage account for your Purview account they are open to be accessed by all so implement proper RBACs and retrict the access of Data to only intended users. Applicable to Accounts deployed after December 15, 2023 (or deployed using API version 2023-05-01-preview onwards",
+ "guid": "7f3165c3-a87a-405b-9a20-9949bda47778",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Test availability zone latency.",
- "waf": "Performance"
+ "text": "Use Azure RBACs to restrict the access of your storage account (not managed by MS) only to intended users.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "f24d1167-85c2-4fa5-9c56-a948008be7d7",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Activate SAP EarlyWatch Alert for all SAP components.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Performance"
+ "text": "Data in rest is encrypted by microsoft managed keys",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "27f7b9e9-1be1-4f38-aff3-9812bd463cbb",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "Performance"
+ "text": "Data in transit is encrypted by TLS 1.3",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
- "severity": "Medium",
- "text": "Review SQL Server performance monitoring using CCMS.",
- "waf": "Performance"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "bc8ac199-ebb9-41a4-9d90-dae2cc881370",
+ "service": "Microsoft Purview",
+ "severity": "High",
+ "text": "Always use Azure key vaults to store all credentials if not using managed identities or without password need methods",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6f7c0cba-fe61-4465-add4-57e927139b82",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "Performance"
+ "text": "Prevent accidental deletion of Microsoft Purview accounts by applying resource Locks",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-collections#design-recommendations",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4722d928",
+ "link": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Review SAP HANA studio alerts.",
- "waf": "Performance"
+ "text": "Plan for a break glass strategy for your Microsoft Entra tenant, Azure subscription and Microsoft Purview accounts to prevent tenant-wide account lockout.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "15f51296-5398-4e6d-bd23-7dd142b16c21",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
- "waf": "Performance"
+ "text": "Integrate with Microsoft 365 and Microsoft Defender for Cloud",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "Medium",
- "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Separate admin accounts from normal user accounts.",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "service": "Databricks",
+ "severity": "High",
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "Medium",
- "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Databricks supports Microsoft Entra ID conditional access, which allows administrators to control where and when users are permitted to sign in to Azure Databricks. Conditional access policies can restrict sign-in to your corporate network or can require multi-factor authentication (MFA).",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/#single-sign-on",
+ "service": "Databricks",
+ "severity": "High",
+ "text": "Configure single sign-on and unified login. Enable multi-factor authentication.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "Low",
- "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Customers can use the Token Management API or UI controls to enable or disable personal access tokens (PATs) for REST API authentication, limit the users who are allowed to use PATs, set the maximum lifetime for new tokens, and manage existing tokens. Highly-secure customers typically provision a maximum token lifetime for new tokens for a workspace. This feature requires the Premium pricing tier.",
+ "guid": "352beee0-79b5-488d-bfc5-972cd4cd21b0",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/access-control/tokens",
+ "service": "Databricks",
+ "severity": "Medium",
+ "text": "Use token management.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If you have Databricks administrators who are also normal users of the Databricks platform (for example, there�s a lead data engineer who administers the platform and also does data engineering work), Databricks recommends creating a separate account for administrative tasks. It�s important to note that as part of the Azure RBAC model, users that are given Contributor or above permissions to the Resource Group for a deployed Azure Databricks workspace automatically become administrators when they login to that workspace. Therefore, the same considerations outlined above should be applied to Azure portal users too.",
+ "guid": "77036e5e-6b4b-4fd3-b503-547c1447dc56",
+ "service": "Databricks",
"severity": "High",
- "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
- "training": "https://me.sap.com/notes/3019299/E",
+ "text": "Separate admin accounts from normal user accounts",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "High",
- "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "SCIM (System for Cross-domain Identity Management) allows you to sync users and groups from Microsoft Entra ID to Azure Databricks. There are three major benefits of this approach: 1. When you remove a user, the user is automatically removed from Databricks. 2. Users can also be disabled temporarily via SCIM. Customers have used this capability for scenarios where customers believe that an account may be compromised and need to investigate 3. Groups are automatically synchronized Please refer to the documentation for detailed instructions on how to configure SCIM for Azure Databricks. This feature requires the Premium pricing tier",
+ "guid": "028a71ff-f1ce-415d-b3f0-d5e872d42e36",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/users-groups/scim/",
+ "service": "Databricks",
+ "severity": "Medium",
+ "text": "SCIM synchronization of users and groups.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Using either cluster policies or the older cluster ACLs, admins can define what users or groups within the organization are able to create clusters. Cluster ACLs allow you to specify which users can attach a notebook to a given cluster. Note that if a user shares a notebook already attached to a standard mode cluster, the recipient will also be able to execute code on that cluster. This does not apply to clusters that enforce user isolation: SQL Warehouses, high concurrency with table ACLs clusters, and high concurrency with credential passthrough clusters. Customers who use Unity Catalog can also enable single-user clusters to enforce isolation clusters.",
+ "guid": "11cc57b4-a4b1-4410-b43a-58a9c2289b3d",
+ "service": "Databricks",
"severity": "Medium",
- "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "text": "Limit cluster creation rights.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It�s important to note that even if customers use Azure Key Vault to store their secrets, access controls still need to be defined within Azure Databricks. This is because the same service identity is used to retrieve the secret for all users of an Azure Databricks workspace.",
+ "guid": "8b662d6c-15f5-4129-9539-8e6ded237dd1",
+ "service": "Databricks",
"severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Store passwords, secrets in Azure Key Vault",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Clusters with user isolation include enforcement such that each user runs as a different non-privileged user account on the cluster host. Languages are also limited to those that can be implemented in an isolated manner (SQL and Python), and Spark APIs must be on an allowlist of those we believe to be isolation-safe.",
+ "guid": "78c06a73-a22a-4495-9e7a-8dc4a20e27c3",
+ "service": "Databricks",
"severity": "Medium",
- "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "text": "Use clusters that support user isolation.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It is against security best practices to tie production workloads to individual user accounts, and so we recommend configuring Service Principals within Databricks. Service Principles separate administrator and user actions from the workload and prevent workloads from being impacted if a user leaves an organization. With Databricks, you can configure jobs to run as service principals and generate Personal Access Tokens for Service Principals.",
+ "guid": "e29711b1-352b-4eee-879b-588defc5972c",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/access-control/",
+ "service": "Databricks",
"severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Use service principals to run production jobs. Use proper access control for workspace level (ACLs), account level (RBACs) and data level (Unity catalog) security controls",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "By default, DBFS is a filesystem that is accessible to all users of the given workspace and can be accessed via API. This is not necessarily a major data exfiltration concern as you can limit access to accessing data via the DBFS API or Databricks cli using IP access lists or private network access. However, as use of Azure Databricks grows and more users join a workspace, those users would have access to any data stored in DBFS, creating the potential for undesired information sharing. Databricks recommends that our customers do not store production data in DBFS.",
+ "guid": "d4cd21b0-7703-46e5-b6b4-bfd3d503547c",
+ "service": "Databricks",
"severity": "High",
- "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "text": "Avoid storing production data in DBFS.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "High",
- "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "For the storage accounts that you manage, it is your responsibility to ensure that the storage accounts are protected according to your requirements. Examples might include: Encryption with your customer-managed key, Restrict access to trusted networks with a storage firewall, Anonymous public access is not allowed",
+ "guid": "1447dc56-028a-471f-bf1c-e15dd3f0d5e8",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Databricks",
+ "severity": "Medium",
+ "text": "Encrypt storage and restrict access.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
- "severity": "High",
- "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Add a customer-managed key for select data stored within the Azure Databricks control plane, such as notebooks, secrets, Databricks SQL queries, and Databricks SQL query history and for the root storage account used for DBFS. Azure Databricks requires access to this key for ongoing operations. You can revoke access to the key to prevent Azure Databricks from accessing encrypted data within the control plane (or in our backups). This is like a �nuclear option� where the workspace ceases to function, but it provides an emergency control for extreme situations. This feature requires the Premium pricing tier.",
+ "guid": "72d42e36-11cc-457b-9a4b-1410e43a58a9",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Databricks",
+ "severity": "Medium",
+ "text": "Add a customer-managed key for managed services and workspace storage",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Low",
- "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Configure IP access lists that restrict the IP addresses that can authenticate to Databricks at account console and workspace level by checking if the user or API client is coming from a known good IP address range such as a VPN or office network. Established user sessions do not work if the user moves to a bad IP address, such as when disconnecting from the VPN. ",
+ "guid": "277de183-b1ac-4252-a9a9-b64608489a8f",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/front-end/ip-access-list",
+ "service": "Databricks",
+ "severity": "Medium",
+ "text": "Enable IP access lists to restrict access to certain IP addresses.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Private Link provides a private network route from one Azure environment to another. Private Link can be configured both between Azure Databricks users and the control plane, and also between the control plane and the data plane. Between Databricks users and the control plane, Private Link provides strong controls that limit the source for inbound requests. If a company already routes traffic through an Azure environment, they can use Private Link so that the communication between users and the Azure Databricks control plane does not traverse public IP addresses. This feature requires the Premium pricing tier. Use Azure Private Link to connect from Azure Databricks to your Azure resources. Not only does Private Link ensure",
+ "guid": "82db8eb9-d1ba-473b-86a5-a57eba8dd4b3",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/classic/private-link",
+ "service": "Databricks",
"severity": "Medium",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Configure and use Azure Private Link to access Azure resources.",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "High",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
+ "severity": "Medium",
+ "text": "Leverage Flexible Server",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"severity": "High",
- "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
- "severity": "High",
- "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
+ "severity": "Medium",
+ "text": "Leverage Data-in replication for cross-region DR scenarios",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
- "severity": "High",
- "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "AppGW",
+ "severity": "Medium",
+ "text": "Ensure you are using Application Gateway v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "Low",
- "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
+ "severity": "Medium",
+ "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "Low",
- "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
+ "severity": "Medium",
+ "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "High",
- "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "AppGW",
+ "severity": "Medium",
+ "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Low",
- "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "AppGW",
+ "severity": "Medium",
+ "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/application-gateway/tutorial-protect-application-gateway-ddos",
+ "service": "AppGW",
"severity": "Medium",
- "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "High",
- "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "AppGW",
+ "severity": "Medium",
+ "text": "Configure autoscaling with a minimum amount of instances of two.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "text": "Deploy Application Gateway across Availability Zones",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
"severity": "High",
- "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "Medium",
- "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "Low",
+ "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "Medium",
- "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
- "severity": "Medium",
- "text": "Use Azure Traffic Manager to coordinate requests",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
+ "severity": "High",
+ "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "AppGW",
"severity": "High",
- "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Monitor",
- "severity": "Medium",
- "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Backup",
- "severity": "Medium",
- "text": "check backup instances with the underlying datasource not found",
- "waf": "Cost"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "severity": "Medium",
- "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
- "waf": "Cost"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Backup",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
- "waf": "Cost"
+ "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Monitor",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Cost"
+ "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Monitor",
- "severity": "Medium",
- "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Cost"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "AppGW",
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Cost"
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Cost"
+ "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Make sure advisor is configured for VM right sizing ",
- "waf": "Cost"
+ "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "check by searching the Meter Category Licenses in the Cost analysys",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "AppGW",
"severity": "Medium",
- "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
- "waf": "Cost"
+ "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "AppGW",
"severity": "Medium",
- "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Cost"
+ "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Cost"
+ "text": "Use WAF Policies instead of the legacy WAF configuration.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
- "waf": "Cost"
+ "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways'| extend compliant = (properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443') |where properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443'|distinct id,name,compliant",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "You should encrypt traffic to the backend servers.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "You should use a Web Application Firewall.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Only larger disks can be reserved => 1 TiB -",
- "waf": "Cost"
+ "text": "Redirect HTTP to HTTPS",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "AppGW",
"severity": "Medium",
- "text": "After the right-sizing optimization",
- "waf": "Cost"
+ "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "AppGW",
+ "severity": "Low",
+ "text": "Create custom error pages to display a personalized user experience",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Cost"
+ "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
- "waf": "Cost"
+ "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Consider using a VMSS to match demand rather than flat sizing",
- "waf": "Cost"
+ "text": "Use transport layer load balancing",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "AppGW",
"severity": "Medium",
- "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
- "waf": "Cost"
+ "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "AppGW",
+ "severity": "Medium",
+ "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "AppGW",
+ "severity": "Low",
+ "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
+ "severity": "Medium",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "Low",
+ "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Low",
+ "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Low",
+ "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "Low",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
+ "severity": "High",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Reliability"
+ },
+ {
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "severity": "Medium",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "Low",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "Low",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "High",
+ "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "High",
+ "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
+ "severity": "High",
+ "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "Low",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "High",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "Low",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "High",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Backup",
- "severity": "Medium",
- "text": "Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "severity": "Medium",
- "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Functions - Reuse connections",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Cost"
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Functions - Cache data locally",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Cost"
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Functions",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"severity": "Medium",
- "text": "Functions - Keep your functions warm",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Cost"
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Functions",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"severity": "Medium",
- "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
- "waf": "Cost"
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Functions",
- "severity": "Medium",
- "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Cost"
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
- "waf": "Cost"
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
- "waf": "Cost"
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Consider archiving tiers for less used data",
- "waf": "Cost"
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
- "waf": "Cost"
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "severity": "Medium",
- "text": "Consider using standard SSD rather than Premium or Ultra where possible",
- "waf": "Cost"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "severity": "Medium",
- "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
- "waf": "Cost"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "severity": "Medium",
- "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
- "waf": "Cost"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Storage accounts: check hot tier and/or GRS necessary",
- "waf": "Cost"
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "severity": "Medium",
- "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
- "waf": "Cost"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
- "waf": "Cost"
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Export cost data to a storage account for additional data analysis.",
- "waf": "Cost"
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "severity": "Medium",
- "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
- "waf": "Cost"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "Low",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "severity": "Medium",
- "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "Medium",
- "text": "Create multiple Apache Spark pool definitions of various sizes.",
- "waf": "Cost"
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "severity": "Medium",
- "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "severity": "Medium",
- "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "severity": "Medium",
- "text": "Right-sizing all VMs",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "severity": "Medium",
- "text": "Swap VM sized with normalized and most recent sizes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "severity": "Medium",
- "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"severity": "Medium",
- "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
"training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Cost"
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
"severity": "High",
- "text": "Follow Metaprompting guardrails for resonsible AI",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "High",
- "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
- "waf": "Operations"
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "OpenAI",
- "severity": "High",
- "text": "Enable monitoring for your AOAI instances",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "OpenAI",
- "severity": "High",
- "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "OpenAI",
- "severity": "High",
- "text": "Monitor token usage to prevent service disruptions due to capacity",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
"severity": "Medium",
- "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
- "waf": "Operations"
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
"severity": "Low",
- "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
- "waf": "Operations"
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "OpenAI",
- "severity": "High",
- "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "OpenAI",
- "severity": "High",
- "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "High",
- "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "OpenAI",
- "severity": "High",
- "text": "Evaluate usage of Provisioned throughput model ",
- "waf": "Performance"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"severity": "High",
- "text": "Review and implement Azure AI content safety",
- "waf": "Operations"
+ "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "High",
- "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
- "waf": "Performance"
+ "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
- "waf": "Performance"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
- "waf": "Performance"
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
"severity": "High",
- "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
- "waf": "Performance"
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
"severity": "Medium",
- "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
- "waf": "Performance"
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"severity": "High",
- "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
- "waf": "Performance"
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
"severity": "Medium",
- "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
- "waf": "Performance"
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "OpenAI",
- "severity": "Low",
- "text": "Deploy multiple OAI instances across regions",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "OpenAI",
- "severity": "High",
- "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
"severity": "Medium",
- "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
"severity": "Medium",
- "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
"severity": "Medium",
- "text": "Deploy separate fine tuned models across regions if finetuning is employed",
- "waf": "Reliability"
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
"severity": "Medium",
- "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "OpenAI",
- "severity": "High",
- "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "OpenAI",
- "severity": "Low",
- "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "OpenAI",
- "severity": "High",
- "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "OpenAI",
- "severity": "High",
- "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "OpenAI",
- "severity": "High",
- "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "severity": "High",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "High",
- "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Medium",
- "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "OpenAI",
- "severity": "High",
- "text": "Implement Prompt shields and groundedness detection using Content Safety ",
- "waf": "Operations"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "High",
- "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "Low",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "High",
- "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "Medium",
- "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Medium",
- "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "OpenAI",
- "severity": "High",
- "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "OpenAI",
- "severity": "High",
- "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "OpenAI",
- "severity": "High",
- "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "OpenAI",
- "severity": "High",
- "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "OpenAI",
- "severity": "High",
- "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "Medium",
- "text": "Use prompt compression tools like LLMLingua or gprtrim",
- "waf": "Cost"
+ "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "High",
- "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
- "waf": "Reliability"
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
"severity": "Medium",
- "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
- "waf": "Reliability"
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
"severity": "Medium",
- "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
- "waf": "Reliability"
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
"severity": "Medium",
- "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
- "waf": "Reliability"
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "OpenAI",
- "severity": "Low",
- "text": "Azure AI Services are properly tagged for better management",
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "Medium",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "OpenAI",
- "severity": "Low",
- "text": "Azure AI Service accounts follows organizational naming conventions",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "OpenAI",
- "severity": "High",
- "text": "Diagnostic logs in Azure AI services resources should be enabled",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "OpenAI",
- "severity": "High",
- "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "OpenAI",
- "severity": "High",
- "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "Low",
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "OpenAI",
- "severity": "High",
- "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "OpenAI",
- "severity": "High",
- "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
- "waf": "Cost"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "OpenAI",
- "severity": "High",
- "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "OpenAI",
- "severity": "High",
- "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
- "waf": "Reliability"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "Medium",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"severity": "High",
- "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "OpenAI",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
"severity": "Medium",
- "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
- "waf": "Cost"
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"severity": "High",
- "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
- "waf": "Cost"
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
- "waf": "Cost"
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
- "waf": "Cost"
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Review the guidance provided on setting up AI search for Reliability",
- "waf": "Operations"
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Plan and manage AI Search Vector storage",
- "waf": "Operations"
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
- "waf": "Operations"
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "OpenAI",
- "severity": "High",
- "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
- "waf": "Cost"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Evaluate the quality of prompts and applications when switching between model versions",
- "waf": "Operations"
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
- "waf": "Operations"
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Evaluate your Azure AI Search results based on different search parameters",
- "waf": "Operations"
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
- "waf": "Operations"
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "OpenAI",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"severity": "Medium",
- "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
- "waf": "Operations"
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Red team your GenAI applications",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Provide end users with scoring options for LLM responses and track these scores. ",
- "waf": "Operations"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "OpenAI",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
"severity": "High",
- "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
- "waf": "Cost"
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "High",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "Medium",
- "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "Medium",
- "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
- "service": "OpenAI",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"severity": "Medium",
- "text": "Tune content filters to minimize false positives from overly aggressive filters",
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
- "service": "OpenAI",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"severity": "Medium",
- "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
- "waf": "Cost"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
- "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
- "waf": "Cost"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Functions",
+ "severity": "High",
+ "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
+ "service": "Functions",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Functions",
"severity": "Medium",
- "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
- "waf": "Cost"
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
- "waf": "Cost"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Functions",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "OpenAI",
- "severity": "Medium",
- "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
+ "service": "Functions",
+ "severity": "High",
+ "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
- "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Functions",
"severity": "Medium",
- "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
- "waf": "Operations"
+ "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5855",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
- "service": "OpenAI",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Functions",
"severity": "Medium",
- "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
"waf": "Operations"
},
{
@@ -10662,484 +11430,310 @@
"checklist": "Azure API Management Review",
"guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
"link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
- "severity": "High",
- "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
- "severity": "High",
- "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use managed identities to authenticate to other Azure resources whenever possible",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
- "severity": "High",
- "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
- "severity": "Medium",
- "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
- "severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
- "severity": "High",
- "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
- "severity": "High",
- "text": "Avoid placing Traffic Manager behind Front Door.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
- "severity": "High",
- "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "Low",
- "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
- "waf": "Performance"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
- "severity": "Low",
- "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
- "waf": "Performance"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
- "severity": "High",
- "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
- "severity": "High",
- "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
+ "service": "APIM",
"severity": "Medium",
- "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
+ "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
"severity": "High",
- "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
+ "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"severity": "High",
- "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
+ "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
- "severity": "High",
- "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Use managed identities to authenticate to other Azure resources whenever possible",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"severity": "High",
- "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
+ "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
+ "service": "CosmosDB",
+ "severity": "Medium",
+ "text": "FTA Resiliency Playbook",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"severity": "High",
- "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "text": "Run multiple replicas of the database (>1 ) in Prod",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
+ "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "text": "Leverage Multi-Region Writes",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Span Cosmos account across two or more regions with multi-region writes",
+ "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
+ "text": "Distribute your data globally",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
- "severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
+ "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
+ "service": "CosmosDB",
+ "severity": "High",
+ "text": "Choose from several well-defined consistency models",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
+ "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "text": "Enable Service managed failover",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
+ "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
- "waf": "Operations"
+ "text": "Enable Automatic Backups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
+ "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "text": "Perform Periodic Backups",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
+ "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
+ "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
- "severity": "High",
- "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
+ "service": "PostgreSQL",
+ "severity": "Medium",
+ "text": "Leverage Flexible Server",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
+ "service": "PostgreSQL",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "31b67c67-be59-4519-8083-845d587cb391",
+ "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
+ "service": "PostgreSQL",
"severity": "Medium",
- "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
+ "text": "Leverage cross-region read replicas for BCDR",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Use caching for endpoints that support it.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "Low",
- "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
- "severity": "Medium",
- "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"severity": "Medium",
- "text": "Use wildcard TLS certificates when possible.",
- "waf": "Operations"
+ "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "Medium",
- "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
- "waf": "Performance"
+ "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"severity": "Medium",
- "text": "Use file compression when you're accessing downloadable content.",
+ "text": "Custom brand assets should be hosted on a CDN",
"waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
- "severity": "High",
- "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
- "waf": "Operations"
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "Low",
+ "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Medium",
- "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
+ "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
- "severity": "High",
- "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "Medium",
+ "text": "Don't replicate! Replication can create issues with directory synchronization",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Medium",
- "text": "Leverage Flexible Server",
+ "text": "Have active-active for multi-regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Add Azure AD Domain service stamps to additional regions and locations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Medium",
- "text": "Leverage Data-in replication for cross-region DR scenarios",
+ "text": "Use Replica Sets for DR",
"waf": "Reliability"
},
{
@@ -21662,489 +22256,337 @@
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "AppGW",
- "text": "Deploy the instances in a zone-aware configuration, where available.",
+ "text": "Use Application Gateway v2 in new deployments unless your workload specifically requires Application Gateway v1.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "AppGW",
- "text": "Use Application Gateway with Web Application Firewall (WAF) within a virtual network to protect inbound `HTTP/S` traffic from the Internet.",
+ "text": "Build redundancy in your design. Spread Application Gateway instances across availability zones to improve fault tolerance and build redundancy. Traffic goes to other zones if one zone fails. For more information, see Recommendations for using availability zones and regions.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "AppGW",
- "text": "In new deployments, use Azure Application Gateway v2 unless there is a compelling reason to use Azure Application Gateway v1.",
+ "text": "Plan extra time for rule updates and other configuration changes before you access Application Gateway or make further changes. For example, you might need extra time to remove servers from a back-end pool because they have to drain existing connections.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "AppGW",
- "text": "Plan for rule updates",
+ "text": "Implement the Health Endpoint Monitoring pattern. Your application should expose health endpoints, which aggregate the state of the critical services and dependencies that your application needs to serve requests. Application Gateway health probes use the endpoint to detect the health of servers in the back-end pool. For more information, see Health Endpoint Monitoring pattern.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "AppGW",
- "text": "Use health probes to detect backend unavailability",
+ "text": "Evaluate the impact of interval and threshold settings on a health probe. The health probe sends requests to the configured endpoint at a set interval. And the back end tolerates a limited number of failed requests before it's marked as unhealthy. These settings can conflict, which presents a tradeoff.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "AppGW",
- "text": "Review the impact of the interval and threshold settings on health probes",
+ "text": "Verify downstream dependencies through health endpoints. To isolate failures, each of your back ends might have its own dependencies. For example, an application that you host behind Application Gateway might have multiple back ends, and each back end connects to a different database, or replica. When such a dependency fails, the application might work but doesn't return valid results. For that reason, the health endpoint should ideally validate all dependencies.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "AppGW",
- "text": "Verify downstream dependencies through health endpoints",
+ "text": "Consider Application Gateway limitations and known issues that might affect reliability. Review the Application Gateway FAQ for important information about by-design behavior, fixes under construction, platform limitations, and possible workarounds or mitigation strategies. Don't use UDRs in the Application Gateway dedicated subnet.",
"type": "checklist",
"waf": "Reliability"
},
{
- "description": "Plan enough time for updates before accessing Application Gateway or making further changes. For example, removing servers from backend pool might take some time because they have to drain existing connections.",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "AppGW",
- "text": "Plan for rule updates",
- "type": "recommendation",
+ "text": "Consider Source Network Address Translation (SNAT) port limitations in your design that can affect back-end connections on Application Gateway. Some factors affect how Application Gateway reaches the SNAT port limit. For example, if the back end is a public IP address, it requires its own SNAT port. To avoid SNAT port limitations, you can do one of the following options:",
+ "type": "checklist",
"waf": "Reliability"
},
{
- "description": "If Application Gateway is used to load balance incoming traffic over multiple backend instances, we recommend the use of health probes. These will ensure that traffic is not routed to backends that are unable to handle the traffic.",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "When you spread multiple instances across zones, your workload can withstand failures in a single zone. If you have an unavailable zone, traffic automatically shifts to healthy instances in other zones, which maintains application reliability.",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "AppGW",
- "text": "Use health probes to detect backend unavailability",
+ "text": "Deploy Application Gateway instances in a zone-aware configuration. Check regional support for zone redundancy because not all regions offer this feature.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "The health probe sends requests to the configured endpoint at a set interval. Also, there's a threshold of failed requests that will be tolerated before the backend is marked unhealthy. These numbers present a trade-off.- Setting a higher interval puts a higher load on your service. Each Application Gateway instance sends its own health probes, so 100 instances every 30 seconds means 100 requests per 30 seconds.- Setting a lower interval leaves more time before an outage is detected.- Setting a low unhealthy threshold might mean that short, transient failures might take down a backend. - Setting a high threshold it can take longer to take a backend out of rotation.",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "Health probes ensure that traffic only routes to back ends that can handle the traffic. Application Gateway monitors the health of all the servers in its back-end pool and automatically stops sending traffic to any server that it considers unhealthy.",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "AppGW",
- "text": "Review the impact of the interval and threshold settings on health probes",
+ "text": "Use Application Gateway health probes to detect back-end unavailability.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "Suppose each backend has its own dependencies to ensure failures are isolated. For example, an application hosted behind Application Gateway might have multiple backends, each connected to a different database (replica). When such a dependency fails, the application might be working but won't return valid results. For that reason, the health endpoint should ideally validate all dependencies. Keep in mind that if each call to the health endpoint has a direct dependency call, that database would receive 100 queries every 30 seconds instead of 1. To avoid this, the health endpoint should cache the state of the dependencies for a short period of time.",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "Use rate limiting to avoid problems like retry storms.",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "AppGW",
- "text": "Verify downstream dependencies through health endpoints",
+ "text": "Configure rate-limiting rules for Azure WAF so that clients can't send too much traffic to your application.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "Certain scenarios can force you to implement rules specifically on Application Gateway. For example, if ModSec CRS 2.2.9, CRS 3.0 or CRS 3.1 rules are required, these rules can be only implemented on Application Gateway. Conversely, rate-limiting and geo-filtering are available only on Azure Front Door, not on AppGateway.",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "UDRs on the Application Gateway subnet can cause some problems. Don't use UDRs on the Application Gateway subnet so that you can view the back-end health, logs, and metrics.",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "AppGW",
- "text": "When using Azure Front Door and Application Gateway to protect `HTTP/S` applications, use WAF policies in Front Door and lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "text": "Don't use UDRs on Application Gateway so that the back-end health report functions properly and generates the correct logs and metrics. If you must use a UDR in the Application Gateway subnet, see Supported UDRs.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "Set the IdleTimeout to match the back end. This setting ensures that the connection between Application Gateway and the client stays open if the back end takes more than four minutes to respond to the request. If you don't configure this setting, the connection closes, and the client doesn't see the back-end response.",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "AppGW",
- "text": "Set up a TLS policy for enhanced security",
- "type": "checklist",
+ "text": "Configure the IdleTimeout settings to match the listener and traffic characteristics of the back-end application. The default value is four minutes. You can configure it to a maximum of 30 minutes. For more information, see Load balancer Transmission Control Protocol (TCP) reset and idle timeout.",
+ "type": "recommendation",
"waf": "Reliability"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "AppGW",
- "text": "Use AppGateway for TLS termination",
+ "text": "Review the security baseline for Application Gateway.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "AppGW",
- "text": "Use Azure Key Vault to store TLS certificates",
+ "text": "Block common threats at the edge. WAF integrates with Application Gateway. Enable WAF rules on the front ends to protect applications from common exploits and vulnerabilities at the network edge, which is close to the attack source. For more information, see WAF on Application Gateway.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "AppGW",
- "text": "When re-encrypting backend traffic, ensure the backend server certificate contains both the root and intermediate Certificate Authorities (CAs)",
+ "text": "Allow only authorized access to the control plane. Use Application Gateway role-based access control (RBAC) to restrict access to only the identities that need it.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "AppGW",
- "text": "Use an appropriate DNS server for backend pool resources",
+ "text": "Protect data in transit. Enable end-to-end Transport Layer Security (TLS), TLS termination, and end-to-end TLS encryption. When you re-encrypt back-end traffic, ensure that the back-end server certificate contains both the root and intermediate certificate authorities (CAs).",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "AppGW",
- "text": "Comply with all NSG restrictions for Application Gateway",
+ "text": "Protect application secrets. Use Azure Key Vault to store TLS certificates for increased security and an easier certificate renewal and rotation process.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "AppGW",
- "text": "Refrain from using UDRs on the Application Gateway subnet",
+ "text": "Reduce the attack surface and harden the configuration. Remove default configurations that you don't need, and harden your Application Gateway configuration to tighten security controls. Comply with all network security group (NSG) restrictions for Application Gateway.",
"type": "checklist",
"waf": "Reliability"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "AppGW",
- "text": "Be aware of Application Gateway capacity changes when enabling WAF",
+ "text": "Monitor anomalous activity. Regularly review logs to check for attacks and false positives. Send WAF logs from Application Gateway to your organization's centralized security information and event management (SIEM), such as Microsoft Sentinel, to detect threat patterns and incorporate preventative measures in the workload design.",
"type": "checklist",
"waf": "Reliability"
},
{
- "description": "Set up a TLS policy for extra security. Ensure you're always using the latest TLS policy version available. This enforces TLS 1.2 and stronger ciphers.",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "AppGW",
- "text": "Set up a TLS policy for enhanced security",
- "type": "recommendation",
- "waf": "Reliability"
- },
- {
- "description": "There are advantages of using Application Gateway for TLS termination:- Performance improves because requests going to different backends to have to re-authenticate to each backend.- Better utilization of backend servers because they don't have to perform TLS processing- Intelligent routing by accessing the request content.- Easier certificate management because the certificate only needs to be installed on Application Gateway.",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
- "service": "AppGW",
- "text": "Use AppGateway for TLS termination",
- "type": "recommendation",
- "waf": "Reliability"
- },
- {
- "description": "Application Gateway can be integrated with Key Vault. This provides stronger security, easier separation of roles and responsibilities, support for managed certificates, and an easier certificate renewal and rotation process.",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
- "service": "AppGW",
- "text": "Use Azure Key Vault to store TLS certificates",
- "type": "recommendation",
- "waf": "Reliability"
- },
- {
- "description": "A TLS certificate of the backend server must be issued by a well-known CA. If the certificate was not issued by a trusted CA, the Application Gateway checks if the certificate was issued by a trusted CA, and so on, until a trusted CA certificate is found. Only then a secure connection is established. Otherwise, Application Gateway marks the backend as unhealthy.",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "description": "Use the latest TLS policy to enforce the use of TLS 1.2 and stronger ciphers. The TLS policy includes control of the TLS protocol version and the cipher suites and also the order in which a TLS handshake uses ciphers.",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "AppGW",
- "text": "When re-encrypting backend traffic, ensure the backend server certificate contains both the root and intermediate Certificate Authorities (CAs)",
+ "text": "Set up a TLS policy for enhanced security. Ensure that you use the latest TLS policy version.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "When the backend pool contains a resolvable FQDN, the DNS resolution is based on a private DNS zone or custom DNS server (if configured on the VNet), or it uses the default Azure-provided DNS.",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "Performance improves because requests that go to different back ends don't have to reauthenticate to each back end. The gateway can access the request content and make intelligent routing decisions. You only need to install the certificate on Application Gateway, which simplifies certificate management.",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "AppGW",
- "text": "Use an appropriate DNS server for backend pool resources",
+ "text": "Use Application Gateway for TLS termination.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "NSGs are supported on Application Gateway subnet, but there are some restrictions. For instance, some communication with certain port ranges is prohibited. Make sure you understand the implications of those restrictions. For details, see Network security groups.",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "description": "This approach provides stronger security, easier separation of roles and responsibilities, support for managed certificates, and an easier certificate renewal and rotation process.",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "AppGW",
- "text": "Comply with all NSG restrictions for Application Gateway",
+ "text": "Integrate Application Gateway with Key Vault to store TLS certificates.",
"type": "recommendation",
"waf": "Reliability"
},
{
- "description": "Using User Defined Routes (UDR) on the Application Gateway subnet can cause some issues. Health status in the back-end might be unknown. Application Gateway logs and metrics might not get generated. We recommend that you don't use UDRs on the Application Gateway subnet so that you can view the back-end health, logs, and metrics. If your organizations require to use UDR in the Application Gateway subnet, please ensure you review the supported scenarios. For more information, see Supported user-defined routes.",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
+ "description": "The Application Gateway subnet supports NSGs, but there are some restrictions. For instance, some communication with certain port ranges is prohibited. Make sure you understand the implications of those restrictions.",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "AppGW",
- "text": "Refrain from using UDRs on the Application gateway subnet",
+ "text": "Comply with all NSG restrictions for Application Gateway.",
"type": "recommendation",
"waf": "Reliability"
},
- {
- "description": "When WAF is enabled, every request must be buffered by the Application Gateway until it fully arrives, checks if the request matches with any rule violation in its core rule set, and then forwards the packet to the backend instances. When there are large file uploads (30MB+ in size), it can result in a significant latency. Because Application Gateway capacity requirements are different with WAF, we do not recommend enabling WAF on Application Gateway without proper testing and validation.",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
- "service": "AppGW",
- "text": "Be aware of Application Gateway capacity changes when enabling WAF",
- "type": "recommendation",
- "waf": "Reliability"
- },
- {
- "description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "AppGW",
- "text": "Familiarize yourself with Application Gateway pricing",
- "type": "checklist",
- "waf": "Cost"
- },
{
"description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "AppGW",
- "text": "Review underutilized resources",
+ "text": "Familiarize yourself with Application Gateway and WAF pricing. Choose appropriately sized options to meet your workload capacity demand and deliver expected performance without wasting resources. To estimate costs, use the pricing calculator.",
"type": "checklist",
"waf": "Cost"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "AppGW",
- "text": "Stop Application Gateway instances that are not in use",
+ "text": "Remove unused Application Gateway instances, and optimize underused instances. To avoid unnecessary costs, identify and delete Application Gateway instances that have empty back-end pools. Stop Application Gateway instances when they're not in use.",
"type": "checklist",
"waf": "Cost"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "AppGW",
- "text": "Have a scale-in and scale-out policy",
+ "text": "Optimize the scaling cost of your Application Gateway instance. To optimize your scaling strategy and reduce your wokload's demands, see Recommendations for optimizing scaling cost.",
"type": "checklist",
"waf": "Cost"
},
{
"description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "AppGW",
- "text": "Review consumption metrics across different parameters",
+ "text": "Monitor Application Gateway consumption metrics, and understand their cost impact. Azure charges for metered instances of Application Gateway based on tracked metrics. Evaluate the various metrics and capacity units, and determine the cost drivers. For more information, see Microsoft Cost Management.",
"type": "checklist",
"waf": "Cost"
},
{
- "description": "For information about Application Gateway pricing, see Understanding Pricing for Azure Application Gateway and Web Application Firewall. You can also leverage the Pricing calculator.Ensure that the options are adequately sized to meet the capacity demand and deliver expected performance without wasting resources.",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "AppGW",
- "text": "Familiarize yourself with Application Gateway pricing",
- "type": "recommendation",
- "waf": "Cost"
- },
- {
- "description": "Identify and delete Application Gateway instances with empty backend pools to avoid unnecessary costs.",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "AppGW",
- "text": "Review underutilized resources",
- "type": "recommendation",
- "waf": "Cost"
- },
- {
- "description": "You aren't billed when Application Gateway is in the stopped state. Continuously running Application Gateway instances can incur extraneous costs. Evaluate usage patterns and stop instances when you don't need them. For example, usage after business hours in Dev/Test environments is expected to be low.See these articles for information about how to stop and start instances.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "AppGW",
- "text": "Stop Application Gateway instances when not in use",
- "type": "recommendation",
- "waf": "Cost"
- },
- {
- "description": "A scale-out policy ensures that there will be enough instances to handle incoming traffic and spikes. Also, have a scale-in policy that makes sure the number of instances are reduced when demand drops. Consider the choice of instance size. The size can significantly impact the cost. Some considerations are described in the Estimate the Application Gateway instance count.For more information, see What is Azure Application Gateway v2?",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "description": "A stopped Application Gateway instance doesn't incur costs. Application Gateway instances that continuously run can incur unnecessary costs. Evaluate usage patterns, and stop instances when you don't need them. For example, expect low usage after business hours in dev/test environments.",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "AppGW",
- "text": "Have a scale-in and scale-out policy",
+ "text": "Stop Application Gateway instances when they're not in use. For more information, see Stop-AzApplicationGateway and Start-AzApplicationGateway.",
"type": "recommendation",
"waf": "Cost"
},
{
- "description": "You're billed based on metered instances of Application Gateway based on the metrics tracked by Azure. Evaluate the various metrics and capacity units and determine the cost drivers. For more information, see Microsoft Cost Management and Billing. The following metrics are key for Application Gateway. This information can be used to validate that the provisioned instance count matches the amount of incoming traffic.- Estimated Billed Capacity Units- Fixed Billable Capacity Units- Current Capacity UnitsFor more information, see Application Gateway metrics.Make sure you account for bandwidth costs.",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "Use these metrics to validate whether the provisioned instance count matches the amount of incoming traffic, and ensure that you fully utilize the allocated resources.",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "AppGW",
- "text": "Review consumption metrics across different parameters",
+ "text": "Monitor key cost driver Application Gateway metrics, like: - Estimated billed capacity units. - Fixed billable capacity units. - Current capacity units. Make sure you account for bandwidth costs.",
"type": "recommendation",
"waf": "Cost"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "AppGW",
- "text": "Monitor capacity metrics",
- "type": "checklist",
- "waf": "Operations"
- },
- {
- "description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "AppGW",
- "text": "Enable diagnostics on Application Gateway and Web Application Firewall (WAF)",
- "type": "checklist",
- "waf": "Operations"
- },
- {
- "description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
- "service": "AppGW",
- "text": "Use Azure Monitor Network Insights",
- "type": "checklist",
- "waf": "Operations"
- },
- {
- "description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
- "service": "AppGW",
- "text": "Match timeout settings with the backend application",
- "type": "checklist",
- "waf": "Operations"
- },
- {
- "description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "AppGW",
- "text": "Monitor Key Vault configuration issues using Azure Advisor",
+ "text": "Enable diagnostics on Application Gateway and WAF. Collect logs and metrics so you can monitor the health of the workload, identify trends in the workload performance and reliability, and troubleshoot problems. To design your overall monitoring approach, see Recommendations for designing and creating a monitoring system.",
"type": "checklist",
"waf": "Operations"
},
{
"description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "AppGW",
- "text": "Configure and monitor SNAT port limitations",
+ "text": "Use Azure Monitor Network Insights to get a comprehensive view of health and metrics for network resources, including Application Gateway. Use centralized monitoring to quickly identify and resolve problems, optimize performance, and ensure the reliability of your applications.",
"type": "checklist",
"waf": "Operations"
},
{
"description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "AppGW",
- "text": "Consider SNAT port limitations in your design",
+ "text": "Monitor Application Gateway recommendations in Azure Advisor. Configure alerts to notify your team when you have new, critical recommendations for your Application Gateway instance. Advisor generates recommendations based on properties, such as the category, impact level, and recommendation type.",
"type": "checklist",
"waf": "Operations"
},
{
- "description": "Use these metrics as indicators of utilization of the provisioned Application Gateway capacity. We strongly recommend setting up alerts on capacity. For details, see Application Gateway high traffic support.",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "AppGW",
- "text": "Monitor capacity metrics",
- "type": "recommendation",
- "waf": "Operations"
- },
- {
- "description": "There are other metrics that can indicate issues either at Application Gateway or the backend. We recommend evaluating the following alerts:- Unhealthy Host Count- Response Status (dimension 4xx and 5xx)- Backend Response Status (dimension 4xx and 5xx)- Backend Last Byte Response Time- Application Gateway Total TimeFor more information, see Metrics for Application Gateway.",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "AppGW",
- "text": "Troubleshoot using metrics",
- "type": "recommendation",
- "waf": "Operations"
- },
- {
- "description": "Diagnostic logs allow you to view firewall logs, performance logs, and access logs. Use these logs to manage and troubleshoot issues with Application Gateway instances. For more information, see Back-end health and diagnostic logs for Application Gateway.",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "AppGW",
- "text": "Enable diagnostics on Application Gateway and Web Application Firewall (WAF)",
- "type": "recommendation",
- "waf": "Operations"
- },
- {
- "description": "Azure Monitor Network Insights provides a comprehensive view of health and metrics for network resources, including Application Gateway. For additional details and supported capabilities for Application Gateway, see Azure Monitor Network insights.",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "description": "Set alerts when metrics cross thresholds so that you know when your usage increases. This approach ensures that you have enough time to implement necessary changes to your workload and prevents degradation or outages.",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "AppGW",
- "text": "Use Azure Monitor Network Insights",
+ "text": "Configure alerts to notify your team when capacity metrics, like CPU usage and compute unit usage, cross recommended thresholds. To configure a comprehensive set of alerts based on capacity metrics, see Application Gateway high-traffic support.",
"type": "recommendation",
"waf": "Operations"
},
{
- "description": "Ensure you have configured the IdleTimeout settings to match the listener and traffic characteristics of the backend application. The default value is set to four minutes and can be configured to a maximum of 30. For more information, see Load Balancer TCP Reset and Idle Timeout.For workload considerations, see Monitoring application health for reliability.",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "Use alerts to help ensure that your team can respond to problems in a timely manner and facilitate troubleshooting.",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "AppGW",
- "text": "Match timeout settings with the backend application",
+ "text": "Configure alerts to notify your team about metrics that indicate problems either at Application Gateway or the back end. We recommend that you evaluate the following alerts:- Unhealthy host count- Response status, such as 4xx and 5xx errors - Back-end response status, such as 4xx and 5xx errors - Back-end last byte response time- Application Gateway total timeFor more information, see Metrics for Application Gateway.",
"type": "recommendation",
"waf": "Operations"
},
{
- "description": "Application Gateway checks for the renewed certificate version in the linked Key Vault at every 4-hour interval. If it is inaccessible due to any incorrect Key Vault configuration, it logs that error and pushes a corresponding Advisor recommendation. You must configure the Advisor alerts to stay updated and fix such issues immediately to avoid any Control or Data plane related problems. For more information, see Investigating and resolving key vault errors. To set an alert for this specific case, use the Recommendation Type as Resolve Azure Key Vault issue for your Application Gateway.",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "description": "Use logs to help detect, investigate, and troubleshoot problems with Application Gateway instances and your workload.",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "AppGW",
- "text": "Monitor Key Vault configuration issues using Azure Advisor",
+ "text": "Enable diagnostic logs on Application Gateway and WAF to collect firewall logs, performance logs, and access logs.",
"type": "recommendation",
"waf": "Operations"
},
{
- "description": "SNAT port limitations are important for backend connections on the Application Gateway. There are separate factors that affect how Application Gateway reaches the SNAT port limit. For example, if the backend is a public IP address, it will require its own SNAT port. In order to avoid SNAT port limitations, you can increase the number of instances per Application Gateway, scale out the backends to have more IP addresses, or move your backends into the same virtual network and use private IP addresses for the backends.Requests per second (RPS) on the Application Gateway will be affected if the SNAT port limit is reached. For example, if an Application Gateway reaches the SNAT port limit, then it won't be able to open a new connection to the backend, and the request will fail.",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "Use Advisor alerts to stay up to date and fix problems immediately. Prevent any control plane or data plane-related problems. Application Gateway checks for the renewed certificate version in the linked Key Vault instance every 4 hours. If the certificate version is inaccessible because of an incorrect Key Vault configuration, it logs that error and pushes a corresponding Advisor recommendation.",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "AppGW",
- "text": "Consider SNAT port limitations in your design",
+ "text": "Use Advisor to monitor Key Vault configuration problems. Set an alert to notify your team when you get the recommendation that states Resolve Azure Key Vault issue for your Application Gateway.",
"type": "recommendation",
"waf": "Operations"
},
{
"description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
- "service": "AppGW",
- "text": "Estimate the Application Gateway instance count",
- "type": "checklist",
- "waf": "Performance"
- },
- {
- "description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "AppGW",
- "text": "Define the maximum instance count",
- "type": "checklist",
- "waf": "Performance"
- },
- {
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "AppGW",
- "text": "Define the minimum instance count",
- "type": "checklist",
- "waf": "Performance"
- },
- {
- "description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "AppGW",
- "text": "Define Application Gateway subnet size",
+ "text": "Estimate capacity requirements for Application Gateway to support your workload requirements. Take advantage of the autoscaling functionality in Application Gateway v2. Set appropriate values for the minimum and maximum number of instances. Appropriately size the dedicated subnet that Application Gateway requires. For more information, see Recommendations for capacity planning.",
"type": "checklist",
"waf": "Performance"
},
{
"description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "AppGW",
- "text": "Take advantage of Application Gateway V2 features for autoscaling and performance benefits",
+ "text": "Take advantage of features for autoscaling and performance benefits. The v2 SKU offers autoscaling, which scales up Application Gateway as traffic increases. Compared to the v1 SKU, the v2 SKU has capabilities that enhance the performance of the workload. For example, the v2 SKU has better TLS offload performance, quicker deployment and update times, and zone-redundancy support. For more information, see Scaling Application Gateway v2 and WAF v2.",
"type": "checklist",
"waf": "Performance"
},
{
- "description": "For Application Gateway v2 SKU, autoscaling takes some time (approximately six to seven minutes) before the additional set of instances is ready to serve traffic. During that time, if there are short spikes in traffic, expect transient latency or loss of traffic.We recommend that you set your minimum instance count to an optimal level. After you estimate the average instance count and determine your Application Gateway autoscaling trends, define the minimum instance count based on your application patterns. For information, see Application Gateway high traffic support.Check the Current Compute Units for the past one month. This metric represents the gateway's CPU utilization. To define the minimum instance count, divide the peak usage by 10. For example, if your average Current Compute Units in the past month is 50, set the minimum instance count to five.",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "AppGW",
- "text": "Define the minimum instance count",
- "type": "recommendation",
- "waf": "Performance"
- },
- {
- "description": "We recommend 125 as the maximum autoscale instance count. Make sure the subnet that has the Application Gateway has sufficient available IP addresses to support the scale-up set of instances.Setting the maximum instance count to 125 has no cost implications because you're billed only for the consumed capacity.",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
+ "description": "For Application Gateway v2, autoscaling takes approximately six to seven minutes before the extra set of instances are ready to serve traffic. During that time, if Application Gateway has short spikes in traffic, expect transient latency or loss of traffic.",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "AppGW",
- "text": "Define the maximum instance count",
+ "text": "Set the minimum instance count to an optimal level based on you estimated instance count, actual Application Gateway autoscaling trends, and your application patterns. Check the current compute units for the past month. This metric represents the gateway's CPU usage. To define the minimum instance count, divide the peak usage by 10. For example, if your average current compute units in the past month is 50, set the minimum instance count to five.",
"type": "recommendation",
"waf": "Performance"
},
{
- "description": "Application Gateway needs a dedicated subnet within a virtual network. The subnet can have multiple instances of the deployed Application Gateway resource. You can also deploy other Application Gateway resources in that subnet, v1 or v2 SKU.Here are some considerations for defining the subnet size:- Application Gateway uses one private IP address per instance and another private IP address if a private front-end IP is configured.- Azure reserves five IP addresses in each subnet for internal use.- Application Gateway (Standard or WAF SKU) can support up to 32 instances. Taking 32 instance IP addresses + 1 private front-end IP + 5 Azure reserved, a minimum subnet size of /26 is recommended. Because the Standard_v2 or WAF_v2 SKU can support up to 125 instances, using the same calculation, a subnet size of /24 is recommended.- If you want to deploy additional Application Gateway resources in the same subnet, consider the additional IP addresses that will be required for their maximum instance count for both, Standard and Standard v2.",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "Application Gateway can scale out as needed to handle increased traffic to your applications. This setting doesn't increase cost because you only pay for the consumed capacity.",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "AppGW",
- "text": "Define Application Gateway subnet size",
+ "text": "Set the maximum autoscale instance count to the maximum possible, which is 125 instances. Make sure that the Application Gateway dedicated subnet has sufficient available IP addresses to support the increased set of instances.",
"type": "recommendation",
"waf": "Performance"
},
{
- "description": "The v2 SKU offers autoscaling to ensure that your Application Gateway can scale up as traffic increases. When compared to v1 SKU, v2 has capabilities that enhance the performance of the workload. For example, better TLS offload performance, quicker deployment and update times, zone redundancy, and more. For more information about autoscaling features, see Scaling Application Gateway v2 and WAF v2.If you are running v1 SKU Application gateway, consider migrating to the Application gateway v2 SKU. For more information, see Migrate Azure Application Gateway and Web Application Firewall from v1 to v2.",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
+ "description": "Use a /24 subnet to provide support for all IP addresses that your Application Gateway v2 deployment needs. Application Gateway uses one private IP address for each instance and another private IP address if you configure a private front-end IP. The Standard_v2 or WAF_v2 SKU can support up to 125 instances. Azure reserves five IP addresses in each subnet for internal use.",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "AppGW",
- "text": "Take advantage of features for autoscaling and performance benefits",
+ "text": "Appropriately size the Application Gateway dedicated subnet. We highly recommend a /24 subnet for an Application Gateway v2 deployment. If you want to deploy other Application Gateway resources in the same subnet, consider the extra IP addresses that you require for the maximum instance count. For more considerations about sizing the subnet, see Application Gateway infrastructure configuration.",
"type": "recommendation",
"waf": "Performance"
},
@@ -26511,7 +26953,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
diff --git a/checklists-ext/virtualmachines_sg_checklist.en.json b/checklists-ext/virtualmachines_sg_checklist.en.json
index 4b3cd509c..13bf54085 100644
--- a/checklists-ext/virtualmachines_sg_checklist.en.json
+++ b/checklists-ext/virtualmachines_sg_checklist.en.json
@@ -293,6 +293,6 @@
"name": "Virtual Machines Service Guide",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/virtualmachines_sg_checklist.es.json b/checklists-ext/virtualmachines_sg_checklist.es.json
index 296c4a45f..6fe15b7c8 100644
--- a/checklists-ext/virtualmachines_sg_checklist.es.json
+++ b/checklists-ext/virtualmachines_sg_checklist.es.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "Prepare su aplicación para el futuro para el escalado y aproveche las garantías de alta disponibilidad que distribuyen las máquinas virtuales a través de dominios de error en una región o una zona de disponibilidad.",
+ "description": "Prepare su aplicación para el futuro para el escalado y aproveche las garantías de alta disponibilidad que distribuyen las máquinas virtuales entre dominios de error en una región o una zona de disponibilidad.",
"guid": "68d4b0a3-7b56-45fa-a80e-5f0f1dba68ff",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Use conjuntos de escalado de máquinas virtuales en modo de orquestación flexible para implementar máquinas virtuales.",
@@ -14,12 +14,12 @@
"description": "Mantenga la disponibilidad incluso si una instancia se considera incorrecta. Las reparaciones automáticas inician la recuperación mediante la sustitución de la instancia defectuosa. Establecer una ventana de tiempo puede evitar operaciones de reparación inadvertidas o prematuras.",
"guid": "fac87b55-eeaa-47d4-99fc-05bf5e220e3e",
"service": "Virtual Machines",
- "text": "(Máquinas virtuales) Implemente puntos de conexión de estado que emitan estados de mantenimiento de instancia en máquinas virtuales. (Conjunto de escalas) Habilite las reparaciones automáticas en el conjunto de báscula especificando la acción de reparación preferida. Considere la posibilidad de establecer un período de tiempo durante el cual las reparaciones automáticas se detengan si cambia el estado de la máquina virtual.",
+ "text": "(Máquinas virtuales) Implemente puntos de conexión de estado que emitan estados de mantenimiento de instancias en máquinas virtuales. (Conjunto de escalas) Habilite las reparaciones automáticas en el conjunto de básculas especificando la acción de reparación preferida. Considere la posibilidad de establecer un período de tiempo durante el cual las reparaciones automáticas se detengan si cambia el estado de la máquina virtual.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "El sobreaprovisionamiento reduce los tiempos de implementación y tiene una ventaja en cuanto a costos, ya que no se facturan las máquinas virtuales adicionales.",
+ "description": "El sobreaprovisionamiento reduce los tiempos de implementación y tiene una ventaja de costo, ya que no se facturan las máquinas virtuales adicionales.",
"guid": "6f9864f6-415a-40eb-be9d-328d66a1a313",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Habilite el sobreaprovisionamiento en conjuntos de escalado.",
@@ -35,10 +35,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Las instancias de máquina virtual se aprovisionan en ubicaciones físicamente separadas dentro de cada región de Azure que son tolerantes a errores locales. Tenga en cuenta que, en función de la disponibilidad de recursos, puede haber un número impar de instancias en todas las zonas. El equilibrio de zonas admite la disponibilidad al asegurarse de que, si una zona está inactiva, las otras zonas tengan suficientes instancias. Dos instancias en cada zona proporcionan un búfer durante las actualizaciones.",
+ "description": "Las instancias de máquina virtual se aprovisionan en ubicaciones físicamente separadas dentro de cada región de Azure que son tolerantes a errores locales. Tenga en cuenta que, en función de la disponibilidad de recursos, puede haber un número impar de instancias en todas las zonas. El equilibrio de zona admite la disponibilidad al asegurarse de que, si una zona está inactiva, las otras zonas tengan suficientes instancias. Dos instancias en cada zona proporcionan un búfer durante las actualizaciones.",
"guid": "1602d5e4-e1cb-4e3a-b74e-1636b8e789cd",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Implemente en zonas de disponibilidad en conjuntos de escalado. Configure al menos dos instancias en cada zona. El equilibrio de zonas distribuye equitativamente las instancias entre zonas.",
+ "text": "(Conjunto de escalas) Implementación en zonas de disponibilidad en conjuntos de escalado. Configure al menos dos instancias en cada zona. El equilibrio de zonas distribuye equitativamente las instancias entre zonas.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -70,7 +70,7 @@
"description": "El etiquetado es una forma común de segmentar y organizar los recursos, y puede ser crucial durante la gestión de incidentes. Para obtener más información, consulte Propósito de la nomenclatura y el etiquetado.",
"guid": "59f8b29d-53e3-44f4-aa87-b1be2379746c",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Aplique etiquetas recomendadas por la organización en los recursos aprovisionados.",
+ "text": "(VMs, conjunto de escalado) Aplique las etiquetas recomendadas por la organización en los recursos aprovisionados.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -78,7 +78,7 @@
"description": "Las características del perfil de seguridad se habilitan automáticamente cuando se crea la máquina virtual. Para más información, consulte Línea base de seguridad de Azure para conjuntos de escalado de máquinas virtuales.",
"guid": "b3e98269-3ffc-4326-abff-769fc46efd63",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca un perfil de seguridad con las características de seguridad que desea habilitar en la configuración de la máquina virtual. Por ejemplo, cuando se especifica el cifrado en el host en el perfil, los datos almacenados en el host de la máquina virtual se cifran en reposo y los flujos se cifran en el servicio de almacenamiento.",
+ "text": "(VMs, conjunto de escalado) Establezca un perfil de seguridad con las características de seguridad que desea habilitar en la configuración de la máquina virtual. Por ejemplo, cuando se especifica el cifrado en el host en el perfil, los datos almacenados en el host de la máquina virtual se cifran en reposo y los flujos se cifran en el servicio de almacenamiento.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -102,31 +102,31 @@
"description": "Las extensiones se usan para arrancar las máquinas virtuales con el software adecuado que protege el acceso hacia y desde las máquinas virtuales. Las extensiones proporcionadas por Microsoft se actualizan con frecuencia para mantenerse al día con la evolución de los estándares de seguridad.",
"guid": "07666c40-3a2e-4c2d-b9f3-5f626ad5882d",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Incluya extensiones en las máquinas virtuales que protejan contra las amenazas. Por ejemplo, - Extensión de Key Vault para Windows y Linux - Autenticación de identificador de Microsoft Entra - Microsoft Antimalware para Azure Cloud Services y Virtual Machines - Extensión de Azure Disk Encryption para Windows y Linux.",
+ "text": "(VMs, conjunto de escalado) Incluya extensiones en las máquinas virtuales que protejan contra las amenazas. Por ejemplo, - Extensión de Key Vault para Windows y Linux - Autenticación de identificador de Microsoft Entra - Microsoft Antimalware para Azure Cloud Services y Virtual Machines - Extensión de Azure Disk Encryption para Windows y Linux.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Los SKU tienen un precio según las capacidades que ofrecen. Si no necesitas capacidades avanzadas, no gastes de más en SKU. Las máquinas virtuales de acceso puntual aprovechan la capacidad excedente de Azure a un costo menor.",
+ "description": "Los SKU tienen un precio de acuerdo con las capacidades que ofrecen. Si no necesitas capacidades avanzadas, no gastes de más en SKU. Las máquinas virtuales de acceso puntual aprovechan la capacidad excedente de Azure a un costo menor.",
"guid": "29588a06-72af-40ba-892d-df8b05f2e2e1",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Elija el tamaño del plan de máquina virtual y la SKU adecuados. Identifique los mejores tamaños de máquina virtual para su carga de trabajo. Utilice el selector de máquina virtual para identificar la mejor máquina virtual para su carga de trabajo. Consulta los precios de Windows y Linux. En el caso de las cargas de trabajo, como los trabajos de procesamiento por lotes muy paralelos que pueden tolerar algunas interrupciones, considere la posibilidad de usar Azure Spot Virtual Machines. Las máquinas virtuales puntuales son buenas para experimentar, desarrollar y probar soluciones a gran escala.",
+ "text": "(VMs, conjunto de escalado) Elija el tamaño del plan de máquina virtual y la SKU adecuados. Identifique los mejores tamaños de máquina virtual para su carga de trabajo. Use el selector de máquina virtual para identificar la mejor máquina virtual para su carga de trabajo. Consulta los precios de Windows y Linux. En el caso de cargas de trabajo, como trabajos de procesamiento por lotes muy paralelos que pueden tolerar algunas interrupciones, considere la posibilidad de usar Azure Spot Virtual Machines. Las máquinas virtuales puntuales son buenas para experimentar, desarrollar y probar soluciones a gran escala.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Algunos tipos de discos de alto rendimiento ofrecen funciones y estrategias de optimización de costos adicionales. La capacidad de ajuste del disco SSD prémium v2 puede reducir los costos, ya que proporciona un alto rendimiento sin sobreaprovisionamiento, lo que, de otro modo, podría conducir a recursos infrautilizados.",
+ "description": "Algunos tipos de discos de alto rendimiento ofrecen funciones y estrategias de optimización de costos adicionales. La capacidad de ajuste del disco SSD prémium v2 puede reducir los costos, ya que proporciona un alto rendimiento sin sobreaprovisionamiento, lo que, de otro modo, podría dar lugar a recursos infrautilizados.",
"guid": "184fb2f7-0386-4a88-8487-95623a412bec",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Evalúe las opciones de disco asociadas a las SKU de la máquina virtual. Determine sus necesidades de rendimiento teniendo en cuenta sus necesidades de capacidad de almacenamiento y teniendo en cuenta los patrones de carga de trabajo fluctuantes. Por ejemplo, el disco SSD prémium v2 de Azure permite ajustar de forma granular el rendimiento independientemente del tamaño del disco.",
+ "text": "(VMs, conjunto de escalado) Evalúe las opciones de disco asociadas a las SKU de la máquina virtual. Determine sus necesidades de rendimiento teniendo en cuenta sus necesidades de capacidad de almacenamiento y teniendo en cuenta los patrones de carga de trabajo fluctuantes. Por ejemplo, el disco SSD prémium v2 de Azure permite ajustar de forma granular el rendimiento independientemente del tamaño del disco.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Reduzca los costos de infraestructura informática aplicando los grandes descuentos de las máquinas virtuales de acceso puntual.",
+ "description": "Reduzca los costos de infraestructura informática aplicando los grandes descuentos de las máquinas virtuales puntuales.",
"guid": "b1fdfb60-31c8-4ab9-8106-f62e863f6d31",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Combine máquinas virtuales normales con máquinas virtuales de acceso puntual. La orquestación flexible le permite distribuir máquinas virtuales de acceso puntual en función de un porcentaje especificado.",
+ "text": "(Conjunto de escalas) Mezcle máquinas virtuales normales con máquinas virtuales de acceso puntual. La orquestación flexible le permite distribuir máquinas virtuales de acceso puntual en función de un porcentaje especificado.",
"type": "recommendation",
"waf": "Costar"
},
@@ -134,7 +134,7 @@
"description": "El escalado vertical o la detención de recursos cuando no están en uso reduce el número de máquinas virtuales que se ejecutan en el conjunto de escalado, lo que ahorra costos. La función Start/Stop es una opción de automatización de bajo costo.",
"guid": "99a9ab5e-e84d-493d-854b-40eca32360ce",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Reduzca el número de instancias de VM cuando la demanda disminuya. Establezca una política de reducción horizontal basada en criterios. Detenga las máquinas virtuales durante las horas de inactividad. Puede usar la característica Iniciar/Detener de Azure Automation y configurarla según las necesidades de su empresa.",
+ "text": "(Conjunto de escalas) Reduzca el número de instancias de VM cuando la demanda disminuye. Establezca una política de reducción horizontal basada en criterios. Detenga las máquinas virtuales durante las horas de inactividad. Puede usar la característica Iniciar/Detener de Azure Automation y configurarla según las necesidades de su empresa.",
"type": "recommendation",
"waf": "Costar"
},
@@ -142,12 +142,12 @@
"description": "Puede maximizar sus licencias locales mientras obtiene los beneficios de la nube.",
"guid": "1c6503e1-16f5-4ef8-9515-68d5c7747f0d",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Aproveche la movilidad de licencias mediante la Ventaja híbrida de Azure. Las máquinas virtuales tienen una opción de licencia que le permite traer sus propias licencias locales del SO de servidor Windows a Azure. La Ventaja híbrida de Azure también le permite incorporar determinadas suscripciones de Linux a Azure.",
+ "text": "(VMs, conjunto de escalado) Aproveche la movilidad de licencias mediante la Ventaja híbrida de Azure. Las máquinas virtuales tienen una opción de licencia que le permite traer sus propias licencias locales del SO de servidor Windows a Azure. La Ventaja híbrida de Azure también le permite incorporar determinadas suscripciones de Linux a Azure.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "La orquestación flexible puede administrar instancias de VM a escala. La entrega de máquinas virtuales individuales agrega sobrecarga operativa. Por ejemplo, cuando se eliminan instancias de VM, los discos y las NIC asociados también se eliminan automáticamente. Las instancias de VM se distribuyen en varios dominios de error para que las operaciones de actualización no interrumpan el servicio.",
+ "description": "La orquestación flexible puede administrar instancias de VM a escala. La entrega de máquinas virtuales individuales agrega una sobrecarga operativa. Por ejemplo, cuando se eliminan instancias de VM, los discos y las NIC asociados también se eliminan automáticamente. Las instancias de VM se distribuyen en varios dominios de error para que las operaciones de actualización no interrumpan el servicio.",
"guid": "a2dbf398-1751-4efb-98aa-8ab3694ff096",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Los conjuntos de escalado de máquinas virtuales en modo de orquestación flexible pueden ayudar a simplificar la implementación y la administración de la carga de trabajo. Por ejemplo, puede administrar fácilmente la autorreparación mediante el uso de reparaciones automáticas.",
@@ -155,10 +155,10 @@
"waf": "Operaciones"
},
{
- "description": "La seguridad es la razón principal de las actualizaciones. Las garantías de seguridad de las instancias no deben deteriorarse con el tiempo. Las actualizaciones graduales se realizan en lotes, lo que garantiza que todas las instancias no estén inactivas al mismo tiempo.",
+ "description": "La seguridad es la razón principal de las actualizaciones. Las garantías de seguridad de las instancias no deben deteriorarse con el tiempo. Las actualizaciones sucesivas se realizan en lotes, lo que garantiza que todas las instancias no estén inactivas al mismo tiempo.",
"guid": "62e3e643-0661-4c0d-aa35-9066eb12e56e",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Mantenga sus máquinas virtuales actualizadas mediante la configuración de una directiva de actualización. Recomendamos actualizaciones continuas. Sin embargo, si necesita un control granular, elija actualizar manualmente. Para la orquestación flexible, puede usar Azure Update Manager.",
+ "text": "(Conjunto de escalas) Mantenga sus máquinas virtuales actualizadas mediante la configuración de una directiva de actualización. Recomendamos actualizaciones continuas. Sin embargo, si necesita un control granular, elija actualizar manualmente. En el caso de la orquestación flexible, puede usar Azure Update Manager.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -166,7 +166,7 @@
"description": "Se crean las máquinas virtuales del conjunto de escalado y se preinstalan las aplicaciones especificadas, lo que facilita la administración.",
"guid": "36a103b1-2888-4150-bebb-de8e8ba2a1d8",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Implemente automáticamente aplicaciones de máquina virtual desde Azure Compute Gallery definiendo las aplicaciones en el perfil.",
+ "text": "(VMs, conjunto de escalado) Implemente automáticamente aplicaciones de máquina virtual desde Azure Compute Gallery definiendo las aplicaciones en el perfil.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -182,15 +182,15 @@
"description": "La monitorización de los datos es el núcleo de la resolución de incidentes. Una pila de supervisión completa proporciona información sobre el rendimiento de las máquinas virtuales y su estado. Al monitorear continuamente las instancias, puede estar preparado para errores o prevenirlos, como la sobrecarga de rendimiento y los problemas de confiabilidad.",
"guid": "4d2f720c-f0d3-4d39-9258-b212ca1c8a99",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Supervise y mida el estado de las instancias de VM. Implemente la extensión del agente Monitor en las máquinas virtuales para recopilar datos de supervisión del sistema operativo invitado con reglas de recopilación de datos específicas del sistema operativo. Permita que VM Insights supervise el estado y el rendimiento, y vea las tendencias de los datos recopilados. Use los diagnósticos de arranque para obtener información a medida que arrancan las máquinas virtuales. Los diagnósticos de arranque también diagnostican errores de arranque.",
+ "text": "(VMs, conjunto de escalado) Supervise y mida el estado de las instancias de VM. Implemente la extensión del agente Monitor en las máquinas virtuales para recopilar datos de supervisión del sistema operativo invitado con reglas de recopilación de datos específicas del sistema operativo. Habilite la información de la máquina virtual para supervisar el estado y el rendimiento, y para ver las tendencias de los datos recopilados. Use los diagnósticos de arranque para obtener información a medida que arrancan las máquinas virtuales. Los diagnósticos de arranque también diagnostican errores de arranque.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "El tamaño correcto de las máquinas virtuales es una decisión fundamental que afecta significativamente al rendimiento de la carga de trabajo. Sin el conjunto adecuado de máquinas virtuales, es posible que experimente problemas de rendimiento y acumule costos innecesarios.",
+ "description": "El redimensionamiento de las máquinas virtuales es una decisión fundamental que afecta significativamente al rendimiento de la carga de trabajo. Sin el conjunto adecuado de máquinas virtuales, es posible que experimente problemas de rendimiento y acumule costos innecesarios.",
"guid": "e6e6f3f5-7632-4f17-975e-7b35d09b38b4",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Elija SKU para máquinas virtuales que se alineen con su planificación de capacidad. Comprenda bien los requisitos de su carga de trabajo, incluido el número de núcleos, la memoria, el almacenamiento y el ancho de banda de red para que pueda filtrar las SKU inadecuadas.",
+ "text": "(VMs, conjunto de escalado) Elija SKU para máquinas virtuales que se alineen con su planificación de capacidad. Comprenda bien los requisitos de la carga de trabajo, incluido el número de núcleos, la memoria, el almacenamiento y el ancho de banda de red para poder filtrar las SKU inadecuadas.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -198,20 +198,20 @@
"description": "Los grupos de selección de ubicación por proximidad reducen la distancia física entre los recursos de proceso de Azure, lo que puede mejorar el rendimiento y reducir la latencia de red entre máquinas virtuales independientes, máquinas virtuales de varios conjuntos de disponibilidad o máquinas virtuales de varios conjuntos de escalado.",
"guid": "07d79869-9589-4d6a-9e5b-cb0f27cf4b48",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Implemente máquinas virtuales de carga de trabajo sensibles a la latencia en grupos con ubicación de proximidad.",
+ "text": "(VMs, conjunto de escalado) Implemente máquinas virtuales de carga de trabajo sensibles a la latencia en grupos de selección de ubicación por proximidad.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Las SSD prémium ofrecen máquinas virtuales compatibles con discos de alto rendimiento y baja latencia con cargas de trabajo intensivas en E/S. SSD prémium v2 no requiere cambiar el tamaño del disco, lo que permite un alto rendimiento sin un sobreaprovisionamiento excesivo y minimiza el costo de la capacidad no utilizada. Cuando están disponibles en SKU de máquina virtual, NVMe conectado localmente o dispositivos similares pueden ofrecer un alto rendimiento, especialmente para casos de uso que requieren altas operaciones de entrada/salida por segundo (IOPS) y baja latencia.",
+ "description": "Las SSD prémium ofrecen máquinas virtuales compatibles con discos de alto rendimiento y baja latencia con cargas de trabajo intensivas de E/S. Premium SSD v2 no requiere cambiar el tamaño del disco, lo que permite un alto rendimiento sin un sobreaprovisionamiento excesivo y minimiza el costo de la capacidad no utilizada. Cuando están disponibles en SKU de máquina virtual, NVMe conectado localmente o dispositivos similares pueden ofrecer un alto rendimiento, especialmente para casos de uso que requieren operaciones de entrada/salida por segundo (IOPS) altas y baja latencia.",
"guid": "e0902a54-a13c-4831-8dbe-c013010044f4",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca el perfil de almacenamiento analizando el rendimiento del disco de las cargas de trabajo existentes y la SKU de la máquina virtual. Use SSD prémium para máquinas virtuales de producción. Ajuste el rendimiento de los discos con SSD prémium v2. Utilice dispositivos NVMe conectados localmente.",
+ "text": "(VMs, conjunto de escalado) Establezca el perfil de almacenamiento analizando el rendimiento del disco de las cargas de trabajo existentes y la SKU de la máquina virtual. Use SSD prémium para las máquinas virtuales de producción. Ajuste el rendimiento de los discos con SSD prémium v2. Utilice dispositivos NVMe conectados localmente.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Permite la virtualización de E/S de raíz única (SR-IOV) en una máquina virtual, lo que mejora en gran medida su rendimiento de red.",
+ "description": "Permite la virtualización de E/S de raíz única (SR-IOV) en una máquina virtual, lo que mejora en gran medida el rendimiento de su red.",
"guid": "6118c905-4ae3-4a5d-918f-16c2b268934c",
"service": "Virtual Machines",
"text": "(Máquinas virtuales) Considere la posibilidad de habilitar redes aceleradas.",
@@ -219,10 +219,10 @@
"waf": "Rendimiento"
},
{
- "description": "Si aumenta la demanda de la aplicación, aumenta la carga de las instancias de máquina virtual del conjunto de escalado. Las reglas de escalado automático garantizan que tenga suficientes recursos para satisfacer la demanda.",
+ "description": "Si aumenta la demanda de la aplicación, aumenta la carga en las instancias de máquina virtual del conjunto de escalado. Las reglas de escalado automático garantizan que tenga suficientes recursos para satisfacer la demanda.",
"guid": "e4ade8bb-7114-4d3f-9cba-8784905b707b",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca reglas de escalado automático para aumentar o disminuir el número de instancias de VM en el conjunto de escalado en función de la demanda.",
+ "text": "(VMs, conjunto de escalado) Establezca reglas de escalado automático para aumentar o disminuir el número de instancias de máquina virtual del conjunto de escalado en función de la demanda.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -230,7 +230,7 @@
"metadata": {
"name": "Virtual Machines Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -257,31 +257,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/virtualmachines_sg_checklist.ja.json b/checklists-ext/virtualmachines_sg_checklist.ja.json
index d17ffd3c1..952186e57 100644
--- a/checklists-ext/virtualmachines_sg_checklist.ja.json
+++ b/checklists-ext/virtualmachines_sg_checklist.ja.json
@@ -230,7 +230,7 @@
"metadata": {
"name": "Virtual Machines Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -257,31 +257,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/virtualmachines_sg_checklist.ko.json b/checklists-ext/virtualmachines_sg_checklist.ko.json
index 2e4ba6095..d1bbbdf98 100644
--- a/checklists-ext/virtualmachines_sg_checklist.ko.json
+++ b/checklists-ext/virtualmachines_sg_checklist.ko.json
@@ -3,7 +3,7 @@
"categories": [],
"items": [
{
- "description": "확장을 위해 애플리케이션의 미래를 보장하고 지역 또는 가용성 영역의 장애 도메인 간에 VM을 분산하는 고가용성 보장을 활용하세요.",
+ "description": "확장을 위해 애플리케이션의 미래를 보장하고 지역 또는 가용성 영역의 장애 도메인 간에 VM을 분산하는 고가용성 보장을 활용합니다.",
"guid": "68d4b0a3-7b56-45fa-a80e-5f0f1dba68ff",
"service": "Virtual Machines",
"text": "(확장 집합) 유연한 오케스트레이션 모드에서 Virtual Machine Scale Sets 사용하여 VM을 배포합니다.",
@@ -14,7 +14,7 @@
"description": "인스턴스가 비정상으로 간주되는 경우에도 가용성을 유지합니다. 자동 복구는 결함이 있는 인스턴스를 교체하여 복구를 시작합니다. 시간 창을 설정하면 부주의하거나 조기 수리 작업을 방지할 수 있습니다.",
"guid": "fac87b55-eeaa-47d4-99fc-05bf5e220e3e",
"service": "Virtual Machines",
- "text": "(가상 머신) VM에서 인스턴스 상태를 내보내는 heath 엔드포인트를 구현합니다. (확장 집합) 선호하는 복구 작업을 지정하여 확장 집합에서 자동 복구를 사용하도록 설정합니다. VM의 상태가 변경되는 경우 자동 복구가 일시 중지되는 시간 프레임을 설정하는 것이 좋습니다.",
+ "text": "(가상 머신) VM에서 인스턴스 상태를 내보내는 heath 엔드포인트를 구현합니다. (확장 집합) 기본 복구 작업을 지정하여 확장 집합에서 자동 복구를 사용하도록 설정합니다. VM의 상태가 변경되는 경우 자동 복구가 일시 중지되는 시간 프레임을 설정하는 것이 좋습니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -27,7 +27,7 @@
"waf": "신뢰도"
},
{
- "description": "이 옵션은 장애 도메인을 격리합니다. 유지 보수 기간 동안 하나의 장애 도메인이 업데이트되면 다른 장애 도메인에서 VM 인스턴스를 사용할 수 있습니다.",
+ "description": "이 옵션은 장애 도메인을 격리합니다. 유지 보수 기간 동안 하나의 장애 도메인이 업데이트되면 VM 인스턴스를 다른 장애 도메인에서 사용할 수 있습니다.",
"guid": "075a75c0-2abd-43cd-ae87-8b82751ef983",
"service": "Virtual Machines",
"text": "(확장 집합) 유연한 오케스트레이션을 통해 VM 인스턴스를 가능한 한 많은 장애 도메인에 분산할 수 있습니다.",
@@ -35,15 +35,15 @@
"waf": "신뢰도"
},
{
- "description": "VM 인스턴스는 로컬 오류에 대한 내성이 있는 각 Azure 지역 내에서 물리적으로 분리된 위치에 프로비전됩니다. 리소스 가용성에 따라 영역 간에 균일하지 않은 수의 인스턴스가 있을 수 있음을 명심하십시오. 영역 분산은 한 영역이 다운된 경우 다른 영역에 충분한 인스턴스를 갖도록 하여 가용성을 지원합니다. 각 영역에 있는 두 개의 인스턴스는 업그레이드 중에 버퍼를 제공합니다.",
+ "description": "VM 인스턴스는 로컬 오류에 대한 내성이 있는 각 Azure 지역 내에서 물리적으로 분리된 위치에 프로비전됩니다. 리소스 가용성에 따라 영역 간에 인스턴스 수가 고르지 않을 수 있습니다. 영역 분산은 한 영역이 다운된 경우 다른 영역에 충분한 인스턴스를 갖도록 하여 가용성을 지원합니다. 각 영역에 있는 두 개의 인스턴스는 업그레이드 중에 버퍼를 제공합니다.",
"guid": "1602d5e4-e1cb-4e3a-b74e-1636b8e789cd",
"service": "Virtual Machines",
- "text": "(확장 집합) 확장 집합의 가용성 영역에 배포합니다. 각 영역에 두 개 이상의 인스턴스를 설정합니다. 영역 분산은 인스턴스를 영역 간에 균등하게 분산합니다.",
+ "text": "(확장 집합) 확장 집합의 가용성 영역에 배포합니다. 각 영역에 인스턴스를 두 개 이상 설정합니다. 영역 분산은 인스턴스를 여러 영역에 균등하게 분산합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "용량은 사용자가 사용하도록 예약되어 있으며 해당 SLA 범위 내에서 사용할 수 있습니다. 용량 예약은 더 이상 필요하지 않을 때 삭제할 수 있으며 청구는 사용량을 기반으로 합니다.",
+ "description": "용량은 사용자가 사용하도록 예약되어 있으며 해당 SLA의 범위 내에서 사용할 수 있습니다. 용량 예약은 더 이상 필요하지 않을 때 삭제할 수 있으며 청구는 사용량을 기반으로 합니다.",
"guid": "3d22dcd5-106f-4e67-8ee3-693decf769af",
"service": "Virtual Machines",
"text": "(가상 머신) 용량 예약 기능을 활용하세요.",
@@ -70,12 +70,12 @@
"description": "태그 지정은 리소스를 분류하고 구성하는 일반적인 방법이며 인시던트 관리 중에 중요할 수 있습니다. 자세한 내용은 이름 지정 및 태그 지정의 목적을 참조하십시오.",
"guid": "59f8b29d-53e3-44f4-aa87-b1be2379746c",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) 프로비저닝된 리소스에 조직 권장 태그를 적용합니다.",
+ "text": "(VM, 확장 집합) 프로비저닝된 리소스에 organization-recommended 태그를 적용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "보안 프로필의 기능은 VM이 생성될 때 자동으로 활성화됩니다. 자세한 내용은 Virtual Machine Scale Sets에 대한 Azure 보안 기준을 참조하세요.",
+ "description": "보안 프로필의 기능은 VM이 생성될 때 자동으로 활성화됩니다. 자세한 내용은 Virtual Machine Scale Sets 대한 Azure 보안 기준을 참조하세요.",
"guid": "b3e98269-3ffc-4326-abff-769fc46efd63",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) VM 구성에서 사용하도록 설정하려는 보안 기능을 사용하여 보안 프로필을 설정합니다. 예를 들어 프로필에서 호스트에서 암호화를 지정하면 VM 호스트에 저장된 데이터는 미사용 시 암호화되고 흐름은 스토리지 서비스로 암호화됩니다.",
@@ -139,10 +139,10 @@
"waf": "비용"
},
{
- "description": "온-프레미스 라이선스를 극대화하는 동시에 클라우드의 이점을 얻을 수 있습니다.",
+ "description": "온-프레미스 라이선스를 극대화하는 동시에 클라우드의 이점을 활용할 수 있습니다.",
"guid": "1c6503e1-16f5-4ef8-9515-68d5c7747f0d",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) Azure 하이브리드 혜택을 사용하여 라이선스 이동을 활용하세요. VM에는 사용자 고유의 온-프레미스 Windows Server OS 라이선스를 Azure로 가져올 수 있는 라이선스 옵션이 있습니다. 또한 Azure 하이브리드 혜택을 통해 특정 Linux 구독을 Azure로 가져올 수 있습니다.",
+ "text": "(VM, 확장 집합) Azure 하이브리드 혜택을 사용하여 라이선스 이동을 활용하세요. VM에는 고유한 온-프레미스 Windows Server OS 라이선스를 Azure로 가져올 수 있는 라이선스 옵션이 있습니다. 또한 Azure 하이브리드 혜택을 통해 특정 Linux 구독을 Azure로 가져올 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -150,12 +150,12 @@
"description": "유연한 오케스트레이션을 통해 VM 인스턴스를 대규모로 관리할 수 있습니다. 개별 VM을 처리하면 운영 오버헤드가 추가됩니다. 예를 들어 VM 인스턴스를 삭제하면 연결된 디스크 및 NIC도 자동으로 삭제됩니다. VM 인스턴스는 업데이트 작업으로 인해 서비스가 중단되지 않도록 여러 장애 도메인에 분산되어 있습니다.",
"guid": "a2dbf398-1751-4efb-98aa-8ab3694ff096",
"service": "Virtual Machines",
- "text": "(확장 집합) 유연한 오케스트레이션 모드의 Virtual Machine Scale Sets 워크로드의 배포 및 관리를 간소화하는 데 도움이 될 수 있습니다. 예를 들어 자동 복구를 사용하여 자가 복구를 쉽게 관리할 수 있습니다.",
+ "text": "(확장 집합) 유연한 오케스트레이션 모드의 Virtual Machine Scale Sets 워크로드의 배포 및 관리를 간소화하는 데 도움이 될 수 있습니다. 예를 들어 자동 복구를 사용하여 자체 복구를 쉽게 관리할 수 있습니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "보안은 업그레이드의 주된 이유입니다. 인스턴스에 대한 보안 보증은 시간이 지남에 따라 감소해서는 안 됩니다. 롤링 업그레이드는 배치로 수행되므로 모든 인스턴스가 동시에 다운되지 않습니다.",
+ "description": "보안은 업그레이드의 주된 이유입니다. 인스턴스에 대한 보안 보증은 시간이 지남에 따라 감소해서는 안 됩니다. 롤링 업그레이드는 일괄적으로 수행되므로 모든 인스턴스가 동시에 다운되지 않습니다.",
"guid": "62e3e643-0661-4c0d-aa35-9066eb12e56e",
"service": "Virtual Machines",
"text": "(확장 집합) 업그레이드 정책을 설정하여 VM을 최신 상태로 유지합니다. 롤링 업그레이드를 권장합니다. 그러나 세부적인 제어가 필요한 경우 수동으로 업그레이드하도록 선택합니다. 유연한 오케스트레이션의 경우 Azure Update Manager를 사용할 수 있습니다.",
@@ -163,7 +163,7 @@
"waf": "작업"
},
{
- "description": "확장 집합의 VM이 만들어지고 지정된 앱이 미리 설치되어 관리가 더 쉬워집니다.",
+ "description": "확장 집합의 VM이 만들어지고 지정된 앱이 미리 설치되므로 관리가 더 쉬워집니다.",
"guid": "36a103b1-2888-4150-bebb-de8e8ba2a1d8",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) 프로필에서 응용 프로그램을 정의하여 Azure Compute Gallery에서 VM 응용 프로그램을 자동으로 배포합니다.",
@@ -174,7 +174,7 @@
"description": "확장은 각 VM에서 수동으로 설치, 구성 또는 업그레이드할 필요 없이 규모에 맞게 소프트웨어 설치를 간소화하는 데 도움이 될 수 있습니다.",
"guid": "7177b0fd-461c-49e1-9183-f1ee9986c5b6",
"service": "Virtual Machines",
- "text": "부트스트래핑의 일부로 사전 구축된 소프트웨어 구성 요소를 확장으로 설치합니다. Azure는 VM에 대한 유틸리티 응용 프로그램을 구성, 모니터링, 보안 및 제공하는 데 사용할 수 있는 많은 확장을 지원합니다. 확장에서 자동 업그레이드를 사용하도록 설정합니다.",
+ "text": "사전 구축된 소프트웨어 구성 요소를 부트스트래핑의 일부로 확장으로 설치합니다. Azure는 VM에 대한 유틸리티 응용 프로그램을 구성, 모니터링, 보안 및 제공하는 데 사용할 수 있는 많은 확장을 지원합니다. 확장에서 자동 업그레이드를 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "작업"
},
@@ -182,7 +182,7 @@
"description": "데이터 모니터링은 인시던트 해결의 핵심입니다. 포괄적인 모니터링 스택은 VM의 성능 및 상태에 대한 정보를 제공합니다. 인스턴스를 지속적으로 모니터링하면 성능 과부하 및 안정성 문제와 같은 오류에 대비하거나 예방할 수 있습니다.",
"guid": "4d2f720c-f0d3-4d39-9258-b212ca1c8a99",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) VM 인스턴스의 상태를 모니터링하고 측정합니다. 모니터 에이전트 확장을 VM에 배포하여 OS별 데이터 수집 규칙을 사용하여 게스트 OS에서 모니터링 데이터를 수집합니다. VM 인사이트를 사용하여 상태 및 성능을 모니터링하고 수집된 데이터에서 추세를 볼 수 있습니다. 부팅 진단을 사용하여 VM이 부팅될 때 정보를 가져옵니다. 부팅 진단은 부팅 실패도 진단합니다.",
+ "text": "(VM, 확장 집합) VM 인스턴스의 상태를 모니터링하고 측정합니다. Monitor 에이전트 확장을 VM에 배포하여 OS별 데이터 수집 규칙을 사용하여 게스트 OS에서 모니터링 데이터를 수집합니다. VM 인사이트를 사용하여 상태 및 성능을 모니터링하고 수집된 데이터에서 추세를 볼 수 있습니다. 부팅 진단을 사용하여 VM이 부팅될 때 정보를 가져옵니다. 부트 진단은 부트 실패도 진단합니다.",
"type": "recommendation",
"waf": "작업"
},
@@ -190,7 +190,7 @@
"description": "VM의 크기를 적절하게 조정하는 것은 워크로드의 성능에 큰 영향을 미치는 기본적인 결정입니다. 올바른 VM 집합이 없으면 성능 문제가 발생하고 불필요한 비용이 발생할 수 있습니다.",
"guid": "e6e6f3f5-7632-4f17-975e-7b35d09b38b4",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) 용량 계획에 맞는 VM에 대한 SKU를 선택합니다. 부적합한 SKU를 필터링할 수 있도록 코어 수, 메모리, 스토리지 및 네트워크 대역폭을 포함한 워크로드 요구 사항을 잘 이해해야 합니다.",
+ "text": "(VM, 확장 집합) 용량 계획에 맞는 VM용 SKU를 선택합니다. 부적합한 SKU를 필터링할 수 있도록 코어 수, 메모리, 스토리지 및 네트워크 대역폭을 포함한 워크로드 요구 사항을 잘 이해해야 합니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -203,7 +203,7 @@
"waf": "공연"
},
{
- "description": "프리미엄 SSD는 I/O 집약적 워크로드가 있는 고성능 및 짧은 대기 시간 디스크 지원 VM을 제공합니다. 프리미엄 SSD v2는 디스크 크기 조정이 필요하지 않으므로 과도한 오버 프로비저닝 없이 고성능을 가능하게 하고 사용되지 않는 용량 비용을 최소화합니다. VM SKU에서 사용할 수 있는 경우 로컬로 연결된 NVMe 또는 유사한 디바이스는 특히 높은 IOPS(초당 입력/출력 작업 수)와 짧은 대기 시간이 필요한 사용 사례에 대해 고성능을 제공할 수 있습니다.",
+ "description": "프리미엄 SSD는 I/O 집약적 워크로드가 있는 고성능 및 짧은 대기 시간 디스크 지원 VM을 제공합니다. 프리미엄 SSD v2는 디스크 크기 조정이 필요하지 않으므로 과도한 오버 프로비저닝 없이 고성능을 가능하게 하고 사용하지 않는 용량의 비용을 최소화합니다. VM SKU에서 사용할 수 있는 경우 로컬로 연결된 NVMe 또는 유사한 디바이스는 특히 높은 IOPS(초당 입력/출력 작업 수) 및 짧은 대기 시간이 필요한 사용 사례에 대해 고성능을 제공할 수 있습니다.",
"guid": "e0902a54-a13c-4831-8dbe-c013010044f4",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) 기존 워크로드 및 VM SKU의 디스크 성능을 분석하여 스토리지 프로필을 설정합니다. 프로덕션 VM에 프리미엄 SSD를 사용합니다. 프리미엄 SSD v2를 사용하여 디스크의 성능을 조정합니다. 로컬로 연결된 NVMe 디바이스를 사용합니다.",
@@ -211,7 +211,7 @@
"waf": "공연"
},
{
- "description": "VM에 대한 SR-IOV(단일 루트 I/O 가상화)를 가능하게 하여 네트워킹 성능을 크게 향상시킵니다.",
+ "description": "VM에 대한 SR-IOV(단일 루트 I/O 가상화)를 활성화하여 네트워킹 성능을 크게 향상시킵니다.",
"guid": "6118c905-4ae3-4a5d-918f-16c2b268934c",
"service": "Virtual Machines",
"text": "(가상 머신) 가속화된 네트워킹을 사용하도록 설정하는 것이 좋습니다.",
@@ -230,7 +230,7 @@
"metadata": {
"name": "Virtual Machines Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -257,31 +257,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/virtualmachines_sg_checklist.pt.json b/checklists-ext/virtualmachines_sg_checklist.pt.json
index 13c164cf0..ec7c25f90 100644
--- a/checklists-ext/virtualmachines_sg_checklist.pt.json
+++ b/checklists-ext/virtualmachines_sg_checklist.pt.json
@@ -230,7 +230,7 @@
"metadata": {
"name": "Virtual Machines Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -257,31 +257,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/virtualmachines_sg_checklist.zh-Hant.json b/checklists-ext/virtualmachines_sg_checklist.zh-Hant.json
index 8e9725921..d48160fb9 100644
--- a/checklists-ext/virtualmachines_sg_checklist.zh-Hant.json
+++ b/checklists-ext/virtualmachines_sg_checklist.zh-Hant.json
@@ -230,7 +230,7 @@
"metadata": {
"name": "Virtual Machines Service Guide",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -257,31 +257,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists-ext/wafsg_checklist.en.json b/checklists-ext/wafsg_checklist.en.json
index f08136c80..53e5bb11c 100644
--- a/checklists-ext/wafsg_checklist.en.json
+++ b/checklists-ext/wafsg_checklist.en.json
@@ -5237,6 +5237,6 @@
"name": "WAF Service Guides",
"waf": "all",
"state": "preview",
- "timestamp": "October 20, 2024"
+ "timestamp": "October 21, 2024"
}
}
\ No newline at end of file
diff --git a/checklists-ext/wafsg_checklist.es.json b/checklists-ext/wafsg_checklist.es.json
index adc5aeee4..903f3e000 100644
--- a/checklists-ext/wafsg_checklist.es.json
+++ b/checklists-ext/wafsg_checklist.es.json
@@ -14,7 +14,7 @@
"description": "",
"guid": "a67a6739-c1af-48d6-a3d1-001fb5105139",
"service": "App Service Web Apps",
- "text": "Anticipar posibles fallos: Planifique estrategias de mitigación para posibles errores. En la tabla siguiente se muestran ejemplos de análisis del modo de error.",
+ "text": "Anticipe posibles errores: planifique estrategias de mitigación para posibles errores. En la tabla siguiente se muestran ejemplos de análisis de modo de error.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -22,7 +22,7 @@
"description": "",
"guid": "b47d664a-75c8-4739-80d8-6cf9f60abb56",
"service": "App Service Web Apps",
- "text": "Cree redundancia: cree redundancia en la aplicación y en la infraestructura de soporte. Distribuya las instancias entre las zonas de disponibilidad para mejorar la tolerancia a errores. El tráfico se enruta a otras zonas si se produce un error en una zona. Implemente su aplicación en varias regiones para asegurarse de que su aplicación permanezca disponible, incluso si una región completa experimenta una interrupción.",
+ "text": "Cree redundancia: cree redundancia en la aplicación y la infraestructura de soporte. Distribuya las instancias entre las zonas de disponibilidad para mejorar la tolerancia a errores. El tráfico se enruta a otras zonas si se produce un error en una zona. Implemente su aplicación en varias regiones para asegurarse de que su aplicación permanezca disponible, incluso si una región completa experimenta una interrupción.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -30,7 +30,7 @@
"description": "",
"guid": "6b8fa1ed-cfa0-4435-9146-b3d1a8edb432",
"service": "App Service Web Apps",
- "text": "Tenga una estrategia de escalado confiable: la carga inesperada en una aplicación puede hacer que no sea confiable. Considere el enfoque de escalado adecuado en función de las características de su carga de trabajo. A veces se puede escalar verticalmente para controlar la carga. Sin embargo, si la carga sigue aumentando, escale horizontalmente a nuevas instancias. Prefiera el escalado automático en lugar de los enfoques manuales. Mantenga siempre un búfer de capacidad adicional durante las operaciones de escalado para evitar la degradación del rendimiento.",
+ "text": "Tenga una estrategia de escalado confiable: la carga inesperada en una aplicación puede hacer que no sea confiable. Considere el enfoque de escalado adecuado en función de las características de su carga de trabajo. A veces se puede escalar verticalmente para controlar la carga. Sin embargo, si la carga sigue aumentando, escale horizontalmente a nuevas instancias. Prefiera el escalado automático a los enfoques manuales. Mantenga siempre un búfer de capacidad adicional durante las operaciones de escalado para evitar la degradación del rendimiento.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -38,7 +38,7 @@
"description": "",
"guid": "ac7f205b-9117-4b49-8f22-9f31528dfdbd",
"service": "App Service Web Apps",
- "text": "Planifique su capacidad de recuperación: la redundancia es crucial para la continuidad del negocio. Conmutar por error a otra instancia si no se puede acceder a una instancia. Explore las capacidades de recuperación automática de App Service, como la reparación automática de instancias.",
+ "text": "Planifique su capacidad de recuperación: la redundancia es crucial para la continuidad del negocio. Conmutación por error a otra instancia si no se puede acceder a una instancia. Explore las capacidades de recuperación automática de App Service, como la reparación automática de instancias.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -54,7 +54,7 @@
"description": "",
"guid": "dcceb232-19d6-48dc-a91f-5b4907cc3dda",
"service": "App Service Web Apps",
- "text": "Uso de sondeos de estado para identificar a los trabajadores que no responden: App Service tiene funcionalidades integradas que hacen ping periódicamente a una ruta de acceso específica de la aplicación web. Las instancias que no responden se eliminan del equilibrador de carga y se reemplazan por una nueva instancia.",
+ "text": "Uso de sondeos de estado para identificar a los trabajadores que no responden: App Service tiene funcionalidades integradas que hacen ping periódicamente a una ruta de acceso específica de la aplicación web. Las instancias que no responden se eliminan del equilibrador de carga y se sustituyen por una nueva instancia.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -62,12 +62,12 @@
"description": "Un plan premium de App Service ofrece características de escalado avanzadas y garantiza la redundancia si se producen errores.",
"guid": "696fd187-e2a8-45e8-bbe7-a6d3cb1fca62",
"service": "App Service Web Apps",
- "text": "(Plan de App Service) Elija el nivel Premium de un plan de App Service para cargas de trabajo de producción. Establezca el número máximo y mínimo de trabajadores de acuerdo con su planificación de capacidad. Para obtener más información, consulte Introducción al plan de App Service.",
+ "text": "(Plan de App Service) Elija el nivel Premium de un plan de App Service para las cargas de trabajo de producción. Establezca el número máximo y mínimo de trabajadores de acuerdo con su planificación de capacidad. Para obtener más información, consulte Información general sobre el plan de App Service.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "La aplicación puede soportar errores en una sola zona cuando varias instancias se distribuyen entre zonas. El tráfico cambia automáticamente a instancias en buen estado en otras zonas y mantiene la confiabilidad de la aplicación si una zona no está disponible.",
+ "description": "La aplicación puede resistir errores en una sola zona cuando hay varias instancias distribuidas entre zonas. El tráfico cambia automáticamente a instancias en buen estado en otras zonas y mantiene la confiabilidad de la aplicación si una zona no está disponible.",
"guid": "830faa5e-7767-4526-8550-547a345dd398",
"service": "App Service Web Apps",
"text": "(Plan de App Service) Habilite la redundancia de zona. Considere la posibilidad de aprovisionar más de tres instancias para mejorar la tolerancia a errores. Compruebe la compatibilidad regional con la redundancia de zona, ya que no todas las regiones ofrecen esta característica.",
@@ -75,7 +75,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Las solicitudes entrantes se distribuyen uniformemente entre todos los nodos disponibles cuando se deshabilita la afinidad ARR. Las solicitudes distribuidas uniformemente evitan que el tráfico abrume a un solo nodo. Las solicitudes se pueden redirigir sin problemas a otros nodos en buen estado si un nodo no está disponible. Evite la afinidad de sesión para asegurarse de que la instancia de App Service permanezca sin estado. Un servicio de aplicaciones sin estado reduce la complejidad y garantiza un comportamiento coherente en todos los nodos. Quite las sesiones permanentes para que App Service pueda agregar o quitar instancias para escalar horizontalmente.",
+ "description": "Las solicitudes entrantes se distribuyen uniformemente entre todos los nodos disponibles cuando se deshabilita la afinidad de ARR. Las solicitudes distribuidas uniformemente evitan que el tráfico sature cualquier nodo individual. Las solicitudes se pueden redirigir sin problemas a otros nodos en buen estado si un nodo no está disponible. Evite la afinidad de sesión para asegurarse de que la instancia de App Service permanezca sin estado. Un servicio de aplicaciones sin estado reduce la complejidad y garantiza un comportamiento coherente en todos los nodos. Quite las sesiones permanentes para que App Service pueda agregar o quitar instancias para escalar horizontalmente.",
"guid": "3551bbd4-1f44-4bca-b25c-53e16f79cafe",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Considere la posibilidad de deshabilitar la característica de afinidad de enrutamiento de solicitudes de aplicación (ARR). La afinidad ARR crea sesiones permanentes que redirigen a los usuarios al nodo que manejó sus solicitudes anteriores.",
@@ -86,12 +86,12 @@
"description": "Las reglas de recuperación automática ayudan a la aplicación a recuperarse automáticamente de problemas inesperados. Las reglas configuradas desencadenan acciones de reparación cuando se superan los umbrales. La reparación automática permite un mantenimiento proactivo automático.",
"guid": "2a428ce1-dc25-4a1b-baf4-5edc909369fe",
"service": "App Service Web Apps",
- "text": "(Servicio de aplicaciones) Defina reglas de recuperación automática en función del recuento de solicitudes, las solicitudes lentas, los límites de memoria y otros indicadores que forman parte de la línea base de rendimiento. Considere esta configuración como parte de su estrategia de escalado.",
+ "text": "(Servicio de aplicaciones) Defina reglas de reparación automática en función del recuento de solicitudes, las solicitudes lentas, los límites de memoria y otros indicadores que forman parte de la línea base de rendimiento. Tenga en cuenta esta configuración como parte de su estrategia de escalado.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Las comprobaciones de estado pueden detectar problemas de forma temprana. A continuación, el sistema puede tomar automáticamente medidas correctivas cuando se produce un error en una solicitud de comprobación de estado. El equilibrador de carga enruta el tráfico lejos de las instancias en mal estado, lo que dirige a los usuarios a los nodos en buen estado.",
+ "description": "Las comprobaciones de estado pueden detectar problemas de forma temprana. A continuación, el sistema puede tomar medidas correctivas automáticamente cuando se produce un error en una solicitud de comprobación de estado. El equilibrador de carga enruta el tráfico lejos de las instancias en mal estado, lo que dirige a los usuarios a los nodos en buen estado.",
"guid": "4dd04acd-7d69-45b8-aa22-223c4ecc0a8c",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Habilite la característica de comprobación de estado y proporcione una ruta de acceso que responda a las solicitudes de comprobación de estado.",
@@ -102,7 +102,7 @@
"description": "",
"guid": "e13358d7-cf1a-4356-a8eb-afe901ca3b36",
"service": "App Service Web Apps",
- "text": "Revisión de las líneas base de seguridad: para mejorar la posición de seguridad de la aplicación hospedada en un plan de App Service, revise la línea base de seguridad para App Service.",
+ "text": "Revisión de las líneas base de seguridad: para mejorar la posición de seguridad de la aplicación hospedada en un plan del Servicio de aplicaciones, revise la línea base de seguridad del Servicio de aplicaciones.",
"type": "checklist",
"waf": "seguridad"
},
@@ -118,7 +118,7 @@
"description": "",
"guid": "469151fd-f51c-43ab-84f7-5d6c01e99fba",
"service": "App Service Web Apps",
- "text": "Creación de segmentación a través de límites de aislamiento para contener la infracción: Aplique la segmentación de identidad. Por ejemplo, implemente el control de acceso basado en roles (RBAC) para asignar permisos específicos en función de los roles. Siga el principio de privilegios mínimos para limitar los derechos de acceso solo a lo necesario. También cree segmentación a nivel de red. Inserte aplicaciones de App Service en una red virtual de Azure para el aislamiento y defina grupos de seguridad de red (NSG) para filtrar el tráfico.",
+ "text": "Crear segmentación a través de límites de aislamiento para contener la infracción: Aplique la segmentación de identidad. Por ejemplo, implemente el control de acceso basado en roles (RBAC) para asignar permisos específicos en función de los roles. Siga el principio de privilegios mínimos para limitar los derechos de acceso solo a lo necesario. También cree segmentación a nivel de red. Inserte aplicaciones de App Service en una red virtual de Azure para el aislamiento y defina grupos de seguridad de red (NSG) para filtrar el tráfico.",
"type": "checklist",
"waf": "seguridad"
},
@@ -126,7 +126,7 @@
"description": "",
"guid": "794e1680-facc-4258-89cb-a07f1fa6e4d0",
"service": "App Service Web Apps",
- "text": "Aplicar controles de acceso a las identidades: restrinja el acceso interno a la aplicación web y el acceso externo de la aplicación web a otros recursos. Esta configuración aplica controles de acceso a las identidades y ayuda a mantener la posición de seguridad general de la carga de trabajo.",
+ "text": "Aplicar controles de acceso a las identidades: restrinja el acceso interno a la aplicación web y el acceso externo desde la aplicación web a otros recursos. Esta configuración aplica controles de acceso a las identidades y ayuda a mantener la posición de seguridad general de la carga de trabajo.",
"type": "checklist",
"waf": "seguridad"
},
@@ -150,7 +150,7 @@
"description": "",
"guid": "410bf979-2e37-4dfc-82ba-33dc8e9fbbf0",
"service": "App Service Web Apps",
- "text": "Reduzca la superficie expuesta a ataques: elimine las configuraciones predeterminadas que no necesite. Por ejemplo, deshabilite la depuración remota, la autenticación local para los sitios del Administrador de control de código fuente (SCM) y la autenticación básica. Deshabilite los protocolos no seguros como HTTP y el Protocolo de transferencia de archivos (FTP). Aplique configuraciones a través de directivas de Azure. Para más información, consulte Directivas de Azure.",
+ "text": "Reduzca la superficie expuesta a ataques: elimine las configuraciones predeterminadas que no necesite. Por ejemplo, deshabilite la depuración remota, la autenticación local para los sitios del Administrador de control de código fuente (SCM) y la autenticación básica. Deshabilite los protocolos no seguros como HTTP y el Protocolo de transferencia de archivos (FTP). Aplicación de configuraciones a través de directivas de Azure. Para más información, consulte Directivas de Azure.",
"type": "checklist",
"waf": "seguridad"
},
@@ -158,7 +158,7 @@
"description": "",
"guid": "7157fe29-fe06-4c84-965d-8d450ac4bfe0",
"service": "App Service Web Apps",
- "text": "Proteja los secretos de las aplicaciones: debe manejar información confidencial, como claves de API o tokens de autenticación. En lugar de codificar estos secretos directamente en el código de la aplicación o en los archivos de configuración, puede usar referencias de Azure Key Vault en la configuración de la aplicación. Cuando se inicia la aplicación, App Service recupera automáticamente los valores secretos de Key Vault mediante la identidad administrada de la aplicación.",
+ "text": "Proteger los secretos de las aplicaciones: debe manejar información confidencial, como claves de API o tokens de autenticación. En lugar de codificar estos secretos directamente en el código de la aplicación o en los archivos de configuración, puede usar las referencias de Azure Key Vault en la configuración de la aplicación. Cuando se inicia la aplicación, App Service recupera automáticamente los valores secretos de Key Vault mediante la identidad administrada de la aplicación.",
"type": "checklist",
"waf": "seguridad"
},
@@ -166,7 +166,7 @@
"description": "",
"guid": "ae9e2e30-a31e-4459-ae31-fbcb8307016e",
"service": "App Service Web Apps",
- "text": "Habilite los registros de recursos para su aplicación: habilite los registros de recursos para su aplicación para crear registros de actividad completos que proporcionen datos valiosos durante las investigaciones que siguen a los incidentes de seguridad.",
+ "text": "Habilite los registros de recursos para su aplicación: habilite los registros de recursos para su aplicación para crear registros de actividad completos que proporcionen datos valiosos durante las investigaciones posteriores a los incidentes de seguridad.",
"type": "checklist",
"waf": "seguridad"
},
@@ -187,10 +187,10 @@
"waf": "Seguridad"
},
{
- "description": "Al usar esta característica, no es necesario usar bibliotecas de autenticación en el código de la aplicación, lo que reduce la complejidad. El usuario ya está autenticado cuando una solicitud llega a la aplicación.",
+ "description": "Al usar esta característica, no tiene que usar bibliotecas de autenticación en el código de la aplicación, lo que reduce la complejidad. El usuario ya está autenticado cuando una solicitud llega a la aplicación.",
"guid": "0e19e111-ccad-457f-94b5-ee2deebc553c",
"service": "App Service Web Apps",
- "text": "(App Service) evalúe si la autenticación integrada de App Service es el mecanismo adecuado para autenticar a los usuarios que acceden a la aplicación. La autenticación integrada de App Service se integra con el identificador de Microsoft Entra. Esta característica controla la validación de tokens y la administración de identidades de usuario en varios proveedores de inicio de sesión y es compatible con OpenID Connect. Con esta característica, no tiene autorización a nivel granular y no tiene un mecanismo para probar la autenticación.",
+ "text": "(App Service) evalúe si la autenticación integrada de App Service es el mecanismo adecuado para autenticar a los usuarios que acceden a la aplicación. La autenticación integrada de App Service se integra con el identificador de Microsoft Entra. Esta función controla la validación de tokens y la administración de identidades de usuario en varios proveedores de inicio de sesión y es compatible con OpenID Connect. Con esta característica, no tiene autorización a nivel granular y no tiene un mecanismo para probar la autenticación.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -230,7 +230,7 @@
"description": "El registro captura patrones de acceso. Registra eventos relevantes que proporcionan información valiosa sobre cómo interactúan los usuarios con una aplicación o plataforma. Esta información es crucial para fines de responsabilidad, cumplimiento y seguridad.",
"guid": "93a4781a-8e68-4ad4-af67-4ae28d534e6e",
"service": "App Service Web Apps",
- "text": "(Plan de App Service) Habilite el registro de diagnóstico y agregue instrumentación a su aplicación. Los registros se envían a cuentas de Azure Storage, Azure Event Hubs y Log Analytics. Para obtener más información sobre los tipos de registro de auditoría, consulte Tipos de registro compatibles.",
+ "text": "(Plan de App Service) Habilite el registro de diagnóstico y agregue instrumentación a la aplicación. Los registros se envían a las cuentas de Azure Storage, Azure Event Hubs y Log Analytics. Para obtener más información sobre los tipos de registro de auditoría, consulte Tipos de registro compatibles.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -254,7 +254,7 @@
"description": "",
"guid": "08ccd533-7d3f-438e-8274-a30d3e10d81e",
"service": "App Service Web Apps",
- "text": "Descripción de los medidores de uso: Azure cobra una tarifa por hora, prorrateada al segundo, en función del plan de tarifa de App Service. Los cargos se aplican a cada instancia escalada horizontalmente del plan, en función del tiempo que asigne a la instancia de VM. Preste atención a los recursos de proceso infrautilizados que podrían aumentar los costos como resultado de una asignación excesiva debido a una selección de SKU subóptima o a una configuración de reducción horizontal mal configurada.",
+ "text": "Descripción de los medidores de uso: Azure cobra una tarifa por hora, prorrateada por segundo, en función del plan de tarifa de App Service. Los cargos se aplican a cada instancia escalada horizontalmente del plan, en función del tiempo que asigne la instancia de VM. Preste atención a los recursos de proceso infrautilizados que podrían aumentar los costos como resultado de una asignación excesiva debido a una selección de SKU subóptima o a una configuración de reducción horizontal mal configurada.",
"type": "checklist",
"waf": "costar"
},
@@ -270,7 +270,7 @@
"description": "",
"guid": "19d66260-5bfe-466e-89b0-f2573223acf9",
"service": "App Service Web Apps",
- "text": "Evalúe el efecto de su estrategia de escalado en el costo: debe diseñar, probar y configurar correctamente el escalado horizontal y horizontal al implementar el escalado automático. Establezca límites máximos y mínimos precisos para el escalado automático.",
+ "text": "Evalúe el efecto de su estrategia de escalado en el costo: debe diseñar, probar y configurar correctamente el escalado horizontal y el escalado horizontal al implementar el escalado automático. Establezca límites máximos y mínimos precisos para el escalado automático.",
"type": "checklist",
"waf": "costar"
},
@@ -278,7 +278,7 @@
"description": "",
"guid": "b4798bde-d65a-4c44-a75e-e7c8c05df60e",
"service": "App Service Web Apps",
- "text": "Optimice los costos del entorno: considere el nivel Básico o Gratis para ejecutar entornos de preproducción. Estos niveles son de bajo rendimiento y bajo costo. Si utiliza el nivel Básico o Gratuito, utilice la gobernanza para aplicar el nivel, restringir el número de instancias y CPU, restringir el escalado y limitar la retención de registros.",
+ "text": "Optimice los costos del entorno: considere el nivel Básico o Gratuito para ejecutar entornos de preproducción. Estos niveles son de bajo rendimiento y bajo costo. Si utiliza el nivel Básico o Gratuito, utilice la gobernanza para aplicar el nivel, restringir el número de instancias y CPU, restringir el escalado y limitar la retención de registros.",
"type": "checklist",
"waf": "costar"
},
@@ -350,7 +350,7 @@
"description": "",
"guid": "751098a9-7103-4250-bd52-f48a5fbe8b73",
"service": "App Service Web Apps",
- "text": "Ejecute pruebas automatizadas: antes de promocionar una versión de su aplicación web, pruebe exhaustivamente su rendimiento, funcionalidad e integración con otros componentes. Use Azure Load Testing, que se integra con Apache JMeter, una herramienta popular para las pruebas de rendimiento. Explore herramientas automatizadas para otros tipos de pruebas, como Phantom para pruebas funcionales.",
+ "text": "Ejecute pruebas automatizadas: antes de promocionar una versión de su aplicación web, pruebe exhaustivamente su rendimiento, funcionalidad e integración con otros componentes. Use Azure Load Testing, que se integra con Apache JMeter, una herramienta popular para pruebas de rendimiento. Explore las herramientas automatizadas para otros tipos de pruebas, como Phantom para pruebas funcionales.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -366,7 +366,7 @@
"description": "",
"guid": "3175ebdb-2846-4f48-b450-278df163c188",
"service": "App Service Web Apps",
- "text": "Mantenga seguros los entornos de producción: cree planes de App Service independientes para ejecutar entornos de producción y preproducción. No realice cambios directamente en el entorno de producción para garantizar la estabilidad y la fiabilidad. Las instancias separadas permiten flexibilidad en el desarrollo y las pruebas antes de promover cambios en la producción.",
+ "text": "Mantenga seguros los entornos de producción: cree planes de App Service independientes para ejecutar entornos de producción y preproducción. No realice cambios directamente en el entorno de producción para garantizar la estabilidad y la fiabilidad. Las instancias independientes permiten flexibilidad en el desarrollo y las pruebas antes de promover cambios en la producción.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -390,12 +390,12 @@
"description": "Los registros de diagnóstico proporcionan información valiosa sobre el comportamiento de tu app. Supervise los patrones de tráfico e identifique anomalías.",
"guid": "91d861ad-a4ae-462e-8775-56cbecb31951",
"service": "App Service Web Apps",
- "text": "(Servicio de aplicaciones) Habilite los registros de diagnóstico para la aplicación y la instancia. El registro frecuente puede ralentizar el rendimiento del sistema, aumentar los costos de almacenamiento e introducir riesgos si tiene acceso no seguro a los registros. Siga estas prácticas recomendadas: - Registre el nivel correcto de información. - Establecer políticas de retención. - Mantenga un registro de auditoría de los accesos autorizados y los intentos no autorizados. - Tratar los registros como datos y aplicar controles de protección de datos.",
+ "text": "(Servicio de aplicaciones) Habilite los registros de diagnóstico para la aplicación y la instancia. El registro frecuente puede ralentizar el rendimiento del sistema, aumentar los costos de almacenamiento e introducir riesgos si tiene acceso no seguro a los registros. Siga estas prácticas recomendadas: - Registre el nivel correcto de información. - Establecer políticas de retención. - Mantener un registro de auditoría del acceso autorizado y los intentos no autorizados. - Tratar los registros como datos y aplicar controles de protección de datos.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "App Service controla automáticamente procesos como la adquisición de certificados, la verificación de certificados, la renovación de certificados y la importación de certificados de Key Vault. Como alternativa, cargue el certificado en Key Vault y autorice al proveedor de recursos de App Service a acceder a él.",
+ "description": "App Service controla automáticamente procesos como la adquisición de certificados, la verificación de certificados, la renovación de certificados y la importación de certificados desde Key Vault. Como alternativa, cargue el certificado en Key Vault y autorice al proveedor de recursos de App Service a acceder a él.",
"guid": "70e24ecc-5113-4d7d-8a79-8ac24fe1f838",
"service": "App Service Web Apps",
"text": "(Servicio de aplicaciones) Aproveche los certificados administrados de App Service para descargar la administración de certificaciones en Azure.",
@@ -422,7 +422,7 @@
"description": "",
"guid": "c66aabbd-8b2a-4295-9492-78cd5aea690a",
"service": "App Service Web Apps",
- "text": "Evaluar la capacidad: simule varios escenarios de usuario para determinar la capacidad óptima que necesita para manejar el tráfico esperado. Utilice las pruebas de carga para comprender cómo se comporta la aplicación bajo diferentes niveles de carga.",
+ "text": "Evaluar la capacidad: simule varios escenarios de usuario para determinar la capacidad óptima que necesita para controlar el tráfico esperado. Utilice las pruebas de carga para comprender cómo se comporta la aplicación en diferentes niveles de carga.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -446,7 +446,7 @@
"description": "",
"guid": "45d7e1a5-2b7e-4b6b-8925-bf0b760a9d7e",
"service": "App Service Web Apps",
- "text": "Usar el almacenamiento en caché: Recuperar información de un recurso que no cambia con frecuencia y cuyo acceso es costoso afecta al rendimiento. Las consultas complejas, incluidas las combinaciones y las búsquedas múltiples, contribuyen al tiempo de ejecución. Realice el almacenamiento en caché para minimizar el tiempo de procesamiento y la latencia. Almacene en caché los resultados de las consultas para evitar repetidos viajes de ida y vuelta a la base de datos o al back-end y reducir el tiempo de procesamiento de las solicitudes posteriores.",
+ "text": "Usar el almacenamiento en caché: la recuperación de información de un recurso que no cambia con frecuencia y cuyo acceso es costoso afecta al rendimiento. Las consultas complejas, incluidas las combinaciones y las búsquedas múltiples, contribuyen al tiempo de ejecución. Realice el almacenamiento en caché para minimizar el tiempo de procesamiento y la latencia. Caché los resultados de las consultas para evitar repetidos viajes de ida y vuelta a la base de datos o al back-end y reducir el tiempo de procesamiento de las solicitudes posteriores.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -462,7 +462,7 @@
"description": "La aplicación nunca se descarga con Always On habilitado.",
"guid": "2c97ff90-e7cd-4888-a0c9-c21ea287071c",
"service": "App Service Web Apps",
- "text": null,
+ "text": "Habilite la opción Siempre activo cuando las aplicaciones compartan un único plan de App Service. Las aplicaciones de App Service se descargan automáticamente cuando están inactivas para ahorrar recursos. La siguiente solicitud desencadena un inicio en frío, lo que puede provocar tiempos de espera de solicitud.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -470,495 +470,343 @@
"description": "Elija HTTP/2 en lugar de HTTP/1.1 porque HTTP/2 multiplexa completamente las conexiones, reutiliza las conexiones para reducir la sobrecarga y comprime los encabezados para minimizar la transferencia de datos.",
"guid": "d735fb9e-9e87-415c-93d0-4918b5cf104e",
"service": "App Service Web Apps",
- "text": "Considere la posibilidad de utilizar HTTP/2 para que las aplicaciones mejoren la eficiencia del protocolo.",
+ "text": "Considere la posibilidad de usar HTTP/2 para que las aplicaciones mejoren la eficiencia del protocolo.",
"type": "recommendation",
- "waf": null
+ "waf": "Rendimiento"
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "Azure Application Gateway",
- "text": "Implemente las instancias en una configuración con reconocimiento de zonas, cuando esté disponible.",
+ "text": "Use Application Gateway v2 en nuevas implementaciones, a menos que la carga de trabajo requiera específicamente Application Gateway v1.",
"type": "checklist",
"waf": "fiabilidad"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "Azure Application Gateway",
- "text": "Use Application Gateway con Web Application Firewall (WAF) dentro de una red virtual para proteger el tráfico entrante \"HTTP/S\" de Internet.",
+ "text": "Cree redundancia en su diseño. Distribuya instancias de Application Gateway entre zonas de disponibilidad para mejorar la tolerancia a errores y crear redundancia. El tráfico se dirige a otras zonas si se produce un error en una zona. Para obtener más información, consulte Recomendaciones para el uso de zonas de disponibilidad y regiones.",
"type": "checklist",
"waf": "fiabilidad"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "Azure Application Gateway",
- "text": "En las nuevas implementaciones, use Azure Application Gateway v2 a menos que haya una razón convincente para usar Azure Application Gateway v1.",
+ "text": "Planifique tiempo adicional para las actualizaciones de reglas y otros cambios de configuración antes de acceder a Application Gateway o realizar más cambios. Por ejemplo, es posible que necesite más tiempo para quitar servidores de un grupo de back-end porque tienen que purgar las conexiones existentes.",
"type": "checklist",
"waf": "fiabilidad"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "Azure Application Gateway",
- "text": null,
+ "text": "Implemente el patrón de supervisión de puntos de conexión de estado. La aplicación debe exponer puntos de conexión de estado, que agregan el estado de los servicios y dependencias críticos que la aplicación necesita para atender las solicitudes. Los sondeos de estado de Application Gateway usan el punto de conexión para detectar el estado de los servidores en el grupo de back-end. Para obtener más información, consulte Patrón de supervisión de puntos de conexión de estado.",
"type": "checklist",
"waf": "fiabilidad"
},
{
- "description": null,
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "Azure Application Gateway",
- "text": "Uso de sondeos de estado para detectar la falta de disponibilidad del back-end",
+ "text": "Evalúe el impacto de la configuración de intervalo y umbral en un sondeo de estado. El sondeo de estado envía solicitudes al punto de conexión configurado en un intervalo establecido. Y el back-end tolera un número limitado de solicitudes fallidas antes de que se marque como incorrecto. Estas configuraciones pueden entrar en conflicto, lo que presenta una compensación.",
"type": "checklist",
"waf": "fiabilidad"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "Azure Application Gateway",
- "text": "Revisión del impacto de la configuración de intervalo y umbral en los sondeos de estado",
+ "text": "Compruebe las dependencias de nivel inferior a través de los puntos de conexión de estado. Para aislar los errores, es posible que cada uno de los back-end tenga sus propias dependencias. Por ejemplo, una aplicación que se hospeda detrás de Application Gateway puede tener varios back-end y cada back-end se conecta a una base de datos o réplica diferente. Cuando se produce un error en una dependencia de este tipo, es posible que la aplicación funcione, pero no devuelva resultados válidos. Por ese motivo, lo ideal es que el punto de conexión de mantenimiento valide todas las dependencias.",
"type": "checklist",
- "waf": null
+ "waf": "fiabilidad"
},
{
- "description": null,
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "Azure Application Gateway",
- "text": "Comprobación de las dependencias de nivel inferior a través de puntos de conexión de estado",
+ "text": "Tenga en cuenta las limitaciones de Application Gateway y los problemas conocidos que podrían afectar a la confiabilidad. Revise las preguntas más frecuentes de Application Gateway para obtener información importante sobre el comportamiento por diseño, las correcciones en construcción, las limitaciones de la plataforma y las posibles soluciones alternativas o estrategias de mitigación. No use UDR en la subred dedicada de Application Gateway.",
"type": "checklist",
"waf": "fiabilidad"
},
{
- "description": "Planifique el tiempo suficiente para las actualizaciones antes de acceder a Application Gateway o realizar más cambios. Por ejemplo, la eliminación de servidores del grupo de back-end puede llevar algún tiempo porque tienen que purgar las conexiones existentes.",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "Azure Application Gateway",
- "text": "Planear las actualizaciones de las reglas",
- "type": "recommendation",
- "waf": "Fiabilidad"
+ "text": "Tenga en cuenta las limitaciones de puerto de traducción de direcciones de red de origen (SNAT) en el diseño que pueden afectar a las conexiones de back-end en Application Gateway. Algunos factores afectan a la forma en que Application Gateway alcanza el límite de puertos SNAT. Por ejemplo, si el back-end es una dirección IP pública, requiere su propio puerto SNAT. Para evitar las limitaciones del puerto SNAT, puede realizar una de las siguientes opciones:",
+ "type": "checklist",
+ "waf": "fiabilidad"
},
{
- "description": "Si Application Gateway se usa para equilibrar la carga del tráfico entrante en varias instancias de back-end, se recomienda el uso de sondeos de estado. Esto garantizará que el tráfico no se enrute a backends que no puedan manejar el tráfico.",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "Cuando se distribuyen varias instancias entre zonas, la carga de trabajo puede soportar errores en una sola zona. Si tiene una zona no disponible, el tráfico se desplaza automáticamente a instancias en buen estado en otras zonas, lo que mantiene la fiabilidad de la aplicación.",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "Azure Application Gateway",
- "text": "Uso de sondeos de estado para detectar la falta de disponibilidad del back-end",
+ "text": "Implemente instancias de Application Gateway en una configuración que tenga en cuenta las zonas. Compruebe la compatibilidad regional con la redundancia de zona, ya que no todas las regiones ofrecen esta característica.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "El sondeo de estado envía solicitudes al punto de conexión configurado en un intervalo establecido. Además, hay un umbral de solicitudes con errores que se tolerarán antes de que el back-end se marque como incorrecto. Estos números presentan una compensación.- Establecer un intervalo más alto pone una mayor carga en su servicio. Cada instancia de Application Gateway envía sus propios sondeos de estado, por lo que 100 instancias cada 30 segundos significa 100 solicitudes cada 30 segundos.- Establecer un intervalo inferior deja más tiempo antes de que se detecte una interrupción.- Establecer un umbral incorrecto bajo podría significar que errores breves y transitorios podrían derribar un back-end. - Al establecer un umbral alto, puede llevar más tiempo sacar un backend de la rotación.",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "Los sondeos de estado garantizan que el tráfico solo se dirija a los back-end que pueden controlar el tráfico. Application Gateway supervisa el estado de todos los servidores de su grupo de back-end y detiene automáticamente el envío de tráfico a cualquier servidor que considere incorrecto.",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "Azure Application Gateway",
- "text": "Revisión del impacto de la configuración de intervalo y umbral en los sondeos de estado",
+ "text": "Use sondeos de estado de Application Gateway para detectar la falta de disponibilidad del back-end.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": null,
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "Use la limitación de velocidad para evitar problemas como tormentas de reintentos.",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "Azure Application Gateway",
- "text": "Comprobación de las dependencias de nivel inferior a través de puntos de conexión de estado",
+ "text": "Configure reglas de limitación de velocidad para Azure WAF de modo que los clientes no puedan enviar demasiado tráfico a la aplicación.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Determinados escenarios pueden obligarle a implementar reglas específicamente en Application Gateway. Por ejemplo, si se requieren reglas ModSec CRS 2.2.9, CRS 3.0 o CRS 3.1, estas reglas solo se pueden implementar en Application Gateway. Por el contrario, la limitación de velocidad y el filtrado geográfico solo están disponibles en Azure Front Door, no en AppGateway.",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "Las unidades definidas por el usuario de la subred de Application Gateway pueden causar algunos problemas. No use UDR en la subred de Application Gateway para poder ver el estado del back-end, los registros y las métricas.",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "Azure Application Gateway",
- "text": "Al usar Azure Front Door y Application Gateway para proteger aplicaciones \"HTTP/S\", use directivas de WAF en Front Door y bloquee Application Gateway para recibir tráfico solo de Azure Front Door.",
+ "text": "No use UDR en Application Gateway para que el informe de estado de back-end funcione correctamente y genere los registros y las métricas correctos. Si debe usar una UDR en la subred de Application Gateway, consulte UDR admitidas.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "Establezca IdleTimeout para que coincida con el back-end. Esta configuración garantiza que la conexión entre Application Gateway y el cliente permanezca abierta si el back-end tarda más de cuatro minutos en responder a la solicitud. Si no configura esta opción, la conexión se cierra y el cliente no ve la respuesta de back-end.",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "Azure Application Gateway",
- "text": "Configuración de una política de TLS para mejorar la seguridad",
- "type": "checklist",
- "waf": "seguridad"
+ "text": "Configure las opciones de IdleTimeout para que coincidan con las características del agente de escucha y el tráfico de la aplicación back-end. El valor predeterminado es cuatro minutos. Puede configurarlo hasta un máximo de 30 minutos. Para obtener más información, consulte Restablecimiento del protocolo de control de transmisión (TCP) del equilibrador de carga y tiempo de espera de inactividad.",
+ "type": "recommendation",
+ "waf": "Fiabilidad"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "Azure Application Gateway",
- "text": "Uso de AppGateway para la terminación de TLS",
+ "text": "Revise la línea base de seguridad de Application Gateway.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "Azure Application Gateway",
- "text": "Uso de Azure Key Vault para almacenar certificados TLS",
+ "text": "Bloquee las amenazas comunes en el perímetro. WAF se integra con Application Gateway. Habilite las reglas de WAF en los front-end para proteger las aplicaciones de vulnerabilidades y exploits comunes en el perímetro de la red, que está cerca del origen del ataque. Para obtener más información, consulte WAF en Application Gateway.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "Azure Application Gateway",
- "text": "Al volver a cifrar el tráfico de backend, asegúrese de que el certificado del servidor de backend contenga las autoridades de certificación (CA) raíz e intermedias",
+ "text": "Permitir solo el acceso autorizado al plano de control. Use el control de acceso basado en roles (RBAC) de Application Gateway para restringir el acceso solo a las identidades que lo necesiten.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "Azure Application Gateway",
- "text": "Usar un servidor DNS adecuado para los recursos del grupo de back-end",
+ "text": "Proteja los datos en tránsito. Habilite la seguridad de la capa de transporte (TLS) de extremo a extremo, la terminación de TLS y el cifrado TLS de extremo a extremo. Cuando vuelva a cifrar el tráfico de back-end, asegúrese de que el certificado del servidor de back-end contenga las autoridades de certificación (CA) raíz e intermedias.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "Azure Application Gateway",
- "text": "Cumplimiento de todas las restricciones de NSG para Application Gateway",
+ "text": "Proteja los secretos de las aplicaciones. Use Azure Key Vault para almacenar certificados TLS a fin de aumentar la seguridad y facilitar el proceso de renovación y rotación de certificados.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "Azure Application Gateway",
- "text": "Abstenerse de usar UDR en la subred de Application Gateway",
+ "text": "Reducir la superficie de ataque y endurecer la configuración. Quite las configuraciones predeterminadas que no necesite y refuerce la configuración de Application Gateway para reforzar los controles de seguridad. Cumpla con todas las restricciones del grupo de seguridad de red (NSG) para Application Gateway.",
"type": "checklist",
"waf": "seguridad"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "Azure Application Gateway",
- "text": "Tenga en cuenta los cambios de capacidad de Application Gateway al habilitar WAF",
+ "text": "Supervisar la actividad anómala. Revise periódicamente los registros para comprobar si hay ataques y falsos positivos. Envíe registros de WAF desde Application Gateway a la administración centralizada de eventos e información de seguridad (SIEM) de su organización, como Microsoft Sentinel, para detectar patrones de amenazas e incorporar medidas preventivas en el diseño de la carga de trabajo.",
"type": "checklist",
"waf": "seguridad"
},
{
- "description": "Configure una política de TLS para mayor seguridad. Asegúrese de usar siempre la última versión de la política TLS disponible. Esto aplica TLS 1.2 y cifrados más seguros.",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "Azure Application Gateway",
- "text": "Configuración de una política de TLS para mejorar la seguridad",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Hay ventajas de usar Application Gateway para la terminación de TLS:- El rendimiento mejora porque las solicitudes que van a diferentes backends tienen que volver a autenticarse en cada backend.- Mejor utilización de los servidores de back-end porque no tienen que realizar el procesamiento de TLS.- Enrutamiento inteligente mediante el acceso al contenido de la solicitud.- Administración de certificados más fácil porque el certificado solo necesita instalarse en Application Gateway.",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
- "service": "Azure Application Gateway",
- "text": "Uso de AppGateway para la terminación de TLS",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Application Gateway se puede integrar con Key Vault. Esto proporciona una mayor seguridad, una separación más sencilla de roles y responsabilidades, compatibilidad con certificados administrados y un proceso de renovación y rotación de certificados más sencillo.",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
- "service": "Azure Application Gateway",
- "text": "Uso de Azure Key Vault para almacenar certificados TLS",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Un certificado TLS del servidor backend debe ser emitido por una CA conocida. Si el certificado no fue emitido por una entidad de certificación de confianza, Application Gateway comprueba si el certificado fue emitido por una entidad de certificación de confianza, y así sucesivamente, hasta que se encuentra un certificado de entidad de certificación de confianza. Solo entonces se establece una conexión segura. De lo contrario, Application Gateway marca el back-end como incorrecto.",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
- "service": "Azure Application Gateway",
- "text": "Al volver a cifrar el tráfico de backend, asegúrese de que el certificado del servidor de backend contenga las autoridades de certificación (CA) raíz e intermedias",
- "type": "recommendation",
- "waf": "Seguridad"
- },
- {
- "description": "Cuando el grupo de back-end contiene un FQDN que se puede resolver, la resolución de DNS se basa en una zona DNS privada o en un servidor DNS personalizado (si está configurado en la red virtual), o bien usa el DNS predeterminado proporcionado por Azure.",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "Utilice la política de TLS más reciente para exigir el uso de TLS 1.2 y cifrados más seguros. La política TLS incluye el control de la versión del protocolo TLS y los conjuntos de cifrado, así como el orden en el que un protocolo de enlace TLS utiliza cifrados.",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "Azure Application Gateway",
- "text": "Usar un servidor DNS adecuado para los recursos del grupo de back-end",
+ "text": "Configure una política TLS para mejorar la seguridad. Asegúrese de utilizar la versión más reciente de la política TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Los grupos de seguridad de red se admiten en la subred de Application Gateway, pero existen algunas restricciones. Por ejemplo, se prohíbe cierta comunicación con ciertos rangos de puertos. Asegúrese de comprender las implicaciones de esas restricciones. Para obtener más información, consulte Grupos de seguridad de red.",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "description": "El rendimiento mejora porque las solicitudes que van a diferentes back-end no tienen que volver a autenticarse en cada back-end. La puerta de enlace puede acceder al contenido de la solicitud y tomar decisiones de enrutamiento inteligentes. Solo tiene que instalar el certificado en Application Gateway, lo que simplifica la administración de certificados.",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "Azure Application Gateway",
- "text": "Cumplimiento de todas las restricciones de NSG para Application Gateway",
+ "text": "Use Application Gateway para la terminación de TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "El uso de rutas definidas por el usuario (UDR) en la subred de Application Gateway puede causar algunos problemas. Es posible que se desconozca el estado de mantenimiento en el back-end. Es posible que los registros y las métricas de Application Gateway no se generen. Se recomienda no usar UDR en la subred de Application Gateway para poder ver el estado, los registros y las métricas del back-end. Si las organizaciones necesitan usar UDR en la subred de Application Gateway, asegúrese de revisar los escenarios admitidos. Para obtener más información, consulte Rutas definidas por el usuario admitidas.",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
+ "description": "Este enfoque proporciona una seguridad más sólida, una separación más sencilla de roles y responsabilidades, compatibilidad con certificados administrados y un proceso de renovación y rotación de certificados más sencillo.",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "Azure Application Gateway",
- "text": "Abstenerse de usar UDR en la subred de Application Gateway",
+ "text": "Integre Application Gateway con Key Vault para almacenar certificados TLS.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Cuando WAF está habilitado, Application Gateway debe almacenar en búfer cada solicitud hasta que llegue por completo, comprueba si la solicitud coincide con alguna infracción de regla en su conjunto de reglas principal y, a continuación, reenvía el paquete a las instancias de back-end. Cuando hay cargas de archivos grandes (30 MB + de tamaño), puede resultar en una latencia significativa. Dado que los requisitos de capacidad de Application Gateway son diferentes con WAF, no se recomienda habilitar WAF en Application Gateway sin las pruebas y validaciones adecuadas.",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "description": "La subred de Application Gateway admite grupos de seguridad de red, pero existen algunas restricciones. Por ejemplo, está prohibida cierta comunicación con ciertos rangos de puertos. Asegúrese de comprender las implicaciones de esas restricciones.",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "Azure Application Gateway",
- "text": "Tenga en cuenta los cambios de capacidad de Application Gateway al habilitar WAF",
+ "text": "Cumpla con todas las restricciones de NSG para Application Gateway.",
"type": "recommendation",
"waf": "Seguridad"
},
{
"description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "Azure Application Gateway",
- "text": "Familiarícese con los precios de Application Gateway",
+ "text": "Familiarícese con los precios de Application Gateway y WAF. Elija opciones de tamaño adecuado para satisfacer la demanda de capacidad de su carga de trabajo y ofrecer el rendimiento esperado sin desperdiciar recursos. Para estimar los costos, use la calculadora de precios.",
"type": "checklist",
"waf": "costar"
},
{
"description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "Azure Application Gateway",
- "text": "Revisar los recursos infrautilizados",
+ "text": "Quite las instancias de Application Gateway no utilizadas y optimice las instancias infrautilizadas. Para evitar costos innecesarios, identifique y elimine las instancias de Application Gateway que tengan grupos de back-end vacíos. Detenga las instancias de Application Gateway cuando no estén en uso.",
"type": "checklist",
"waf": "costar"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "Azure Application Gateway",
- "text": "Detener instancias de Application Gateway que no están en uso",
+ "text": "Optimice el costo de escalado de la instancia de Application Gateway. Para optimizar su estrategia de escalado y reducir las demandas de su wokload, consulte Recomendaciones para optimizar el costo de escalado.",
"type": "checklist",
"waf": "costar"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "Azure Application Gateway",
- "text": "Tener una política de escalado horizontal y horizontal",
+ "text": "Supervise las métricas de consumo de Application Gateway y comprenda su impacto en los costos. Azure cobra por las instancias de uso medido de Application Gateway en función de las métricas de las que se realiza un seguimiento. Evalúe las distintas métricas y unidades de capacidad, y determine los factores de costo. Para obtener más información, consulte Microsoft Cost Management.",
"type": "checklist",
"waf": "costar"
},
{
- "description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
- "service": "Azure Application Gateway",
- "text": "Revisar las métricas de consumo en diferentes parámetros",
- "type": "checklist",
- "waf": "costar"
- },
- {
- "description": "Para obtener información sobre los precios de Application Gateway, consulte Descripción de los precios de Azure Application Gateway y Web Application Firewall. También puede aprovechar la calculadora de precios. Asegúrese de que las opciones tengan el tamaño adecuado para satisfacer la demanda de capacidad y ofrecer el rendimiento esperado sin desperdiciar recursos.",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Familiarícese con los precios de Application Gateway",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "Identifique y elimine instancias de Application Gateway con grupos de back-end vacíos para evitar costos innecesarios.",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "Azure Application Gateway",
- "text": "Revisar los recursos infrautilizados",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "No se le facturará cuando Application Gateway esté en estado detenido. La ejecución continua de instancias de Application Gateway puede incurrir en costos superfluos. Evalúe los patrones de uso y detenga las instancias cuando no las necesite. Por ejemplo, se espera que el uso fuera del horario comercial en entornos de desarrollo y pruebas sea bajo. Consulte estos artículos para obtener información sobre cómo detener e iniciar instancias.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "Azure Application Gateway",
- "text": "Detener instancias de Application Gateway cuando no estén en uso",
- "type": "recommendation",
- "waf": "Costar"
- },
- {
- "description": "Una política de escalado horizontal garantiza que habrá suficientes instancias para controlar el tráfico entrante y los picos. Además, tenga una política de reducción horizontal que garantice que el número de instancias se reduzca cuando disminuya la demanda. Tenga en cuenta la elección del tamaño de la instancia. El tamaño puede afectar significativamente el costo. Algunas consideraciones se describen en Estimación del recuento de instancias de Application Gateway. Para más información, consulte ¿Qué es Azure Application Gateway v2?",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "description": "Una instancia de Application Gateway detenida no genera costos. Las instancias de Application Gateway que se ejecutan continuamente pueden incurrir en costos innecesarios. Evalúe los patrones de uso y detenga las instancias cuando no las necesite. Por ejemplo, espere un uso bajo después del horario comercial en entornos de desarrollo y pruebas.",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "Azure Application Gateway",
- "text": "Tener una política de escalado horizontal y horizontal",
+ "text": "Detenga las instancias de Application Gateway cuando no estén en uso. Para obtener más información, vea Stop-AzApplicationGateway y Start-AzApplicationGateway.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Se le facturará en función de las instancias medidas de Application Gateway en función de las métricas rastreadas por Azure. Evalúe las distintas métricas y unidades de capacidad y determine los factores de coste. Para obtener más información, consulte Administración de costos y facturación de Microsoft. Las siguientes métricas son clave para Application Gateway. Esta información se puede usar para validar que el recuento de instancias aprovisionadas coincida con la cantidad de tráfico entrante.- Unidades de capacidad facturadas estimadas- Unidades de capacidad facturables fijas- Unidades de capacidad actualesPara obtener más información, consulte Métricas de Application Gateway. Asegúrese de tener en cuenta los costos de ancho de banda.",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "Utilice estas métricas para validar si el recuento de instancias aprovisionadas coincide con la cantidad de tráfico entrante y asegúrese de utilizar plenamente los recursos asignados.",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "Azure Application Gateway",
- "text": "Revisar las métricas de consumo en diferentes parámetros",
+ "text": "Supervise las métricas clave de Application Gateway que impulsan el costo, como: - Unidades de capacidad facturada estimadas. - Unidades fijas de capacidad facturable. - Unidades de capacidad actual. Asegúrese de tener en cuenta los costos de ancho de banda.",
"type": "recommendation",
"waf": "Costar"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "Supervisión de las métricas de capacidad",
- "type": "checklist",
- "waf": "Operaciones"
- },
- {
- "description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Habilitación de diagnósticos en Application Gateway y Web Application Firewall (WAF)",
- "type": "checklist",
- "waf": "Operaciones"
- },
- {
- "description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
- "service": "Azure Application Gateway",
- "text": "Uso de Azure Monitor Network Insights",
- "type": "checklist",
- "waf": "Operaciones"
- },
- {
- "description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "Azure Application Gateway",
- "text": "Hacer coincidir la configuración de tiempo de espera con la aplicación back-end",
+ "text": "Habilite los diagnósticos en Application Gateway y WAF. Recopile registros y métricas para poder supervisar el estado de la carga de trabajo, identificar tendencias en el rendimiento y la confiabilidad de la carga de trabajo y solucionar problemas. Para diseñar el enfoque de supervisión general, consulte Recomendaciones para diseñar y crear un sistema de supervisión.",
"type": "checklist",
"waf": "Operaciones"
},
{
"description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "Azure Application Gateway",
- "text": "Supervisión de problemas de configuración de Key Vault mediante Azure Advisor",
+ "text": "Use Azure Monitor Network Insights para obtener una vista completa del estado y las métricas de los recursos de red, incluida Application Gateway. Utilice la supervisión centralizada para identificar y resolver problemas rápidamente, optimizar el rendimiento y garantizar la fiabilidad de sus aplicaciones.",
"type": "checklist",
"waf": "Operaciones"
},
{
"description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "Azure Application Gateway",
- "text": "Configurar y supervisar las limitaciones de los puertos SNAT",
+ "text": "Supervisión de las recomendaciones de Application Gateway en Azure Advisor. Configure alertas para notificar a su equipo cuando tenga recomendaciones nuevas y críticas para la instancia de Application Gateway. Advisor genera recomendaciones basadas en propiedades, como la categoría, el nivel de impacto y el tipo de recomendación.",
"type": "checklist",
"waf": "Operaciones"
},
{
- "description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
- "service": "Azure Application Gateway",
- "text": "Tenga en cuenta las limitaciones de los puertos SNAT en el diseño",
- "type": "checklist",
- "waf": "Operaciones"
- },
- {
- "description": "Use estas métricas como indicadores de uso de la capacidad aprovisionada de Application Gateway. Recomendamos encarecidamente configurar alertas sobre la capacidad. Para obtener más información, consulte Compatibilidad con alto tráfico de Application Gateway.",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "Supervisión de las métricas de capacidad",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "Hay otras métricas que pueden indicar problemas en Application Gateway o en el back-end. Se recomienda evaluar las siguientes alertas:- Recuento de hosts incorrectos- Estado de respuesta (dimensión 4xx y 5xx)- Estado de respuesta de back-end (dimensión 4xx y 5xx)- Tiempo de respuesta del último byte de back-end- Tiempo total de Application GatewayPara obtener más información, consulte Métricas para Application Gateway.",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "Azure Application Gateway",
- "text": "Solución de problemas mediante métricas",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "Los registros de diagnóstico le permiten ver los registros de firewall, los registros de rendimiento y los registros de acceso. Use estos registros para administrar y solucionar problemas con las instancias de Application Gateway. Para obtener más información, consulte Registros de diagnóstico y estado de back-end para Application Gateway.",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Habilitación de diagnósticos en Application Gateway y Web Application Firewall (WAF)",
- "type": "recommendation",
- "waf": "Operaciones"
- },
- {
- "description": "Azure Monitor Network Insights proporciona una vista completa del estado y las métricas de los recursos de red, incluida Application Gateway. Para obtener más información y funcionalidades compatibles con Application Gateway, consulte Información de red de Azure Monitor.",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "description": "Establezca alertas cuando las métricas crucen los umbrales para saber cuándo aumenta su uso. Este enfoque garantiza que tenga tiempo suficiente para implementar los cambios necesarios en la carga de trabajo y evita la degradación o las interrupciones.",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "Azure Application Gateway",
- "text": "Uso de Azure Monitor Network Insights",
+ "text": "Configure alertas para notificar a su equipo cuando las métricas de capacidad, como el uso de CPU y el uso de unidades de proceso, superen los umbrales recomendados. Para configurar un conjunto completo de alertas basadas en métricas de capacidad, consulte Compatibilidad con el tráfico elevado de Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Asegúrese de que ha configurado la configuración de IdleTimeout para que coincida con las características de escucha y tráfico de la aplicación back-end. El valor predeterminado se establece en cuatro minutos y se puede configurar hasta un máximo de 30. Para obtener más información, consulte Restablecimiento de TCP del equilibrador de carga y tiempo de espera de inactividad.Para obtener consideraciones sobre la carga de trabajo, consulte Supervisión del estado de la aplicación para la confiabilidad.",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "Use alertas para ayudar a garantizar que su equipo pueda responder a los problemas de manera oportuna y facilitar la solución de problemas.",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "Azure Application Gateway",
- "text": "Hacer coincidir la configuración de tiempo de espera con la aplicación back-end",
+ "text": "Configure alertas para notificar a su equipo sobre las métricas que indican problemas en Application Gateway o en el back-end. Se recomienda evaluar las siguientes alertas:- Recuento de hosts incorrectos- Estado de respuesta, como errores 4xx y 5xx - Estado de respuesta de back-end, como errores 4xx y 5xx - Tiempo de respuesta del último byte de back-end- Tiempo total de Application GatewayPara obtener más información, consulte Métricas para Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Application Gateway comprueba la versión de certificado renovada en el almacén de claves vinculado cada intervalo de 4 horas. Si no se puede acceder a él debido a una configuración incorrecta de Key Vault, registra ese error y envía una recomendación de Advisor correspondiente. Debe configurar las alertas de Advisor para mantenerse actualizado y solucionar dichos problemas de inmediato para evitar problemas relacionados con el plano de control o de datos. Para obtener más información, consulte Investigación y resolución de errores de Key Vault. Para establecer una alerta para este caso específico, use el tipo de recomendación como Resolver problema de Azure Key Vault para Application Gateway.",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "description": "Use los registros para ayudar a detectar, investigar y solucionar problemas con las instancias de Application Gateway y la carga de trabajo.",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "Azure Application Gateway",
- "text": "Supervisión de problemas de configuración de Key Vault mediante Azure Advisor",
+ "text": "Habilite los registros de diagnóstico en Application Gateway y WAF para recopilar registros de firewall, registros de rendimiento y registros de acceso.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Las limitaciones del puerto SNAT son importantes para las conexiones de back-end en Application Gateway. Hay factores independientes que afectan a la forma en que Application Gateway alcanza el límite de puertos SNAT. Por ejemplo, si el backend es una dirección IP pública, requerirá su propio puerto SNAT. Para evitar las limitaciones del puerto SNAT, puede aumentar el número de instancias por Application Gateway, escalar horizontalmente los back-end para que tengan más direcciones IP o mover los back-end a la misma red virtual y usar direcciones IP privadas para los back-end. Las solicitudes por segundo (RPS) en Application Gateway se verán afectadas si se alcanza el límite de puertos SNAT. Por ejemplo, si una puerta de enlace de aplicaciones alcanza el límite de puertos SNAT, no podrá abrir una nueva conexión al back-end y se producirá un error en la solicitud.",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "Utilice las alertas de Advisor para mantenerse al día y solucionar problemas de inmediato. Evite cualquier problema relacionado con el plano de control o el plano de datos. Application Gateway comprueba la versión de certificado renovada en la instancia de Key Vault vinculada cada 4 horas. Si no se puede acceder a la versión del certificado debido a una configuración incorrecta de Key Vault, registra ese error e inserta una recomendación de Advisor correspondiente.",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "Azure Application Gateway",
- "text": "Tenga en cuenta las limitaciones de los puertos SNAT en el diseño",
+ "text": "Use Advisor para supervisar los problemas de configuración de Key Vault. Establezca una alerta para notificar a su equipo cuando reciba la recomendación que indica Resolver el problema de Azure Key Vault para Application Gateway.",
"type": "recommendation",
"waf": "Operaciones"
},
{
"description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
- "service": "Azure Application Gateway",
- "text": "Estimación del recuento de instancias de Application Gateway",
- "type": "checklist",
- "waf": "rendimiento"
- },
- {
- "description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "Definir el número máximo de instancias",
- "type": "checklist",
- "waf": "rendimiento"
- },
- {
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "Azure Application Gateway",
- "text": "Definir el número mínimo de instancias",
+ "text": "Calcule los requisitos de capacidad de Application Gateway para admitir los requisitos de carga de trabajo. Aproveche la funcionalidad de escalado automático de Application Gateway v2. Establezca los valores adecuados para el número mínimo y máximo de instancias. Dimensione correctamente la subred dedicada que requiere Application Gateway. Para obtener más información, consulte Recomendaciones para la planeación de la capacidad.",
"type": "checklist",
"waf": "rendimiento"
},
{
"description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "Azure Application Gateway",
- "text": "Definir el tamaño de la subred de Application Gateway",
+ "text": "Aproveche las características de escalado automático y beneficios de rendimiento. La SKU v2 ofrece escalado automático, que escala verticalmente Application Gateway a medida que aumenta el tráfico. En comparación con la SKU v1, la SKU v2 tiene funcionalidades que mejoran el rendimiento de la carga de trabajo. Por ejemplo, la SKU v2 tiene un mejor rendimiento de descarga de TLS, tiempos de implementación y actualización más rápidos y compatibilidad con redundancia de zona. Para obtener más información, consulte Escalado de Application Gateway v2 y WAF v2.",
"type": "checklist",
"waf": "rendimiento"
},
{
- "description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
+ "description": "En el caso de Application Gateway v2, el escalado automático tarda aproximadamente de seis a siete minutos antes de que el conjunto adicional de instancias esté listo para atender el tráfico. Durante ese tiempo, si Application Gateway tiene picos cortos en el tráfico, espere latencia transitoria o pérdida de tráfico.",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "Azure Application Gateway",
- "text": "Aproveche las características de Application Gateway V2 para obtener ventajas de rendimiento y escalado automático",
- "type": "checklist",
- "waf": "rendimiento"
- },
- {
- "description": "En el caso de la SKU de Application Gateway v2, el escalado automático tarda algún tiempo (aproximadamente de seis a siete minutos) antes de que el conjunto adicional de instancias esté listo para atender el tráfico. Durante ese tiempo, si hay picos cortos en el tráfico, espere latencia transitoria o pérdida de tráfico. Le recomendamos que establezca el número mínimo de instancias en un nivel óptimo. Después de calcular el número medio de instancias y determinar las tendencias de escalado automático de Application Gateway, defina el número mínimo de instancias en función de los patrones de la aplicación. Para obtener información, consulte Compatibilidad con el tráfico alto de Application Gateway. Compruebe las unidades de proceso actuales del último mes. Esta métrica representa la utilización de la CPU de la puerta de enlace. Para definir el número mínimo de instancias, divida el uso máximo por 10. Por ejemplo, si el promedio de unidades de proceso actuales en el último mes es de 50, establezca el recuento mínimo de instancias en cinco.",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "Definir el número mínimo de instancias",
- "type": "recommendation",
- "waf": "Rendimiento"
- },
- {
- "description": "Se recomienda 125 como número máximo de instancias de escalado automático. Asegúrese de que la subred que tiene Application Gateway tiene suficientes direcciones IP disponibles para admitir el conjunto de instancias de escalado vertical. Establecer el número máximo de instancias en 125 no tiene implicaciones de costo, ya que solo se le factura por la capacidad consumida.",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "Definir el número máximo de instancias",
+ "text": "Establezca el número mínimo de instancias en un nivel óptimo en función del recuento de instancias estimado, las tendencias reales de escalado automático de Application Gateway y los patrones de la aplicación. Compruebe las unidades de proceso actuales del mes pasado. Esta métrica representa el uso de CPU de la puerta de enlace. Para definir el número mínimo de instancias, divida el uso máximo por 10. Por ejemplo, si el promedio de unidades de proceso actuales en el último mes es de 50, establezca el recuento mínimo de instancias en cinco.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Application Gateway necesita una subred dedicada dentro de una red virtual. La subred puede tener varias instancias del recurso de Application Gateway implementado. También puede implementar otros recursos de Application Gateway en esa SKU de subred, v1 o v2. Estas son algunas consideraciones para definir el tamaño de la subred:- Application Gateway usa una dirección IP privada por instancia y otra dirección IP privada si se configura una IP front-end privada.- Azure reserva cinco direcciones IP en cada subred para uso interno.- Application Gateway (SKU estándar o WAF) puede admitir hasta 32 instancias. Tomando 32 direcciones IP de instancia + 1 IP de front-end privada + 5 reservadas de Azure, se recomienda un tamaño de subred mínimo de /26. Dado que la SKU de Standard_v2 o WAF_v2 puede admitir hasta 125 instancias, con el mismo cálculo, se recomienda un tamaño de subred de /24.- Si desea implementar recursos adicionales de Application Gateway en la misma subred, tenga en cuenta las direcciones IP adicionales que se requerirán para su recuento máximo de instancias tanto para Estándar como para Estándar v2.",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "Application Gateway se puede escalar horizontalmente según sea necesario para controlar el aumento del tráfico a las aplicaciones. Esta configuración no aumenta el costo, ya que solo paga por la capacidad consumida.",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "Azure Application Gateway",
- "text": "Definir el tamaño de la subred de Application Gateway",
+ "text": "Establezca el número máximo de instancias de escalado automático en el máximo posible, que es de 125 instancias. Asegúrese de que la subred dedicada de Application Gateway tenga suficientes direcciones IP disponibles para admitir el mayor conjunto de instancias.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "La SKU v2 ofrece escalado automático para garantizar que Application Gateway se pueda escalar verticalmente a medida que aumenta el tráfico. En comparación con la SKU v1, v2 tiene capacidades que mejoran el rendimiento de la carga de trabajo. Por ejemplo, un mejor rendimiento de descarga de TLS, tiempos de implementación y actualización más rápidos, redundancia de zona y más. Para obtener más información sobre las características de escalado automático, consulte Escalado de Application Gateway v2 y WAF v2. Si ejecuta la SKU de Application Gateway v1, considere la posibilidad de migrar a la SKU de Application Gateway v2. Para obtener más información, consulte Migración de Azure Application Gateway y Web Application Firewall de v1 a v2.",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
+ "description": "Use una subred /24 para proporcionar compatibilidad con todas las direcciones IP que necesite la implementación de Application Gateway v2. Application Gateway usa una dirección IP privada para cada instancia y otra dirección IP privada si configura una dirección IP de front-end privada. La SKU Standard_v2 o WAF_v2 puede admitir hasta 125 instancias. Azure reserva cinco direcciones IP en cada subred para uso interno.",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "Azure Application Gateway",
- "text": "Aproveche las características para el escalado automático y las ventajas de rendimiento",
+ "text": "Dimensione correctamente la subred dedicada de Application Gateway. Se recomienda encarecidamente una subred /24 para una implementación de Application Gateway v2. Si desea implementar otros recursos de Application Gateway en la misma subred, tenga en cuenta las direcciones IP adicionales que necesita para el recuento máximo de instancias. Para obtener más consideraciones sobre el tamaño de la subred, consulte Configuración de la infraestructura de Application Gateway.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -966,7 +814,7 @@
"description": "",
"guid": "d68b4fc0-fd9c-499a-9fd4-2c572735bd36",
"service": "Azure Blob Storage",
- "text": "Use el análisis del modo de error: minimice los puntos de error teniendo en cuenta las dependencias internas, como la disponibilidad de redes virtuales, Azure Key Vault, Azure Content Delivery Network o Azure Front Door, puntos de conexión. Se pueden producir errores si las credenciales necesarias para que las cargas de trabajo accedan a Blob Storage desaparecen de Key Vault o si las cargas de trabajo usan un punto de conexión basado en una red de entrega de contenido que se quita. En estos casos, es posible que las cargas de trabajo deban usar un punto de conexión alternativo para conectarse. Para obtener información general sobre el análisis del modo de error, consulte Recomendaciones para realizar el análisis del modo de error.",
+ "text": "Use el análisis del modo de error: minimice los puntos de error teniendo en cuenta las dependencias internas, como la disponibilidad de redes virtuales, Azure Key Vault, Azure Content Delivery Network o Azure Front Door, puntos de conexión de Azure Front Door. Se pueden producir errores si las credenciales necesarias para que las cargas de trabajo accedan a Blob Storage desaparecen de Key Vault o si las cargas de trabajo usan un punto de conexión basado en una red de entrega de contenido que se quita. En estos casos, es posible que las cargas de trabajo deban usar un punto de conexión alternativo para conectarse. Para obtener información general sobre el análisis del modo de error, consulte Recomendaciones para realizar el análisis del modo de error.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -990,7 +838,7 @@
"description": "",
"guid": "e71dbbd7-5e50-4ade-b5e5-4b9e59d10706",
"service": "Azure Blob Storage",
- "text": "Aplicaciones de diseño: diseñe aplicaciones para que cambien sin problemas a la lectura de datos de la región secundaria si la región primaria deja de estar disponible por cualquier motivo. Esto solo se aplica a las configuraciones de almacenamiento con redundancia geográfica (GRS) y almacenamiento con redundancia de zona geográfica (GZRS). El diseño de aplicaciones para manejar interrupciones reduce el tiempo de inactividad para los usuarios finales.",
+ "text": "Aplicaciones de diseño: diseñe aplicaciones para cambiar sin problemas a la lectura de datos de la región secundaria si la región primaria deja de estar disponible por cualquier motivo. Esto solo se aplica a las configuraciones de almacenamiento con redundancia geográfica (GRS) y almacenamiento con redundancia de zona geográfica (GZRS). El diseño de aplicaciones para manejar interrupciones reduce el tiempo de inactividad para los usuarios finales.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -998,7 +846,7 @@
"description": "",
"guid": "2243ff8e-7ce3-4999-9eee-3b3377f4df8b",
"service": "Azure Blob Storage",
- "text": "Explore las características que le ayudarán a cumplir sus objetivos de recuperación: Haga que los blobs se puedan restaurar para que se puedan recuperar si se dañan, editan o eliminan por error.",
+ "text": "Explore las características que le ayudarán a cumplir sus objetivos de recuperación: haga que los blobs se puedan restaurar para que se puedan recuperar si se dañan, editan o eliminan por error.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1006,7 +854,7 @@
"description": "",
"guid": "3a9677e5-9506-4aaa-bac6-48b5002070c1",
"service": "Azure Blob Storage",
- "text": "Cree un plan de recuperación: considere las características de protección de datos, las operaciones de copia de seguridad y restauración o los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e inconsistencias en los datos, así como para el tiempo y el costo de la conmutación por error. Para obtener más información, consulte Recomendaciones para diseñar una estrategia de recuperación ante desastres.",
+ "text": "Cree un plan de recuperación: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración o los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e incoherencias de datos, así como para el tiempo y el costo de la conmutación por error. Para obtener más información, consulte Recomendaciones para diseñar una estrategia de recuperación ante desastres.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1035,10 +883,10 @@
"waf": "Fiabilidad"
},
{
- "description": "La opción de eliminación temporal permite que una cuenta de almacenamiento recupere contenedores y blobs eliminados. La opción de control de versiones realiza automáticamente un seguimiento de los cambios realizados en los blobs. Esta opción permite restaurar un blob a un estado anterior. La opción de restauración a un momento dado protege contra la eliminación accidental o los daños de blobs y permite restaurar los datos de blobs en bloques a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
+ "description": "La opción de eliminación temporal permite que una cuenta de almacenamiento recupere contenedores y blobs eliminados. La opción de control de versiones realiza automáticamente un seguimiento de los cambios realizados en los blobs. Esta opción permite restaurar un blob a un estado anterior. La opción de restauración a un momento dado protege contra la eliminación accidental de blobs o daños y permite restaurar los datos de blobs en bloques a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
"guid": "6ba14c6a-6f37-46a3-a2a8-e38373925d6f",
"service": "Azure Blob Storage",
- "text": "Como parte de la estrategia de copia de seguridad y recuperación, habilite las opciones de eliminación temporal de contenedores, eliminación temporal de blobs, control de versiones y restauración a un momento dado.",
+ "text": "Como parte de la estrategia de copia de seguridad y recuperación, habilite las opciones de eliminación temporal de contenedor, eliminación temporal de blobs, control de versiones y restauración a un momento dado.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -1054,7 +902,7 @@
"description": "",
"guid": "54dc05f5-631d-41ac-8ad7-40a451e48efd",
"service": "Azure Blob Storage",
- "text": "Uso de controles de red para restringir el tráfico de entrada y salida: deshabilite todo el tráfico público a la cuenta de almacenamiento. Utilice los controles de red de la cuenta para conceder el nivel mínimo de acceso requerido por los usuarios y las aplicaciones. Para obtener más información, consulte Cómo abordar la seguridad de red para la cuenta de almacenamiento.",
+ "text": "Uso de controles de red para restringir el tráfico de entrada y salida: deshabilite todo el tráfico público a la cuenta de almacenamiento. Utilice los controles de red de cuentas para conceder el nivel mínimo de acceso requerido por los usuarios y las aplicaciones. Para obtener más información, consulte Cómo abordar la seguridad de red para la cuenta de almacenamiento.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1062,7 +910,7 @@
"description": "",
"guid": "3d39bc4a-58c1-4d69-8116-751252d03104",
"service": "Azure Blob Storage",
- "text": "Reducir la superficie de ataque: Evitar el acceso anónimo, el acceso a claves de cuenta o el acceso a través de conexiones no seguras (HTTP) puede reducir la superficie de ataque. Exigir a los clientes que envíen y reciban datos mediante la versión más reciente del protocolo de seguridad de la capa de transporte (TLS).",
+ "text": "Reducir la superficie de ataque: impedir el acceso anónimo, el acceso a claves de cuenta o el acceso a través de conexiones no seguras (HTTP) puede reducir la superficie de ataque. Requerir que los clientes envíen y reciban datos mediante la versión más reciente del protocolo de seguridad de la capa de transporte (TLS).",
"type": "checklist",
"waf": "seguridad"
},
@@ -1086,7 +934,7 @@
"description": "",
"guid": "cd6916c2-09f8-4269-971d-60a07e57cbbd",
"service": "Azure Blob Storage",
- "text": "Habilitar la opción de transferencia segura requerida: la habilitación de esta configuración para todas las cuentas de almacenamiento garantiza que todas las solicitudes realizadas en la cuenta de almacenamiento se realicen a través de conexiones seguras. Se produce un error en las solicitudes realizadas a través de HTTP.",
+ "text": "Habilitar la opción de transferencia segura requerida: al habilitar esta configuración para todas las cuentas de almacenamiento, se garantiza que todas las solicitudes realizadas en la cuenta de almacenamiento se realicen a través de conexiones seguras. Se produce un error en todas las solicitudes realizadas a través de HTTP.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1094,7 +942,7 @@
"description": "",
"guid": "f944c199-636d-46b4-bc23-ee8bdfefa7a5",
"service": "Azure Blob Storage",
- "text": "Proteger objetos críticos: aplique políticas de inmutabilidad para proteger objetos críticos. Las directivas protegen los blobs que se almacenan con fines legales, de cumplimiento u otros fines empresariales para que no se modifiquen o eliminen. Configure retenciones durante períodos de tiempo establecidos o hasta que un administrador levante las restricciones.",
+ "text": "Proteger objetos críticos: aplique políticas de inmutabilidad para proteger objetos críticos. Las directivas protegen los blobs que se almacenan con fines legales, de cumplimiento u otros fines empresariales para que no se modifiquen o eliminen. Configure las retenciones durante períodos de tiempo establecidos o hasta que un administrador levante las restricciones.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1102,7 +950,7 @@
"description": "",
"guid": "80a10cbe-93f3-410a-b7ad-d7b5234add61",
"service": "Azure Blob Storage",
- "text": "Detección de amenazas: habilite Microsoft Defender para Storage para detectar amenazas. Las alertas de seguridad se activan cuando se producen anomalías en la actividad. Las alertas notifican a los administradores de suscripciones por correo electrónico con detalles de actividad sospechosa y recomendaciones sobre cómo investigar y remediar las amenazas.",
+ "text": "Detección de amenazas: habilite Microsoft Defender para Storage para detectar amenazas. Las alertas de seguridad se activan cuando se producen anomalías en la actividad. Las alertas notifican a los administradores de suscripciones por correo electrónico con detalles de actividades sospechosas y recomendaciones sobre cómo investigar y corregir amenazas.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1139,10 +987,10 @@
"waf": "Seguridad"
},
{
- "description": "Solo se permiten las solicitudes protegidas autorizadas con el identificador de Microsoft Entra.",
+ "description": "Solo se permiten las solicitudes protegidas que están autorizadas con el identificador de Microsoft Entra.",
"guid": "4d731629-d6d3-4aa9-b46f-6259451f08f0",
"service": "Azure Blob Storage",
- "text": "No permitir la autorización de clave compartida. Esto deshabilita no solo el acceso a la clave de cuenta, sino también a los tokens de firma de acceso compartido de cuenta y servicio, ya que se basan en claves de cuenta.",
+ "text": "No permitir la autorización de clave compartida. Esto deshabilita no solo el acceso a la clave de cuenta, sino también los tokens de firma de acceso compartido de cuenta y servicio, ya que se basan en claves de cuenta.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -1158,7 +1006,7 @@
"description": "Las prácticas recomendadas pueden ayudarle a evitar que se filtre un token de firma de acceso compartido y a recuperarse rápidamente si se produce una fuga.",
"guid": "e2163930-a35e-415f-bea3-a019e5c2a5c7",
"service": "Azure Blob Storage",
- "text": "Se recomienda no usar tokens de firma de acceso compartido. Evalúe si necesita tokens de firma de acceso compartido para proteger el acceso a los recursos de Blob Storage. Si debe crear una, revise esta lista de prácticas recomendadas para firmas de acceso compartido antes de crearla y distribuirla.",
+ "text": "Se recomienda no usar tokens de firma de acceso compartido. Evalúe si necesita tokens de firma de acceso compartido para proteger el acceso a los recursos de Blob Storage. Si debe crear una, revise esta lista de prácticas recomendadas para la firma de acceso compartido antes de crearla y distribuirla.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -1171,7 +1019,7 @@
"waf": "Seguridad"
},
{
- "description": "Las claves administradas por el cliente proporcionan una mayor flexibilidad y control. Por ejemplo, puede almacenar claves de cifrado en Key Vault y rotarlas automáticamente.",
+ "description": "Las claves administradas por el cliente proporcionan mayor flexibilidad y control. Por ejemplo, puede almacenar claves de cifrado en Key Vault y rotarlas automáticamente.",
"guid": "33303cd1-5b9c-4688-aa24-50cb53f5caac",
"service": "Azure Blob Storage",
"text": "Considere la posibilidad de usar su propia clave de cifrado para proteger los datos de la cuenta de almacenamiento. Para más información, consulte Claves administradas por el cliente para el cifrado de Azure Storage.",
@@ -1190,7 +1038,7 @@
"description": "",
"guid": "0c2e2825-34c7-4ad5-ad21-a270b1b402c0",
"service": "Azure Blob Storage",
- "text": "Comprenda el precio de cada medidor: asegúrese de usar la página de precios adecuada y aplicar la configuración adecuada en esa página. Para obtener más información, consulte Búsqueda del precio unitario de cada medidor. Tenga en cuenta el número de operaciones asociadas a cada precio. Por ejemplo, el precio asociado a las operaciones de escritura y lectura se aplica a 10.000 operaciones. Para determinar el precio de una operación individual, divida el precio de lista por 10.000.",
+ "text": "Comprenda el precio de cada medidor: asegúrese de usar la página de precios adecuada y aplique la configuración adecuada en esa página. Para obtener más información, consulte Búsqueda del precio unitario de cada medidor. Tenga en cuenta el número de operaciones asociadas a cada precio. Por ejemplo, el precio asociado a las operaciones de escritura y lectura se aplica a 10.000 operaciones. Para determinar el precio de una operación individual, divida el precio de lista por 10.000.",
"type": "checklist",
"waf": "costar"
},
@@ -1198,7 +1046,7 @@
"description": "",
"guid": "31b047a5-abfe-4452-ad3e-a4b99cad0e4b",
"service": "Azure Blob Storage",
- "text": "Calcule el costo de la capacidad y las operaciones: puede modelar los costos asociados con el almacenamiento, la entrada y la salida de datos mediante la calculadora de precios de Azure. Utilice campos para comparar el costo asociado con varias regiones, tipos de cuenta, tipos de espacio de nombres y configuraciones de redundancia. Para determinados escenarios, puede usar cálculos de ejemplo y hojas de cálculo disponibles en la documentación de Microsoft. Por ejemplo, puede calcular el costo de archivar datos o calcular el costo de usar el comando AzCopy para transferir blobs.",
+ "text": "Calcular el costo de la capacidad y las operaciones: puede modelar los costos asociados con el almacenamiento, la entrada y la salida de datos mediante la calculadora de precios de Azure. Utilice campos para comparar el costo asociado con varias regiones, tipos de cuenta, tipos de espacios de nombres y configuraciones de redundancia. Para determinados escenarios, puede usar cálculos de ejemplo y hojas de cálculo disponibles en la documentación de Microsoft. Por ejemplo, puede calcular el costo de archivar datos o calcular el costo de usar el comando AzCopy para transferir blobs.",
"type": "checklist",
"waf": "costar"
},
@@ -1222,7 +1070,7 @@
"description": "",
"guid": "b675b5be-352c-4a06-94ed-8457e3d5db8c",
"service": "Azure Blob Storage",
- "text": "Elija el nivel de acceso predeterminado más rentable: a menos que se especifique un nivel con cada carga de blobs, los blobs deducen su nivel de acceso de la configuración predeterminada del nivel de acceso. Un cambio en la configuración del nivel de acceso predeterminado de una cuenta de almacenamiento se aplica a todos los blobs de la cuenta para los que no se ha establecido explícitamente un nivel de acceso. Este costo podría ser significativo si ha recopilado un gran número de blobs. Para obtener más información sobre cómo afecta un cambio de nivel a cada blob existente, consulte Cambiar el nivel de acceso de un blob.",
+ "text": "Elija el nivel de acceso predeterminado más rentable: a menos que se especifique un nivel con cada carga de blobs, los blobs deducen su nivel de acceso a partir de la configuración del nivel de acceso predeterminado. Un cambio en la configuración del nivel de acceso predeterminado de una cuenta de almacenamiento se aplica a todos los blobs de la cuenta para los que no se ha establecido explícitamente un nivel de acceso. Este costo podría ser significativo si ha recopilado un gran número de blobs. Para obtener más información sobre cómo afecta un cambio de nivel a cada blob existente, consulte Cambio del nivel de acceso de un blob.",
"type": "checklist",
"waf": "costar"
},
@@ -1246,7 +1094,7 @@
"description": "",
"guid": "df99152b-4af1-4cea-b2bd-b06fd2425c57",
"service": "Azure Blob Storage",
- "text": "Decida qué características necesita: algunas características, como el control de versiones y la eliminación temporal de blobs, incurren en costos de transacción y capacidad adicionales, así como en otros cargos. Asegúrese de revisar las secciones de precios y facturación de los artículos que describen esas capacidades cuando elija qué capacidades agregar a su cuenta.",
+ "text": "Decida qué características necesita: algunas características, como el control de versiones y la eliminación temporal de blobs, incurren en costos de transacción y capacidad adicionales, así como en otros cargos. Asegúrese de revisar las secciones de precios y facturación en los artículos que describen esas capacidades cuando elija qué capacidades agregar a su cuenta.",
"type": "checklist",
"waf": "costar"
},
@@ -1270,12 +1118,12 @@
"description": "",
"guid": "94b3fa52-a17f-44ec-b4ba-9801c2764632",
"service": "Azure Blob Storage",
- "text": "Supervise el uso: supervise continuamente los patrones de uso y detecte cuentas y contenedores no utilizados o infrautilizados. Use la información de almacenamiento para identificar cuentas con un uso bajo o nulo. Habilite los informes de inventario de blobs y use herramientas como Azure Databricks o Azure Synapse Analytics y Power BI para analizar los datos de costos. Esté atento a los aumentos inesperados de la capacidad, lo que podría indicar que está recopilando numerosos archivos de registro, versiones de blobs o blobs eliminados temporalmente. Desarrolle una estrategia para caducar o hacer la transición de objetos a niveles de acceso más rentables. Tenga un plan para los objetos que caducan o los que los mueve a niveles de acceso más asequibles.",
+ "text": "Supervise el uso: supervise continuamente los patrones de uso y detecte cuentas y contenedores no utilizados o infrautilizados. Use la información de almacenamiento para identificar cuentas sin uso o con poco uso. Habilite los informes de inventario de blobs y use herramientas como Azure Databricks o Azure Synapse Analytics y Power BI para analizar los datos de costos. Esté atento a los aumentos inesperados de la capacidad, lo que podría indicar que está recopilando numerosos archivos de registro, versiones de blobs o blobs eliminados temporalmente. Desarrolle una estrategia para la caducidad o la transición de objetos a niveles de acceso más rentables. Tenga un plan para los objetos que caducan o los que los mueve a niveles de acceso más asequibles.",
"type": "checklist",
"waf": "costar"
},
{
- "description": "Los niveles más esporádicos tienen costos de transferencia de datos más altos. Al tener menos archivos grandes, puede reducir el número de operaciones necesarias para transferir datos.",
+ "description": "Los niveles de esporádico tienen costos de transferencia de datos más altos. Al tener menos archivos grandes, puede reducir el número de operaciones necesarias para transferir datos.",
"guid": "7eb7a0d4-912b-4d5c-af98-31200e20cc63",
"service": "Azure Blob Storage",
"text": "Empaqueta archivos pequeños en archivos más grandes antes de moverlos a niveles más esporádicos. Puede utilizar formatos de archivo como TAR o ZIP.",
@@ -1294,7 +1142,7 @@
"description": "Almacenar registros de recursos en una cuenta de almacenamiento para su posterior análisis puede ser una opción más económica. El uso de directivas de administración del ciclo de vida para administrar la retención de registros en una cuenta de almacenamiento evita que se acumule un gran número de archivos de registros con el tiempo, lo que puede provocar cargos de capacidad innecesarios.",
"guid": "f29291b5-d170-453b-bdbb-379f229fdc5b",
"service": "Azure Blob Storage",
- "text": "Reduzca el costo del uso de registros de recursos eligiendo la ubicación de almacenamiento de registros adecuada y administrando los períodos de retención de registros. Si solo planea consultar registros ocasionalmente (por ejemplo, consultar registros para auditoría de cumplimiento), considere la posibilidad de enviar registros de recursos a una cuenta de almacenamiento en lugar de enviarlos a un área de trabajo de registros de Azure Monitor. Puede usar una solución de consulta sin servidor, como Azure Synapse Analytics, para analizar los registros. Para obtener más información, consulte Optimización del costo para consultas poco frecuentes. Utilice políticas de administración del ciclo de vida para eliminar o archivar registros.",
+ "text": "Reduzca el costo del uso de registros de recursos eligiendo la ubicación de almacenamiento de registros adecuada y administrando los períodos de retención de registros. Si solo planea consultar registros ocasionalmente (por ejemplo, consultar registros para auditoría de cumplimiento), considere la posibilidad de enviar registros de recursos a una cuenta de almacenamiento en lugar de enviarlos a un área de trabajo de registros de Azure Monitor. Puede usar una solución de consulta sin servidor, como Azure Synapse Analytics, para analizar los registros. Para obtener más información, consulte Optimizar el costo de las consultas poco frecuentes. Utilice las políticas de administración del ciclo de vida para eliminar o archivar registros.",
"type": "recommendation",
"waf": "Costar"
},
@@ -1307,7 +1155,7 @@
"waf": "Costar"
},
{
- "description": "Cada vez que se sobrescribe un blob, se agrega una nueva versión, lo que aumenta los cargos por capacidad de almacenamiento. Para reducir los cargos de capacidad, almacene los datos sobrescritos con frecuencia en una cuenta de almacenamiento independiente con el control de versiones deshabilitado.",
+ "description": "Cada vez que se sobrescribe un blob, se agrega una nueva versión, lo que provoca un aumento de los cargos por capacidad de almacenamiento. Para reducir los cargos de capacidad, almacene los datos que se sobrescriben con frecuencia en una cuenta de almacenamiento independiente con el control de versiones deshabilitado.",
"guid": "91514322-4007-4a99-85f0-e73c181d95fa",
"service": "Azure Blob Storage",
"text": "Si habilita el control de versiones, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitado el control de versiones.",
@@ -1315,10 +1163,10 @@
"waf": "Costar"
},
{
- "description": "Cada vez que se sobrescribe un blob, se crea una nueva instantánea. La causa del aumento de los cargos por capacidad puede ser difícil de acceder porque la creación de estas instantáneas no aparece en los registros. Para reducir los cargos de capacidad, almacene los datos sobrescritos con frecuencia en una cuenta de almacenamiento independiente con la eliminación temporal deshabilitada. Un período de retención evita que los blobs eliminados temporalmente se acumulen y aumenten el costo de la capacidad.",
+ "description": "Cada vez que se sobrescribe un blob, se crea una nueva instantánea. Es posible que sea difícil acceder a la causa del aumento de los cargos por capacidad, ya que la creación de estas instantáneas no aparece en los registros. Para reducir los cargos de capacidad, almacene los datos que se sobrescriben con frecuencia en una cuenta de almacenamiento independiente con la eliminación temporal deshabilitada. Un período de retención evita que los blobs eliminados temporalmente se acumulen y aumenten el costo de la capacidad.",
"guid": "7041f493-74f4-42e8-bbd2-15602763dc40",
"service": "Azure Blob Storage",
- "text": "Si habilita la eliminación temporal, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitada la eliminación temporal. Establecer períodos de retención. Considere comenzar con un período de retención corto para comprender mejor cómo afecta la función a su factura. El período de retención mínimo recomendado es de siete días.",
+ "text": "Si habilita la eliminación temporal, coloque los blobs que se sobrescriben con frecuencia en una cuenta que no tenga habilitada la eliminación temporal. Establezca períodos de retención. Considere comenzar con un período de retención corto para comprender mejor cómo la función afecta su factura. El período de retención mínimo recomendado es de siete días.",
"type": "recommendation",
"waf": "Costar"
},
@@ -1342,7 +1190,7 @@
"description": "",
"guid": "ab85e732-c3b0-47d2-ae0c-fa0ccf3ee4d1",
"service": "Azure Blob Storage",
- "text": "Cree planes de mantenimiento y recuperación de emergencia: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración, y los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e inconsistencias en los datos, así como para el tiempo y el costo de la conmutación por error.",
+ "text": "Cree planes de mantenimiento y recuperación de emergencia: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración y los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e incoherencias de datos, así como para el tiempo y el costo de la conmutación por error.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -1358,7 +1206,7 @@
"description": "",
"guid": "b842f2e7-9ac7-4d2e-9c9a-a3fb2ddc2441",
"service": "Azure Blob Storage",
- "text": "Habilitar informes de inventario de blobs: habilite los informes de inventario de blobs para revisar el estado de retención, retención legal o cifrado del contenido de la cuenta de almacenamiento. También puede usar los informes de inventario de blobs para comprender el tamaño total de los datos, la antigüedad, la distribución de niveles u otros atributos de los datos. Use herramientas como Azure Databricks o Azure Synapse Analytics y Power BI para visualizar mejor los datos de inventario y crear informes para las partes interesadas.",
+ "text": "Habilitar informes de inventario de blobs: habilite los informes de inventario de blobs para revisar el estado de retención, retención legal o cifrado del contenido de la cuenta de almacenamiento. También puede usar informes de inventario de blobs para comprender el tamaño total de los datos, la antigüedad, la distribución de niveles u otros atributos de los datos. Use herramientas como Azure Databricks o Azure Synapse Analytics y Power BI para visualizar mejor los datos de inventario y crear informes para las partes interesadas.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -1366,7 +1214,7 @@
"description": "",
"guid": "b54e930b-e9fe-4b7b-adc2-b0f0d0b0f05c",
"service": "Azure Blob Storage",
- "text": "Configure políticas que eliminen blobs o los muevan a niveles de acceso rentables: cree una política de administración del ciclo de vida con un conjunto inicial de condiciones. Las ejecuciones de directivas eliminan o establecen automáticamente el nivel de acceso de los blobs en función de las condiciones que defina. Analice periódicamente el uso de contenedores mediante el uso de métricas de supervisión e informes de inventario de blobs para que pueda refinar las condiciones y optimizar la rentabilidad.",
+ "text": "Configure políticas que eliminen blobs o los muevan a niveles de acceso rentables: cree una política de administración del ciclo de vida con un conjunto inicial de condiciones. Las ejecuciones de directivas eliminan o establecen automáticamente el nivel de acceso de los blobs en función de las condiciones que defina. Analice periódicamente el uso de contenedores mediante el uso de métricas de supervisión e informes de inventario de blobs para poder refinar las condiciones y optimizar la rentabilidad.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -1390,7 +1238,7 @@
"description": "",
"guid": "61755535-55a0-4064-8537-e9cdf07e1baa",
"service": "Azure Blob Storage",
- "text": "Planeación de la escala: comprenda los objetivos de escala de las cuentas de almacenamiento.",
+ "text": "Planeación de la escala: descripción de los objetivos de escala para las cuentas de almacenamiento.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -1398,7 +1246,7 @@
"description": "",
"guid": "bd64ef47-64e7-4c7e-b19f-ccfd451083e0",
"service": "Azure Blob Storage",
- "text": "Elija el tipo de cuenta de almacenamiento óptimo: si su carga de trabajo requiere altas tasas de transacción, objetos más pequeños y una latencia de transacción baja y constante, considere la posibilidad de usar cuentas de almacenamiento premium de blobs en bloques. En la mayoría de los casos, una cuenta estándar de uso general v2 es la más adecuada.",
+ "text": "Elija el tipo de cuenta de almacenamiento óptimo: si la carga de trabajo requiere altas tasas de transacción, objetos más pequeños y una latencia de transacción baja de forma constante, considere la posibilidad de usar cuentas de almacenamiento de blobs en bloques premium. En la mayoría de los casos, una cuenta estándar de uso general v2 es la más adecuada.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -1430,7 +1278,7 @@
"description": "",
"guid": "97486b6a-ea0c-4100-86e0-319ce0c8ad21",
"service": "Azure Blob Storage",
- "text": "Optimice el rendimiento del código personalizado: considere la posibilidad de usar SDK de almacenamiento en lugar de crear sus propios contenedores para las operaciones de REST de blobs. Los SDK de Azure están optimizados para el rendimiento y proporcionan mecanismos para ajustar el rendimiento. Antes de crear una aplicación, revise la lista de comprobación de rendimiento y escalabilidad de Blob Storage. Considere la posibilidad de usar la aceleración de consultas para filtrar los datos no deseados durante la solicitud de almacenamiento y evitar que los clientes transfieran datos innecesariamente a través de la red.",
+ "text": "Optimice el rendimiento del código personalizado: considere la posibilidad de usar SDK de almacenamiento en lugar de crear sus propios contenedores para las operaciones REST de blobs. Los SDK de Azure están optimizados para el rendimiento y proporcionan mecanismos para ajustar el rendimiento. Antes de crear una aplicación, revise la lista de comprobación de rendimiento y escalabilidad de Blob Storage. Considere la posibilidad de usar la aceleración de consultas para filtrar los datos no deseados durante la solicitud de almacenamiento y evitar que los clientes transfieran datos innecesariamente a través de la red.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -1438,7 +1286,7 @@
"description": "",
"guid": "0b2ed074-7dcb-460a-8455-144171d2fe8f",
"service": "Azure Blob Storage",
- "text": "Recopilación de datos de rendimiento: supervise la cuenta de almacenamiento para identificar los cuellos de botella de rendimiento que se producen debido a la limitación. Para obtener más información, consulte Supervisión del servicio de almacenamiento con información de supervisión del almacenamiento. Utilice tanto las métricas como los registros. Las métricas proporcionan números, como los errores de limitación. Los registros describen la actividad. Si ve métricas de limitación, puede usar registros para identificar qué clientes reciben errores de limitación. Para obtener más información, consulte Auditoría de operaciones del plano de datos.",
+ "text": "Recopilación de datos de rendimiento: supervise la cuenta de almacenamiento para identificar los cuellos de botella de rendimiento que se producen debido a la limitación. Para obtener más información, consulte Supervisión del servicio de almacenamiento con información de supervisión del almacenamiento. Utilice tanto las métricas como los registros. Las métricas proporcionan números como los errores de limitación. Los registros describen la actividad. Si ve métricas de limitación, puede usar registros para identificar qué clientes reciben errores de limitación. Para obtener más información, consulte Auditoría de operaciones del plano de datos.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -1446,7 +1294,7 @@
"description": "La reducción de la distancia física entre la cuenta de almacenamiento y las máquinas virtuales, los servicios y los clientes locales puede mejorar el rendimiento y reducir la latencia de la red. La reducción de la distancia física también reduce el costo de las aplicaciones hospedadas en Azure, ya que el uso del ancho de banda dentro de una sola región es gratuito.",
"guid": "1a37ef87-aa18-44a6-9877-6665fb1dc486",
"service": "Azure Blob Storage",
- "text": "Aprovisione cuentas de almacenamiento en la misma región donde se colocan los recursos dependientes. En el caso de las aplicaciones que no están hospedadas en Azure, como las aplicaciones de dispositivos móviles o los servicios empresariales locales, ubique la cuenta de almacenamiento en una región más cercana a esos clientes. Para más información, consulte Geografías de Azure. Si los clientes de una región diferente no requieren los mismos datos, cree una cuenta independiente en cada región. Si los clientes de una región diferente solo requieren algunos datos, considere la posibilidad de usar una directiva de replicación de objetos para copiar de forma asincrónica los objetos relevantes en una cuenta de almacenamiento de la otra región.",
+ "text": "Aprovisione cuentas de almacenamiento en la misma región donde se colocan los recursos dependientes. En el caso de las aplicaciones que no están hospedadas en Azure, como aplicaciones de dispositivos móviles o servicios empresariales locales, busque la cuenta de almacenamiento en una región más cercana a esos clientes. Para obtener más información, consulte Geografías de Azure. Si los clientes de una región diferente no requieren los mismos datos, cree una cuenta independiente en cada región. Si los clientes de una región diferente solo requieren algunos datos, considere la posibilidad de usar una directiva de replicación de objetos para copiar objetos relevantes de forma asincrónica en una cuenta de almacenamiento de la otra región.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -1467,10 +1315,10 @@
"waf": "Rendimiento"
},
{
- "description": "Los tamaños de blob o bloque superiores a 256 KB aprovechan las mejoras de rendimiento de la plataforma, creadas específicamente para blobs y tamaños de bloque más grandes.",
+ "description": "Los tamaños de blob o bloque superiores a 256 KiB aprovechan las mejoras de rendimiento de la plataforma, creadas específicamente para blobs y tamaños de bloque más grandes.",
"guid": "78872d9e-216b-4cc3-8686-0471d46a1acd",
"service": "Azure Blob Storage",
- "text": "Al cargar blobs o bloques, use un tamaño de blob o bloque superior a 256 KB.",
+ "text": "Al cargar blobs o bloques, use un tamaño de blob o bloque superior a 256 KiB.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -1531,7 +1379,7 @@
"waf": "fiabilidad"
},
{
- "description": "Durante la fase de planeación inicial, debe decidir si desea configurar un circuito ExpressRoute o una conexión ExpressRoute Direct. Un circuito ExpressRoute permite una conexión privada dedicada a Azure con la ayuda de un proveedor de conectividad. ExpressRoute Direct permite ampliar la red local directamente a la red de Microsoft en una ubicación de emparejamiento. También debe identificar el requisito de ancho de banda y el requisito de tipo de SKU para las necesidades de su negocio.",
+ "description": "Durante la fase de planeación inicial, debe decidir si desea configurar un circuito ExpressRoute o una conexión ExpressRoute Direct. Un circuito ExpressRoute permite una conexión dedicada privada a Azure con la ayuda de un proveedor de conectividad. ExpressRoute Direct permite extender la red local directamente a la red de Microsoft en una ubicación de emparejamiento. También debe identificar el requisito de ancho de banda y el requisito de tipo de SKU para las necesidades de su negocio.",
"guid": "09e0dd1a-b1f7-46c3-8df1-48e841f53dca",
"service": "Azure Expressroute",
"text": "Planeación del circuito ExpressRoute o ExpressRoute Direct",
@@ -1539,7 +1387,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Para planear la recuperación ante desastres, configure circuitos ExpressRoute en más de una ubicación de emparejamiento. Puede crear circuitos en ubicaciones de emparejamiento en el mismo metro o en diferentes áreas metropolitanas y elegir trabajar con diferentes proveedores de servicios para diversas rutas a través de cada circuito. Para obtener más información, consulte Diseño para la recuperación ante desastres y Diseño para alta disponibilidad.",
+ "description": "Para planear la recuperación ante desastres, configure circuitos ExpressRoute en más de una ubicación de emparejamiento. Puede crear circuitos en ubicaciones de emparejamiento en el mismo metro o en diferentes metros y elegir trabajar con diferentes proveedores de servicios para diversas rutas a través de cada circuito. Para obtener más información, consulte Diseño para la recuperación ante desastres y Diseño para alta disponibilidad.",
"guid": "257031a8-f034-436c-9f54-e82aab53c559",
"service": "Azure Expressroute",
"text": "Planeación de circuitos con redundancia geográfica",
@@ -1547,10 +1395,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Este modo proporciona una mayor disponibilidad de las conexiones de Expressroute. También se recomienda configurar BFD para una conmutación por error más rápida si hay un error de vínculo en una conexión.",
+ "description": "Este modo proporciona una mayor disponibilidad de las conexiones de ExpressRoute. También se recomienda configurar BFD para una conmutación por error más rápida si hay un error de vínculo en una conexión.",
"guid": "068037d8-673f-4e86-bc9d-bf83fbe61d12",
"service": "Azure Expressroute",
- "text": "Planeación de la conectividad Activo-Activo",
+ "text": "Planeación de la conectividad activo-activo",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -1627,7 +1475,7 @@
"waf": "Seguridad"
},
{
- "description": "Use Azure RBAC para configurar roles para limitar las cuentas de usuario que pueden agregar, actualizar o eliminar la configuración de emparejamiento en un circuito ExpressRoute.",
+ "description": "Use Azure RBAC para configurar roles que limiten las cuentas de usuario que pueden agregar, actualizar o eliminar la configuración de emparejamiento en un circuito ExpressRoute.",
"guid": "42b91c75-909f-4366-b014-48ab48639faf",
"service": "Azure Expressroute",
"text": "Mantener el inventario de las cuentas administrativas",
@@ -1635,7 +1483,7 @@
"waf": "Seguridad"
},
{
- "description": "Durante la configuración del emparejamiento privado o del emparejamiento de Microsoft, aplique un hash MD5 para proteger los mensajes entre la ruta local y los enrutadores MSEE.",
+ "description": "Durante la configuración del emparejamiento privado o el emparejamiento de Microsoft, aplique un hash MD5 para proteger los mensajes entre la ruta local y los enrutadores MSEE.",
"guid": "78f7d298-53bf-49ae-8ed7-994d46ccf2dd",
"service": "Azure Expressroute",
"text": "Configuración del hash MD5 en el circuito ExpressRoute",
@@ -1643,7 +1491,7 @@
"waf": "Seguridad"
},
{
- "description": "La seguridad de control de acceso a medios es una seguridad punto a punto en la capa de enlace de datos. ExpressRoute Direct admite la configuración de MACSec para evitar amenazas de seguridad a protocolos como ARP, DHCP, LACP que normalmente no están protegidos en el vínculo Ethernet. Para obtener más información sobre cómo configurar MACSec, consulte MACSec para puertos ExpressRoute Direct.",
+ "description": "La seguridad del control de acceso a medios es una seguridad punto a punto en la capa de enlace de datos. ExpressRoute Direct admite la configuración de MACSec para evitar amenazas de seguridad a protocolos como ARP, DHCP, LACP que normalmente no están protegidos en el vínculo Ethernet. Para obtener más información sobre cómo configurar MACSec, consulte MACSec para puertos ExpressRoute Direct.",
"guid": "d495a140-702d-4e08-bb86-7ceac8141df2",
"service": "Azure Expressroute",
"text": "Configuración de MACSec para recursos de ExpressRoute Direct",
@@ -1694,7 +1542,7 @@
"description": "",
"guid": "d7be65f4-6500-49ea-92e3-3121fca4a076",
"service": "Azure Expressroute",
- "text": "Desaprovisionar los circuitos ExpressRoute que ya no están en uso.",
+ "text": "Desaprovisionamiento de circuitos ExpressRoute que ya no están en uso.",
"type": "checklist",
"waf": "costar"
},
@@ -1707,7 +1555,7 @@
"waf": "Costar"
},
{
- "description": "La forma en que se le cobra por el uso de ExpressRoute varía entre los tres tipos de SKU diferentes. Con el SKU local, se te cobra automáticamente un plan de datos ilimitados. Con los SKU Estándar y Premium, puedes elegir entre un plan de datos medido o ilimitado. Todos los datos de entrada son gratuitos, excepto cuando se utiliza el complemento Global Reach. Es importante comprender qué tipos de SKU y plan de datos funcionan mejor para su carga de trabajo para optimizar mejor el costo y el presupuesto. Para obtener más información sobre cómo cambiar el tamaño del circuito ExpressRoute, consulte Actualización del ancho de banda del circuito ExpressRoute.",
+ "description": "La forma en que se le cobra por el uso de ExpressRoute varía entre los tres tipos de SKU diferentes. Con el SKU local, se te cobra automáticamente un plan de datos ilimitados. Con los SKU Estándar y Premium, puedes seleccionar entre un plan de datos medido o ilimitado. Todos los datos de entrada son gratuitos, excepto cuando se utiliza el complemento Global Reach. Es importante comprender qué tipos de SKU y plan de datos funcionan mejor para su carga de trabajo para optimizar mejor el costo y el presupuesto. Para obtener más información sobre cómo cambiar el tamaño del circuito ExpressRoute, consulte Actualización del ancho de banda del circuito ExpressRoute.",
"guid": "3d8a5d49-af34-431f-b47f-ee8cf05479b5",
"service": "Azure Expressroute",
"text": "Determinar la SKU y el ancho de banda necesarios",
@@ -1715,7 +1563,7 @@
"waf": "Costar"
},
{
- "description": "Las puertas de enlace de red virtual de ExpressRoute se usan para pasar tráfico a una red virtual a través del emparejamiento privado. Revise las necesidades de rendimiento y escalado de su SKU de puerta de enlace de red virtual preferida. Seleccione la SKU de puerta de enlace adecuada en la carga de trabajo local a Azure.",
+ "description": "Las puertas de enlace de red virtual de ExpressRoute se usan para pasar tráfico a una red virtual a través del emparejamiento privado. Revise las necesidades de rendimiento y escala de la SKU de puerta de enlace de red virtual preferida. Seleccione la SKU de puerta de enlace adecuada en la carga de trabajo local a Azure.",
"guid": "82224292-a5a6-4b85-9b2f-b617117c4285",
"service": "Azure Expressroute",
"text": "Determinación del tamaño de la puerta de enlace de red virtual de ExpressRoute",
@@ -1731,10 +1579,10 @@
"waf": "Costar"
},
{
- "description": "Los circuitos ExpressRoute se cobran desde el momento en que se crean. Para reducir costos innecesarios, desaprovisione el circuito con el proveedor de servicios y elimine el circuito ExpressRoute de la suscripción. Para conocer los pasos sobre cómo quitar un circuito ExpressRoute, consulte Desaprovisionamiento de un circuito ExpressRoute.",
+ "description": "Los circuitos ExpressRoute se cargan desde el momento en que se crean. Para reducir el costo innecesario, desaprovisione el circuito con el proveedor de servicios y elimine el circuito ExpressRoute de la suscripción. Para conocer los pasos sobre cómo quitar un circuito ExpressRoute, consulte Desaprovisionamiento de un circuito ExpressRoute.",
"guid": "131104a1-a17f-4b6b-9384-0b636a5d5265",
"service": "Azure Expressroute",
- "text": "Desaprovisionar y eliminar circuitos ExpressRoute que ya no estén en uso.",
+ "text": "Desaprovisionar y eliminar los circuitos ExpressRoute que ya no están en uso.",
"type": "recommendation",
"waf": "Costar"
},
@@ -1742,7 +1590,7 @@
"description": "",
"guid": "4c7d0c83-02a0-4535-a378-c2ab4c13469c",
"service": "Azure Expressroute",
- "text": "Configure la supervisión de la conexión entre el entorno local y la red de Azure.",
+ "text": "Configure la supervisión de conexiones entre el entorno local y la red de Azure.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -1771,7 +1619,7 @@
"waf": "Operaciones"
},
{
- "description": "La supervisión de conexiones permite supervisar la conectividad entre los recursos locales y Azure a través del emparejamiento privado de ExpressRoute y la conexión de emparejamiento de Microsoft. El monitor de conexión puede detectar problemas de red identificando en qué parte de la ruta de red se encuentra el problema y ayudarlo a resolver rápidamente fallas de configuración o hardware.",
+ "description": "La supervisión de conexiones permite supervisar la conectividad entre los recursos locales y Azure a través del emparejamiento privado de ExpressRoute y la conexión de emparejamiento de Microsoft. El monitor de conexión puede detectar problemas de red identificando en qué parte de la ruta de red se encuentra el problema y ayudarlo a resolver rápidamente errores de configuración o hardware.",
"guid": "c6766a4e-7531-4335-af44-4fd1a3c706f4",
"service": "Azure Expressroute",
"text": "Configurar la supervisión de conexiones",
@@ -1779,7 +1627,7 @@
"waf": "Operaciones"
},
{
- "description": "Configure las notificaciones de estado del servicio para alertar cuando se produzca un mantenimiento planeado y próximo en todos los circuitos ExpressRoute de la suscripción. El estado del servicio también muestra el mantenimiento anterior junto con el RCA si se produjera un mantenimiento no planeado.",
+ "description": "Configure las notificaciones de estado del servicio para avisar cuando se produzca un mantenimiento planeado y próximo en todos los circuitos ExpressRoute de la suscripción. El estado del servicio también muestra el mantenimiento anterior junto con el RCA si se produjera un mantenimiento no planeado.",
"guid": "5ff3a7b5-974a-466d-ab01-ad90c143969d",
"service": "Azure Expressroute",
"text": "Configurar el estado del servicio",
@@ -1787,15 +1635,15 @@
"waf": "Operaciones"
},
{
- "description": "ExpressRoute Insights con Network Insights le permite revisar y analizar circuitos, puertas de enlace, métricas de conexiones y paneles de estado de ExpressRoute. ExpressRoute Insights también proporciona una vista de topología de las conexiones de ExpressRoute en la que puede ver los detalles de los componentes de emparejamiento en un solo lugar. Métricas disponibles:- Disponibilidad- Rendimiento- Métricas de puerta de enlace",
+ "description": "ExpressRoute Insights con Network Insights le permite revisar y analizar circuitos, puertas de enlace, métricas de conexiones y paneles de estado de ExpressRoute. ExpressRoute Insights también proporciona una vista de topología de las conexiones de ExpressRoute en la que puede ver los detalles de los componentes del emparejamiento, todo en un solo lugar. Métricas disponibles:- Disponibilidad- Rendimiento- Métricas de puerta de enlace",
"guid": "210546e8-29e3-40d9-869f-6236fddaadd0",
"service": "Azure Expressroute",
- "text": "Revisión de métricas con Network Insights",
+ "text": "Revise las métricas con Network Insights",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "ExpressRoute usa Azure Monitor para recopilar métricas y crear alertas basadas en la configuración. Las métricas se recopilan para los circuitos ExpressRoute, las puertas de enlace de ExpressRoute, las conexiones de puerta de enlace de ExpressRoute y ExpressRoute Direct. Estas métricas son útiles para diagnosticar problemas de conectividad y comprender el rendimiento de la conexión de ExpressRoute.",
+ "description": "ExpressRoute usa Azure Monitor para recopilar métricas y crear alertas en función de la configuración. Las métricas se recopilan para los circuitos ExpressRoute, las puertas de enlace de ExpressRoute, las conexiones de puerta de enlace de ExpressRoute y ExpressRoute Direct. Estas métricas son útiles para diagnosticar problemas de conectividad y comprender el rendimiento de la conexión de ExpressRoute.",
"guid": "8031ed87-7573-469a-9b05-01f4ff4d9231",
"service": "Azure Expressroute",
"text": "Revisión de las métricas de recursos de ExpressRoute",
@@ -1830,7 +1678,7 @@
"description": "",
"guid": "627c2d5f-e638-41fd-be98-9ba1bf195ce3",
"service": "Azure Expressroute",
- "text": "Habilite ExpressRoute FastPath para un mayor rendimiento.",
+ "text": "Habilite ExpressRoute FastPath para obtener un mayor rendimiento.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -1843,7 +1691,7 @@
"waf": "rendimiento"
},
{
- "description": "Use Azure Connectivity Toolkit para probar el rendimiento en el circuito ExpressRoute a fin de comprender la capacidad de ancho de banda y la latencia de la conexión de red.",
+ "description": "Use Azure Connectivity Toolkit para probar el rendimiento en el circuito ExpressRoute para comprender la capacidad de ancho de banda y la latencia de la conexión de red.",
"guid": "256753af-fb4b-49b2-a965-4b65265ee8dd",
"service": "Azure Expressroute",
"text": "Pruebe el rendimiento de la puerta de enlace de ExpressRoute para cumplir los requisitos de carga de trabajo.",
@@ -1878,7 +1726,7 @@
"description": "Configure alertas basadas en métricas de ExpressRoute para que le notifiquen de forma proactiva cuando se alcance un umbral determinado. Estas métricas son útiles para comprender las anomalías que pueden producirse con la conexión de ExpressRoute, como las interrupciones y el mantenimiento que se producen en los circuitos de ExpressRoute.",
"guid": "6440df71-d371-4190-920f-01c1815446db",
"service": "Azure Expressroute",
- "text": "Supervisión de las métricas de circuitos y puertas de enlace de ExpressRoute",
+ "text": "Supervisión de métricas de circuitos y puertas de enlace de ExpressRoute",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -1886,7 +1734,7 @@
"description": "",
"guid": "94d626bf-3509-4311-8700-696d8d18617e",
"service": "Azure Files",
- "text": "Use el análisis del modo de error: minimice los puntos de error teniendo en cuenta las dependencias internas, como la disponibilidad de redes virtuales, Azure Key Vault, Azure Content Delivery Network o Azure Front Door, puntos de conexión. Se pueden producir errores si necesita credenciales para acceder a Azure Files y las credenciales faltan en Key Vault. O bien, es posible que se produzca un error si las cargas de trabajo usan un punto de conexión basado en una red de entrega de contenido que falta. En estos casos, es posible que tenga que configurar las cargas de trabajo para que se conecten a un punto de conexión alternativo. Para obtener información general sobre el análisis del modo de error, consulte Recomendaciones para realizar el análisis del modo de error.",
+ "text": "Use el análisis del modo de error: minimice los puntos de error teniendo en cuenta las dependencias internas, como la disponibilidad de redes virtuales, Azure Key Vault, Azure Content Delivery Network o Azure Front Door, puntos de conexión de Azure Front Door. Pueden producirse errores si necesita credenciales para acceder a Azure Files y las credenciales faltan en Key Vault. O bien, es posible que se produzca un error si las cargas de trabajo usan un punto de conexión basado en una red de entrega de contenido que falta. En estos casos, es posible que tenga que configurar las cargas de trabajo para que se conecten a un punto de conexión alternativo. Para obtener información general sobre el análisis del modo de error, consulte Recomendaciones para realizar el análisis del modo de error.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1894,7 +1742,7 @@
"description": "",
"guid": "bedde06b-f58a-43ab-b6cc-76e41503e72a",
"service": "Azure Files",
- "text": "Definición de objetivos de confiabilidad y recuperación: revise los contratos de nivel de servicio (SLA) de Azure. Derive el objetivo de nivel de servicio (SLO) para la cuenta de almacenamiento. Por ejemplo, la configuración de redundancia que elija podría afectar al SLO. Tenga en cuenta el efecto de una interrupción regional, la posibilidad de pérdida de datos y el tiempo necesario para restaurar el acceso después de una interrupción. Tenga en cuenta también la disponibilidad de las dependencias internas que identificó como parte del análisis del modo de error.",
+ "text": "Definición de objetivos de confiabilidad y recuperación: revise los contratos de nivel de servicio (SLA) de Azure. Derive el objetivo de nivel de servicio (SLO) para la cuenta de almacenamiento. Por ejemplo, la configuración de redundancia que elija puede afectar al SLO. Tenga en cuenta el efecto de una interrupción regional, la posibilidad de pérdida de datos y el tiempo necesario para restaurar el acceso después de una interrupción. Tenga en cuenta también la disponibilidad de las dependencias internas que identificó como parte del análisis del modo de error.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1910,7 +1758,7 @@
"description": "",
"guid": "61e937b4-1989-496a-af6f-5df76d352ed8",
"service": "Azure Files",
- "text": "Aplicaciones de diseño: diseñe sus aplicaciones para que cambien sin problemas de modo que lean datos de una región secundaria si la región primaria no está disponible. Esta consideración de diseño solo se aplica a las configuraciones de almacenamiento con redundancia geográfica (GRS) y almacenamiento con redundancia de zona geográfica (GZRS). Diseñe sus aplicaciones para manejar adecuadamente las interrupciones, lo que reduce el tiempo de inactividad para los clientes.",
+ "text": "Diseñar aplicaciones: diseñe sus aplicaciones para que cambien sin problemas para que lean datos de una región secundaria si la región principal no está disponible. Esta consideración de diseño solo se aplica a las configuraciones de almacenamiento con redundancia geográfica (GRS) y almacenamiento con redundancia de zona geográfica (GZRS). Diseñe sus aplicaciones para manejar adecuadamente las interrupciones, lo que reduce el tiempo de inactividad para los clientes.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1918,7 +1766,7 @@
"description": "",
"guid": "cb1c49d6-9cdb-48f6-a3f8-c35c2037fc92",
"service": "Azure Files",
- "text": "Explore las funciones que le ayudarán a cumplir sus objetivos de recuperación: Haga que los archivos se puedan restaurar para que pueda recuperar los archivos dañados, editados o eliminados.",
+ "text": "Explore las características que le ayudarán a cumplir sus objetivos de recuperación: Haga que los archivos se puedan restaurar para que pueda recuperar archivos dañados, editados o eliminados.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1926,7 +1774,7 @@
"description": "",
"guid": "3a9677e5-9506-4aaa-bac6-48b5002070c1",
"service": "Azure Files",
- "text": "Cree un plan de recuperación: considere las características de protección de datos, las operaciones de copia de seguridad y restauración o los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e inconsistencias en los datos, así como para el tiempo y el costo de la conmutación por error. Para obtener más información, consulte Recomendaciones para diseñar una estrategia de recuperación ante desastres.",
+ "text": "Cree un plan de recuperación: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración o los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e incoherencias de datos, así como para el tiempo y el costo de la conmutación por error. Para obtener más información, consulte Recomendaciones para diseñar una estrategia de recuperación ante desastres.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -1958,7 +1806,7 @@
"description": "La eliminación temporal funciona en un nivel de recurso compartido de archivos para proteger los recursos compartidos de archivos de Azure frente a la eliminación accidental. La restauración a un momento dado protege contra la eliminación accidental o los daños, ya que puede restaurar los recursos compartidos de archivos a un estado anterior. Para obtener más información, consulte Información general sobre la protección de datos.",
"guid": "8bcb6fde-bf94-4f36-8eae-347e5d4f0dea",
"service": "Azure Files",
- "text": "Como parte de su estrategia de copia de seguridad y recuperación, habilite la eliminación temporal y use instantáneas para la restauración a un momento dado. Puede usar Azure Backup para realizar una copia de seguridad de los recursos compartidos de archivos SMB. También puede usar Azure File Sync para realizar copias de seguridad de recursos compartidos de archivos SMB locales en un recurso compartido de archivos de Azure. Azure Backup también le permite realizar una copia de seguridad almacenada (versión preliminar) de Azure Files para proteger sus datos de ataques de ransomware o pérdida de datos de origen debido a un actor malintencionado o un administrador no autorizado. Mediante el uso de la copia de seguridad almacenada, Azure Backup copia y almacena los datos en el almacén de Recovery Services. Esto crea una copia externa de los datos que puede conservar durante un máximo de 99 años. Azure Backup crea y administra los puntos de recuperación según la programación y la retención definidas en la directiva de copia de seguridad. Aprende más.",
+ "text": "Como parte de su estrategia de copia de seguridad y recuperación, habilite la eliminación temporal y use instantáneas para la restauración a un momento dado. Puede usar Azure Backup para realizar copias de seguridad de los recursos compartidos de archivos SMB. También puede usar Azure File Sync para realizar copias de seguridad de recursos compartidos de archivos SMB locales en un recurso compartido de archivos de Azure. Azure Backup también le permite realizar una copia de seguridad almacenada (versión preliminar) de Azure Files para proteger sus datos de ataques de ransomware o pérdida de datos de origen debido a un actor malintencionado o un administrador no autorizado. Mediante la copia de seguridad almacenada, Azure Backup copia y almacena los datos en el almacén de Recovery Services. Esto crea una copia externa de los datos que puede conservar durante un máximo de 99 años. Azure Backup crea y administra los puntos de recuperación según la programación y la retención definidas en la directiva de copia de seguridad. Aprende más.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -1966,7 +1814,7 @@
"description": "",
"guid": "2548e433-aeab-4738-bec1-0a3587ac4d15",
"service": "Azure Files",
- "text": "Revise la línea base de seguridad para Azure Storage: Para empezar, revise la línea base de seguridad para Storage.",
+ "text": "Revise la línea base de seguridad para Azure Storage: para empezar, revise la línea base de seguridad para Storage.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1982,7 +1830,7 @@
"description": "",
"guid": "8395a636-8c19-4b22-a175-2a0f0d83f44f",
"service": "Azure Files",
- "text": "Reduzca la superficie expuesta a ataques: utilice el cifrado en tránsito y evite el acceso a través de conexiones no seguras (HTTP) para reducir la superficie expuesta a ataques. Exigir a los clientes que envíen y reciban datos mediante la versión más reciente del protocolo de seguridad de la capa de transporte (TLS).",
+ "text": "Reduzca la superficie expuesta a ataques: use el cifrado en tránsito y evite el acceso a través de conexiones no seguras (HTTP) para reducir la superficie expuesta a ataques. Requerir que los clientes envíen y reciban datos mediante la versión más reciente del protocolo de seguridad de la capa de transporte (TLS).",
"type": "checklist",
"waf": "seguridad"
},
@@ -1990,7 +1838,7 @@
"description": "",
"guid": "62e5154f-98cb-4dc2-8e62-dd5c546d6a6d",
"service": "Azure Files",
- "text": "Minimice el uso de claves de cuenta de almacenamiento: la autenticación basada en identidad proporciona una seguridad superior en comparación con el uso de una clave de cuenta de almacenamiento. Sin embargo, debe usar una clave de cuenta de almacenamiento para obtener el control administrativo total de un recurso compartido de archivos, incluida la capacidad de tomar posesión de un archivo. Conceda a las entidades de seguridad solo los permisos necesarios para realizar sus tareas.",
+ "text": "Minimice el uso de claves de cuenta de almacenamiento: la autenticación basada en identidad proporciona una seguridad superior en comparación con el uso de una clave de cuenta de almacenamiento. Sin embargo, debe usar una clave de cuenta de almacenamiento para obtener el control administrativo completo de un recurso compartido de archivos, incluida la capacidad de tomar posesión de un archivo. Otorgue a las entidades de seguridad solo los permisos necesarios para realizar sus tareas.",
"type": "checklist",
"waf": "seguridad"
},
@@ -1998,7 +1846,7 @@
"description": "",
"guid": "dd5352d4-faa0-4a85-83db-00395c1a9df8",
"service": "Azure Files",
- "text": "Proteger la información confidencial: proteja la información confidencial, como las claves de la cuenta de almacenamiento y las contraseñas. No te recomendamos que utilices estas formas de autorización, pero si lo haces, debes asegurarte de rotarlas, caducarlas y almacenarlas de forma segura.",
+ "text": "Proteja la información confidencial: proteja la información confidencial, como las claves de la cuenta de almacenamiento y las contraseñas. No le recomendamos que utilice estas formas de autorización, pero si lo hace, debe asegurarse de rotarlas, caducarlas y almacenarlas de forma segura.",
"type": "checklist",
"waf": "seguridad"
},
@@ -2006,7 +1854,7 @@
"description": "",
"guid": "1edd34b4-610b-483a-83a0-d8bcb5915558",
"service": "Azure Files",
- "text": "Detección de amenazas: habilite Microsoft Defender para Storage para detectar intentos potencialmente dañinos de acceder a los recursos compartidos de archivos de Azure a través de los protocolos SMB o FileREST o aprovecharlos. Los administradores de suscripciones reciben alertas por correo electrónico con detalles de actividades sospechosas y recomendaciones sobre cómo investigar y corregir amenazas. Defender for Storage no admite funcionalidades antivirus para recursos compartidos de archivos de Azure. Si usa Defender para Storage, los recursos compartidos de archivos con transacciones pesadas incurren en costos significativos, por lo que considere la posibilidad de optar por no participar en Defender para Storage para cuentas de almacenamiento específicas.",
+ "text": "Detección de amenazas: habilite Microsoft Defender para Storage para detectar intentos potencialmente dañinos de acceder a los recursos compartidos de archivos de Azure a través de los protocolos SMB o FileREST o aprovecharlos. Los administradores de suscripciones reciben alertas por correo electrónico con detalles de actividades sospechosas y recomendaciones sobre cómo investigar y corregir amenazas. Defender para Storage no admite funcionalidades de antivirus para recursos compartidos de archivos de Azure. Si usa Defender para Storage, los recursos compartidos de archivos con muchas transacciones incurren en costos significativos, por lo que debe considerar la posibilidad de optar por no participar en Defender para Storage para cuentas de almacenamiento específicas.",
"type": "checklist",
"waf": "seguridad"
},
@@ -2027,10 +1875,10 @@
"waf": "Seguridad"
},
{
- "description": "SMB 1 es un protocolo anticuado, ineficiente e inseguro. Desactívelo en los clientes para mejorar su posición de seguridad.",
+ "description": "SMB 1 es un protocolo obsoleto, ineficiente e inseguro. Desactívelo en los clientes para mejorar su posición de seguridad.",
"guid": "e2ef284e-804b-4592-866f-5d577069b823",
"service": "Azure Files",
- "text": "Si abre el puerto 445, asegúrese de deshabilitar SMBv1 en clientes Windows y Linux. Azure Files no es compatible con SMB 1, pero aún así debe deshabilitarlo en sus clientes.",
+ "text": "Si abre el puerto 445, asegúrese de deshabilitar SMBv1 en clientes Windows y Linux. Azure Files no es compatible con SMB 1, pero debe deshabilitarlo en los clientes.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2038,15 +1886,15 @@
"description": "El tráfico de red viaja a través de la red troncal de Microsoft en lugar de la red pública de Internet, lo que elimina la exposición al riesgo de la red pública de Internet.",
"guid": "19d4b509-167c-4144-9705-9d65c48ec279",
"service": "Azure Files",
- "text": "Considere la posibilidad de deshabilitar el acceso de red pública a la cuenta de almacenamiento. Habilite el acceso a la red pública solo si los clientes y servicios SMB externos a Azure requieren acceso a la cuenta de almacenamiento. Si deshabilita el acceso a la red pública, cree un punto de conexión privado para la cuenta de almacenamiento. Se aplican tarifas de procesamiento de datos estándar para puntos de conexión privados. Un punto de conexión privado no bloquea las conexiones al punto de conexión público. De todos modos, debe deshabilitar el acceso a la red pública como se describió anteriormente. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso de los puntos de conexión públicos a redes virtuales y direcciones IP específicas.",
+ "text": "Considere la posibilidad de deshabilitar el acceso de red pública a la cuenta de almacenamiento. Habilite el acceso a la red pública solo si los clientes y servicios SMB externos a Azure requieren acceso a la cuenta de almacenamiento. Si deshabilita el acceso a la red pública, cree un punto de conexión privado para la cuenta de almacenamiento. Se aplican las tarifas estándar de procesamiento de datos para los puntos de conexión privados. Un punto de conexión privado no bloquea las conexiones al punto de conexión público. De todos modos, debe deshabilitar el acceso a la red pública como se describió anteriormente. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso del punto de conexión público a redes virtuales y direcciones IP específicas.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Minimice el riesgo de crear oportunidades para los atacantes.",
+ "description": "Minimice el riesgo de crear aperturas para los atacantes.",
"guid": "105c5f3d-dfc6-459b-93f0-c5046972f1ba",
"service": "Azure Files",
- "text": "Habilite reglas de firewall que limiten el acceso a redes virtuales específicas. Comience con acceso cero y, a continuación, proporcione de forma metódica e incremental la menor cantidad de acceso necesaria para los clientes y servicios.",
+ "text": "Habilite reglas de firewall que limiten el acceso a redes virtuales específicas. Comience con acceso cero y, a continuación, proporcione de forma metódica e incremental la menor cantidad de acceso necesaria para los clientes y los servicios.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2054,7 +1902,7 @@
"description": "Use la autenticación basada en identidad para reducir la posibilidad de que un atacante use una clave de cuenta de almacenamiento para acceder a los recursos compartidos de archivos.",
"guid": "1ba283cb-62bf-4ee8-9657-ba59ddd6bccd",
"service": "Azure Files",
- "text": "Cuando sea posible, use la autenticación basada en identidad con el cifrado de vales AES-256 Kerberos para autorizar el acceso a los recursos compartidos de archivos de Azure SMB.",
+ "text": "Cuando sea posible, use la autenticación basada en identidad con el cifrado de vales Kerberos AES-256 para autorizar el acceso a los recursos compartidos de archivos de Azure SMB.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2067,10 +1915,10 @@
"waf": "Seguridad"
},
{
- "description": "Esta configuración garantiza que todas las solicitudes que se realicen en la cuenta de almacenamiento se realicen a través de conexiones seguras (HTTPS). Se producirá un error en cualquier solicitud realizada a través de HTTP.",
+ "description": "Esta configuración garantiza que todas las solicitudes que se realicen en la cuenta de almacenamiento se realicen a través de conexiones seguras (HTTPS). Se producirá un error en todas las solicitudes realizadas a través de HTTP.",
"guid": "4fbd14ad-9bf1-491f-b621-35f086b48ccd",
"service": "Azure Files",
- "text": "En la mayoría de los casos, debe habilitar la opción Transferencia segura necesaria en todas las cuentas de almacenamiento para habilitar el cifrado en tránsito para los recursos compartidos de archivos SMB. No habilite esta opción si necesita permitir que clientes muy antiguos accedan al recurso compartido. Si deshabilita la transferencia segura, asegúrese de usar los controles de red para restringir el tráfico.",
+ "text": "En la mayoría de los casos, debe habilitar la opción Transferencia segura necesaria en todas las cuentas de almacenamiento para habilitar el cifrado en tránsito para los recursos compartidos de archivos SMB. No habilite esta opción si necesita permitir que clientes muy antiguos accedan al recurso compartido. Si deshabilita la transferencia segura, asegúrese de usar controles de red para restringir el tráfico.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2102,7 +1950,7 @@
"description": "",
"guid": "85f4e9b5-aa91-4d96-ad22-9132f7412718",
"service": "Azure Files",
- "text": "Comprenda los requisitos de seguridad de su organización: Los recursos compartidos de archivos de Azure NFS solo admiten clientes Linux que usan el protocolo NFSv4.1, con compatibilidad con la mayoría de las características de la especificación del protocolo 4.1. Algunas características de seguridad, como la autenticación Kerberos, las listas de control de acceso (ACL) y el cifrado en tránsito, no son compatibles.",
+ "text": "Comprenda los requisitos de seguridad de su organización: los recursos compartidos de archivos de Azure de NFS solo admiten clientes de Linux que usan el protocolo NFSv4.1, con compatibilidad con la mayoría de las características de la especificación del protocolo 4.1. Algunas características de seguridad, como la autenticación Kerberos, las listas de control de acceso (ACL) y el cifrado en tránsito, no son compatibles.",
"type": "checklist",
"waf": "seguridad"
},
@@ -2134,12 +1982,12 @@
"description": "El tráfico de red viaja a través de la red troncal de Microsoft en lugar de la red pública de Internet, lo que elimina la exposición al riesgo de la red pública de Internet.",
"guid": "528b4915-a4d9-413d-9b79-e4078f5cd27d",
"service": "Azure Files",
- "text": "Solo se puede acceder a los recursos compartidos de archivos de Azure de NFS a través de redes restringidas. Por lo tanto, debe crear un punto de conexión privado para la cuenta de almacenamiento o restringir el acceso del punto de conexión público a las redes virtuales y direcciones IP seleccionadas. Se recomienda crear un punto de conexión privado. Debe configurar la seguridad de nivel de red para los recursos compartidos de NFS, ya que Azure Files no admite el cifrado en tránsito con el protocolo NFS. Debe deshabilitar la opción Requerir transferencia segura en la cuenta de almacenamiento para usar recursos compartidos de archivos de Azure NFS. Se aplican tarifas estándar de procesamiento de datos para los puntos de conexión privados. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso a los puntos de conexión públicos.",
+ "text": "Solo se puede acceder a los recursos compartidos de archivos de Azure NFS a través de redes restringidas. Por lo tanto, debe crear un punto de conexión privado para la cuenta de almacenamiento o restringir el acceso del punto de conexión público a las redes virtuales y direcciones IP seleccionadas. Se recomienda crear un punto de conexión privado. Debe configurar la seguridad de nivel de red para los recursos compartidos de NFS, ya que Azure Files no admite el cifrado en tránsito con el protocolo NFS. Debe deshabilitar la opción Requerir transferencia segura en la cuenta de almacenamiento para usar recursos compartidos de archivos de Azure NFS. Se aplican tarifas estándar de procesamiento de datos para los puntos de conexión privados. Si no necesita una dirección IP estática para el recurso compartido de archivos y desea evitar el costo de los puntos de conexión privados, puede restringir el acceso a los puntos de conexión públicos.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "No permitir el uso de claves de cuenta de almacenamiento para que su cuenta de almacenamiento sea más segura.",
+ "description": "No permitir el uso de claves de cuenta de almacenamiento para que la cuenta de almacenamiento sea más segura.",
"guid": "2f92995e-d1d1-411d-96cd-309faf0a6ada",
"service": "Azure Files",
"text": "Considere la posibilidad de no permitir el acceso a la clave de la cuenta de almacenamiento en el nivel de la cuenta de almacenamiento. No necesita este acceso para montar recursos compartidos de archivos NFS. Pero tenga en cuenta que el control administrativo completo de un recurso compartido de archivos, incluida la capacidad de tomar posesión de un archivo, requiere el uso de una clave de cuenta de almacenamiento.",
@@ -2150,7 +1998,7 @@
"description": "",
"guid": "bc87a075-cc79-46be-a413-106c995f41ef",
"service": "Azure Files",
- "text": "Decida si la carga de trabajo requiere el rendimiento de recursos compartidos de archivos premium (SSD premium de Azure) o si el almacenamiento de HDD estándar de Azure es suficiente: determine el tipo de cuenta de almacenamiento y el modelo de facturación en función del tipo de almacenamiento que necesita. Si necesita grandes cantidades de operaciones de entrada/salida por segundo (IOPS), velocidades de transferencia de datos extremadamente rápidas o una latencia muy baja, debe elegir recursos compartidos de archivos de Azure premium. Los recursos compartidos de archivos de Azure NFS solo están disponibles en el nivel Premium. Los recursos compartidos de archivos NFS y SMB tienen el mismo precio en el nivel premium.",
+ "text": "Decida si la carga de trabajo requiere el rendimiento de recursos compartidos de archivos premium (SSD premium de Azure) o si el almacenamiento de HDD estándar de Azure es suficiente: determine el tipo de cuenta de almacenamiento y el modelo de facturación en función del tipo de almacenamiento que necesite. Si necesita grandes cantidades de operaciones de entrada/salida por segundo (IOPS), velocidades de transferencia de datos extremadamente rápidas o una latencia muy baja, debe elegir recursos compartidos de archivos de Azure premium. Los recursos compartidos de archivos de Azure NFS solo están disponibles en el nivel Premium. Los recursos compartidos de archivos NFS y SMB tienen el mismo precio en el nivel premium.",
"type": "checklist",
"waf": "costar"
},
@@ -2158,7 +2006,7 @@
"description": "",
"guid": "fc9a86d1-8dcf-4e82-87fa-81d736ab60f4",
"service": "Azure Files",
- "text": "Cree una cuenta de almacenamiento para el recurso compartido de archivos y elija un nivel de redundancia: elija una cuenta estándar (GPv2) o premium (FileStorage). El nivel de redundancia que elija afecta al costo. Cuanta más redundancia, mayor es el coste. El almacenamiento con redundancia local (LRS) es el más asequible. GRS solo está disponible para recursos compartidos de archivos SMB estándar. Los recursos compartidos de archivos estándar solo muestran información de transacciones en el nivel de cuenta de almacenamiento, por lo que se recomienda implementar solo un recurso compartido de archivos en cada cuenta de almacenamiento para garantizar una visibilidad completa de la facturación.",
+ "text": "Cree una cuenta de almacenamiento para el recurso compartido de archivos y elija un nivel de redundancia: elija una cuenta estándar (GPv2) o premium (FileStorage). El nivel de redundancia que elija afecta al costo. Cuanta más redundancia, mayor es el costo. El almacenamiento con redundancia local (LRS) es el más asequible. GRS solo está disponible para recursos compartidos de archivos SMB estándar. Los recursos compartidos de archivos estándar solo muestran información de transacción en el nivel de la cuenta de almacenamiento, por lo que se recomienda implementar solo un recurso compartido de archivos en cada cuenta de almacenamiento para garantizar la visibilidad total de la facturación.",
"type": "checklist",
"waf": "costar"
},
@@ -2182,7 +2030,7 @@
"description": "",
"guid": "9dede643-062f-40d2-869e-10458f04859a",
"service": "Azure Files",
- "text": "Elija el nivel de acceso más rentable: los recursos compartidos de archivos de Azure SMB estándar ofrecen tres niveles de acceso: optimizado para transacciones, frecuente y esporádico. Los tres niveles se almacenan en el mismo hardware de almacenamiento estándar. La principal diferencia para estos tres niveles son sus precios de almacenamiento de datos en reposo, que son más bajos en los niveles más esporádicos, y los precios de transacción, que son más altos en los niveles más esporádicos. Para obtener más información, consulte Diferencias en los niveles estándar.",
+ "text": "Elija el nivel de acceso más rentable: los recursos compartidos de archivos de Azure para pymes estándar ofrecen tres niveles de acceso: optimizado para transacciones, frecuente y esporádico. Los tres niveles se almacenan en el mismo hardware de almacenamiento estándar. La principal diferencia para estos tres niveles son sus precios de almacenamiento de datos en reposo, que son más bajos en los niveles más esporádicos, y los precios de transacción, que son más altos en los niveles esporádicos. Para obtener más información, consulte Diferencias en los niveles estándar.",
"type": "checklist",
"waf": "costar"
},
@@ -2198,7 +2046,7 @@
"description": "",
"guid": "ae36a7c7-3255-4544-b751-bdbe08716cc2",
"service": "Azure Files",
- "text": "Crear barreras de protección: cree presupuestos basados en suscripciones y grupos de recursos. Utilice políticas de gobernanza para restringir los tipos de recursos, las configuraciones y las ubicaciones. Además, utilice el control de acceso basado en roles (RBAC) para bloquear acciones que puedan provocar un gasto excesivo.",
+ "text": "Crear barreras de protección: cree presupuestos basados en suscripciones y grupos de recursos. Utilice políticas de gobernanza para restringir los tipos de recursos, las configuraciones y las ubicaciones. Además, utilice el control de acceso basado en roles (RBAC) para bloquear las acciones que pueden provocar un gasto excesivo.",
"type": "checklist",
"waf": "costar"
},
@@ -2230,12 +2078,12 @@
"description": "Seleccione el nivel de acceso adecuado para los recursos compartidos de archivos estándar a fin de reducir considerablemente los costos.",
"guid": "4ee4d06f-ae90-4ba1-b87e-608a8871e182",
"service": "Azure Files",
- "text": "Después de migrar la carga de trabajo, si usa recursos compartidos de archivos estándar, elija cuidadosamente el nivel de acceso más rentable para el recurso compartido de archivos: frecuente, esporádico u optimizado para transacciones. Después de operar durante unos días o semanas con un uso regular, puede insertar los recuentos de transacciones en la calculadora de precios para averiguar qué nivel se adapta mejor a su carga de trabajo. La mayoría de los clientes deben elegir cool incluso si usan activamente el recurso compartido. Pero debe examinar cada recurso compartido y comparar el saldo de la capacidad de almacenamiento con las transacciones para determinar su nivel. Si los costos de transacción representan un porcentaje significativo de su factura, los ahorros del uso del nivel de acceso esporádico a menudo compensan este costo y minimizan el costo total total. Se recomienda mover recursos compartidos de archivos estándar entre niveles de acceso solo cuando sea necesario para optimizar los cambios en el patrón de carga de trabajo. Cada movimiento incurre en transacciones. Para obtener más información, consulte Cambiar entre niveles estándar.",
+ "text": "Después de migrar la carga de trabajo, si usa recursos compartidos de archivos estándar, elija cuidadosamente el nivel de acceso más rentable para el recurso compartido de archivos: frecuente, esporádico u optimizado para transacciones. Después de operar durante unos días o semanas con uso regular, puede insertar los recuentos de transacciones en la calculadora de precios para averiguar qué nivel se adapta mejor a su carga de trabajo. La mayoría de los clientes deben elegir cool incluso si usan activamente el recurso compartido. Sin embargo, debe examinar cada recurso compartido y comparar el saldo de la capacidad de almacenamiento con las transacciones para determinar su nivel. Si los costos de transacción representan un porcentaje significativo de su factura, los ahorros del uso del nivel de acceso esporádico a menudo compensan este costo y minimizan el costo total total. Se recomienda mover recursos compartidos de archivos estándar entre niveles de acceso solo cuando sea necesario para optimizar los cambios en el patrón de carga de trabajo. Cada movimiento incurre en transacciones. Para obtener más información, consulte Cambiar entre niveles estándar.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Aprovisionar en exceso los recursos compartidos de archivos premium en una cantidad razonable para ayudar a mantener el rendimiento y tener en cuenta el crecimiento futuro y los requisitos de rendimiento.",
+ "description": "Aprovisionamiento excesivo de recursos compartidos de archivos premium en una cantidad razonable para ayudar a mantener el rendimiento y tener en cuenta el crecimiento futuro y los requisitos de rendimiento.",
"guid": "569b045f-3018-4487-be79-5ae7fe5f42f6",
"service": "Azure Files",
"text": "Si usa recursos compartidos premium, asegúrese de aprovisionar capacidad y rendimiento más que suficientes para su carga de trabajo, pero no tanto como para incurrir en costos innecesarios. Se recomienda sobreaprovisionar dos o tres veces. Puede escalar dinámicamente los recursos compartidos de archivos premium hacia arriba o hacia abajo en función de las características de rendimiento de almacenamiento y entrada/salida (E/S).",
@@ -2243,18 +2091,18 @@
"waf": "Costar"
},
{
- "description": "Las reservas de tres años pueden proporcionar un descuento de hasta el 36% en el costo total del almacenamiento de archivos. Las reservas no afectan al rendimiento.",
+ "description": "Las reservas de tres años pueden proporcionar un descuento de hasta el 36% sobre el costo total del almacenamiento de archivos. Las reservas no afectan al rendimiento.",
"guid": "e4d7ee80-2657-4a1b-bf32-b16588f1511e",
"service": "Azure Files",
- "text": "Use las reservas de Azure Files, también conocidas como instancias reservadas, para confirmar previamente el uso del almacenamiento y obtener un descuento. Utilice reservas para cargas de trabajo de producción o cargas de trabajo de desarrollo y pruebas con huellas coherentes. Para obtener más información, consulte Optimización de costos con reservas de almacenamiento. Las reservas no incluyen cargos por transacción, ancho de banda, transferencia de datos y almacenamiento de metadatos.",
+ "text": "Use las reservas de Azure Files, también conocidas como instancias reservadas, para confirmar previamente el uso del almacenamiento y obtener un descuento. Use reservas para cargas de trabajo de producción o cargas de trabajo de desarrollo y pruebas con huellas coherentes. Para obtener más información, consulte Optimización de costos con reservas de almacenamiento. Las reservas no incluyen cargos por transacción, ancho de banda, transferencia de datos y almacenamiento de metadatos.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Las instantáneas diferenciales garantizan que no se le facture varias veces por almacenar los mismos datos. Sin embargo, aún debe supervisar el uso de instantáneas para ayudar a reducir la factura de Azure Files.",
+ "description": "Las instantáneas diferenciales garantizan que no se le facture varias veces por almacenar los mismos datos. Sin embargo, aún debe supervisar el uso de instantáneas para ayudar a reducir su factura de Azure Files.",
"guid": "90fbd856-01ee-41d2-a912-039edc971236",
"service": "Azure Files",
- "text": "Supervise el uso de instantáneas. Las instantáneas conllevan cargos, pero se facturan en función del uso de almacenamiento diferencial de cada instantánea. Solo pagas por la diferencia en cada instantánea. Para obtener más información, consulte Instantáneas. Azure File Sync toma instantáneas de nivel de archivo y de recurso compartido como parte del uso normal, lo que puede aumentar la factura total de Azure Files.",
+ "text": "Supervise el uso de instantáneas. Las instantáneas incurren en cargos, pero se facturan en función del uso de almacenamiento diferencial de cada instantánea. Solo pagas por la diferencia en cada instantánea. Para obtener más información, consulte Instantáneas. Azure File Sync toma instantáneas de nivel de recurso compartido y de nivel de archivo como parte del uso normal, lo que puede aumentar la factura total de Azure Files.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2262,7 +2110,7 @@
"description": "Establezca un período de retención para que los archivos eliminados temporalmente no se acumulen y aumenten el costo de la capacidad. Después del período de retención configurado, los datos eliminados permanentemente no incurren en ningún costo.",
"guid": "d28f02bd-5de7-4d5b-bfbf-46ff161833b5",
"service": "Azure Files",
- "text": "Establezca períodos de retención para la función de eliminación temporal, especialmente cuando comience a usarla por primera vez. Considere comenzar con un período de retención corto para comprender mejor cómo afecta la función a su factura. El período de retención mínimo recomendado es de siete días. Al eliminar temporalmente recursos compartidos de archivos estándar y premium, se facturan como capacidad usada en lugar de capacidad aprovisionada. Y los recursos compartidos de archivos premium se facturan a la tarifa de instantáneas mientras se encuentran en el estado de eliminación temporal. Los recursos compartidos de archivos estándar se facturan a la tarifa normal mientras se encuentran en el estado de eliminación temporal.",
+ "text": "Establezca períodos de retención para la función de eliminación temporal, especialmente cuando comience a usarla por primera vez. Considere comenzar con un período de retención corto para comprender mejor cómo la función afecta su factura. El período de retención mínimo recomendado es de siete días. Al eliminar temporalmente recursos compartidos de archivos estándar y premium, se facturan como capacidad usada en lugar de capacidad aprovisionada. Y los recursos compartidos de archivos premium se facturan a la tarifa de instantáneas mientras se encuentran en el estado de eliminación temporal. Los recursos compartidos de archivos estándar se facturan a la tarifa normal mientras se encuentran en el estado de eliminación temporal.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2270,7 +2118,7 @@
"description": "",
"guid": "ab85e732-c3b0-47d2-ae0c-fa0ccf3ee4d1",
"service": "Azure Files",
- "text": "Cree planes de mantenimiento y recuperación de emergencia: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración, y los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e inconsistencias en los datos, así como para el tiempo y el costo de la conmutación por error.",
+ "text": "Cree planes de mantenimiento y recuperación de emergencia: tenga en cuenta las características de protección de datos, las operaciones de copia de seguridad y restauración y los procedimientos de conmutación por error. Prepárese para posibles pérdidas de datos e incoherencias de datos, así como para el tiempo y el costo de la conmutación por error.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -2286,7 +2134,7 @@
"description": "",
"guid": "e6d6588e-c646-4221-832a-0e289e272531",
"service": "Azure Files",
- "text": "Revisar periódicamente la actividad de uso compartido de archivos: la actividad de uso compartido puede cambiar con el tiempo. Mueva los recursos compartidos de archivos estándar a niveles de acceso más esporádicos, o puede aprovisionar o desaprovisionar capacidad para recursos compartidos premium. Al mover recursos compartidos de archivos estándar a un nivel de acceso diferente, se incurre en un cargo por transacción. Mueva los recursos compartidos de archivos estándar solo cuando sea necesario para reducir su factura mensual.",
+ "text": "Revisar periódicamente la actividad de uso compartido de archivos: la actividad de uso compartido puede cambiar con el tiempo. Mueva recursos compartidos de archivos estándar a niveles de acceso más esporádicos, o puede aprovisionar o desaprovisionar capacidad para recursos compartidos premium. Al mover recursos compartidos de archivos estándar a un nivel de acceso diferente, se incurre en un cargo por transacción. Mueva los recursos compartidos de archivos estándar solo cuando sea necesario para reducir su factura mensual.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -2318,7 +2166,7 @@
"description": "",
"guid": "6c44da65-6a81-442d-87e7-dd1ecdbca0a5",
"service": "Azure Files",
- "text": "Planear la escala: comprenda los objetivos de escalabilidad y rendimiento de las cuentas de almacenamiento, Azure Files y Azure File Sync.",
+ "text": "Planeación de la escala: comprenda los objetivos de escalabilidad y rendimiento de las cuentas de almacenamiento, Azure Files y Azure File Sync.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -2326,7 +2174,7 @@
"description": "",
"guid": "d9878efd-6174-4cf7-b7f4-429d8e82e577",
"service": "Azure Files",
- "text": "Comprenda los patrones de uso y aplicaciones para lograr un rendimiento predecible: determine la sensibilidad de latencia, los requisitos de IOPS y rendimiento, la duración y la frecuencia de la carga de trabajo y la paralelización de la carga de trabajo. Use Azure Files para aplicaciones multiproceso para ayudarle a alcanzar los límites superiores de rendimiento de un servicio. Si la mayoría de las solicitudes están centradas en los metadatos, como createfile, openfile, closefile, queryinfo o querydirectory, las solicitudes crean una latencia deficiente que es mayor que las operaciones de lectura y escritura. Si tiene este problema, considere la posibilidad de separar el recurso compartido de archivos en varios recursos compartidos de archivos dentro de la misma cuenta de almacenamiento.",
+ "text": "Comprenda los patrones de uso y aplicaciones para lograr un rendimiento predecible: determine la sensibilidad de latencia, los requisitos de IOPS y rendimiento, la duración y la frecuencia de la carga de trabajo y la paralelización de la carga de trabajo. Use Azure Files para aplicaciones multiproceso para ayudarle a alcanzar los límites superiores de rendimiento de un servicio. Si la mayoría de las solicitudes están centradas en metadatos, como createfile, openfile, closefile, queryinfo o querydirectory, las solicitudes crean una latencia deficiente que es mayor que las operaciones de lectura y escritura. Si tiene este problema, considere la posibilidad de separar el recurso compartido de archivos en varios recursos compartidos de archivos dentro de la misma cuenta de almacenamiento.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -2363,10 +2211,10 @@
"waf": "rendimiento"
},
{
- "description": "Aumente el rendimiento y las IOPS a la vez que reduce el coste total de propiedad. Las ventajas de rendimiento aumentan con el número de archivos que distribuyen la carga.",
+ "description": "Aumente el rendimiento y las IOPS a la vez que reduce el costo total de propiedad. Las ventajas de rendimiento aumentan con el número de archivos que distribuyen la carga.",
"guid": "24a072d9-074d-4bcf-a65d-9a14336f8075",
"service": "Azure Files",
- "text": "Habilite SMB Multicanal para recursos compartidos de archivos SMB premium. SMB Multicanal permite a un cliente SMB 3.1.1 establecer varias conexiones de red a un recurso compartido de archivos de Azure SMB. SMB multicanal solo funciona cuando la característica está habilitada tanto en el lado del cliente (su cliente) como en el lado del servicio (Azure). En los clientes de Windows, SMB multicanal está habilitado de forma predeterminada, pero debe habilitarlo en su cuenta de almacenamiento.",
+ "text": "Habilite SMB Multichannel para recursos compartidos de archivos SMB premium. SMB Multicanal permite a un cliente SMB 3.1.1 establecer varias conexiones de red a un recurso compartido de archivos de Azure SMB. SMB multicanal solo funciona cuando la característica está habilitada tanto en el lado del cliente (su cliente) como en el lado del servicio (Azure). En los clientes de Windows, SMB Multicanal está habilitado de forma predeterminada, pero debe habilitarlo en su cuenta de almacenamiento.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -2374,7 +2222,7 @@
"description": "Aumente el rendimiento a escala y reduzca el costo total de propiedad de los recursos compartidos de archivos NFS.",
"guid": "c06bc804-3315-43f1-96ca-70169c020494",
"service": "Azure Files",
- "text": "Use la opción de montaje del lado del cliente nconnect con recursos compartidos de archivos de Azure NFS en clientes Linux. Nconnect permite usar más conexiones TCP entre el cliente y el servicio premium de Azure Files para NFSv4.1.",
+ "text": "Use la opción de montaje del lado cliente nconnect con recursos compartidos de archivos de Azure NFS en clientes Linux. Nconnect permite usar más conexiones TCP entre el cliente y el servicio premium de Azure Files para NFSv4.1.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -2398,7 +2246,7 @@
"description": "",
"guid": "de630a06-a4a8-4215-bb80-cc89dd3ced08",
"service": "Azure Firewall",
- "text": "Implemente Azure Firewall en varias zonas de disponibilidad para obtener un acuerdo de nivel de servicio (SLA) superior. Azure Firewall proporciona diferentes acuerdos de nivel de servicio en función de si implementa el servicio en una sola zona de disponibilidad o en varias zonas. Para obtener más información, consulte SLA para servicios en línea.",
+ "text": "Implemente Azure Firewall en varias zonas de disponibilidad para obtener un contrato de nivel de servicio (SLA) superior. Azure Firewall proporciona diferentes acuerdos de nivel de servicio en función de si implementa el servicio en una sola zona de disponibilidad o en varias zonas. Para obtener más información, consulte SLA para servicios en línea.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -2406,7 +2254,7 @@
"description": "",
"guid": "be394cd4-78f2-4737-8d8d-ec8f83193584",
"service": "Azure Firewall",
- "text": "Implemente una instancia de Azure Firewall en cada región en entornos de varias regiones. Para las arquitecturas radiales tradicionales, consulte Consideraciones sobre varias regiones. En el caso de los centros de conectividad de Azure Virtual WAN protegidos, configure la intención de enrutamiento y las directivas para proteger las comunicaciones entre centros y de sucursal a sucursal. En el caso de las cargas de trabajo resistentes a errores y tolerantes a errores, considere la posibilidad de utilizar instancias de Azure Firewall y Azure Virtual Network como recursos regionales.",
+ "text": "Implemente una instancia de Azure Firewall en cada región en entornos de varias regiones. Para arquitecturas radiales tradicionales, consulte Consideraciones sobre varias regiones. En el caso de los centros de conectividad de Azure Virtual WAN protegidos, configure la intención de enrutamiento y las directivas para proteger las comunicaciones entre centros y de sucursal a sucursal. En el caso de las cargas de trabajo resistentes y tolerantes a errores, considere la posibilidad de utilizar instancias de Azure Firewall y Azure Virtual Network como recursos regionales.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -2414,7 +2262,7 @@
"description": "",
"guid": "5f5c6480-7d26-4d6a-b375-e5786b200448",
"service": "Azure Firewall",
- "text": "Supervise las métricas de Azure Firewall y el estado de mantenimiento de los recursos. Azure Firewall se integra con Azure Resource Health. Use la comprobación de estado de los recursos para ver el estado de mantenimiento de Azure Firewall y solucionar los problemas de servicio que puedan afectar al recurso de Azure Firewall.",
+ "text": "Supervise las métricas de Azure Firewall y el estado de mantenimiento de los recursos. Azure Firewall se integra con Azure Resource Health. Use la comprobación de estado del recurso para ver el estado de mantenimiento de Azure Firewall y solucionar los problemas de servicio que puedan afectar al recurso de Azure Firewall.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -2435,10 +2283,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Supervise las métricas de recursos y el estado del servicio para poder detectar cuándo se degrada un estado del servicio y tomar medidas proactivas para evitar errores.",
+ "description": "Supervise las métricas de recursos y el estado del servicio para poder detectar cuándo se degrada un estado de servicio y tomar medidas proactivas para evitar errores.",
"guid": "09d6362f-d7a1-4c56-822c-065064bbcad7",
"service": "Azure Firewall",
- "text": "Supervise las métricas de Azure Firewall en un área de trabajo de Log Analytics. Supervise de cerca las métricas que indican el estado de mantenimiento de Azure Firewall, como el rendimiento, el estado de mantenimiento del firewall, el uso del puerto SNAT y las métricas de sondeo de latencia de AZFW. Use Azure Service Health para supervisar el estado de Azure Firewall.",
+ "text": "Supervise las métricas de Azure Firewall en un área de trabajo de Log Analytics. Supervise de cerca las métricas que indican el estado de mantenimiento de Azure Firewall, como el rendimiento, el estado de mantenimiento del firewall, la utilización del puerto SNAT y las métricas de sondeo de latencia de AZFW. Use Azure Service Health para supervisar el estado de Azure Firewall.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -2446,7 +2294,7 @@
"description": "Use la tunelización forzada para no exponer los recursos de Azure directamente a Internet. Este enfoque reduce la superficie de ataque y minimiza el riesgo de amenazas externas. Para aplicar las directivas corporativas y los requisitos de cumplimiento de forma más eficaz, enrute todo el tráfico enlazado a Internet a través de un firewall local o una NVA.",
"guid": "7abca50a-05ca-41fc-8485-cd536ba9ec86",
"service": "Azure Firewall",
- "text": "Configure Azure Firewall en modo de tunelización forzada si necesita enrutar todo el tráfico enlazado a Internet a un próximo salto designado en lugar de directamente a Internet. Esta recomendación no se aplica a Virtual WAN.
Azure Firewall debe tener conexión directa a Internet. Si AzureFirewallSubnet aprende una ruta predeterminada a la red local a través del protocolo de puerta de enlace fronteriza, debe configurar Azure Firewall en modo de tunelización forzada. Puede usar la característica de tunelización forzada para agregar otro espacio de direcciones /26 para la subred de administración de Azure Firewall. Asigne a la subred el nombre AzureFirewallManagementSubnet. Si tiene una instancia de Azure Firewall existente que no puede volver a configurar en el modo de tunelización forzada, cree una UDR con una ruta 0.0.0.0/0. Establezca el valor de NextHopType como Internet. Para mantener la conectividad a Internet, asocie la UDR con AzureFirewallSubnet. Establezca la dirección IP pública en None para implementar un plano de datos totalmente privado al configurar Azure Firewall en modo de tunelización forzada. Sin embargo, el plano de administración sigue requiriendo una dirección IP pública solo con fines de administración. El tráfico interno de las redes virtuales y locales no usa esa dirección IP pública.",
+ "text": "Configure Azure Firewall en modo de tunelización forzada si necesita enrutar todo el tráfico enlazado a Internet a un próximo salto designado en lugar de directamente a Internet. Esta recomendación no se aplica a Virtual WAN.
Azure Firewall debe tener conectividad directa a Internet. Si AzureFirewallSubnet aprende una ruta predeterminada a la red local a través del protocolo de puerta de enlace fronteriza, debe configurar Azure Firewall en modo de tunelización forzada. Puede usar la característica de tunelización forzada para agregar otro espacio de direcciones /26 para la subred de administración de Azure Firewall. Asigne a la subred el nombre AzureFirewallManagementSubnet. Si tiene una instancia de Azure Firewall existente que no puede volver a configurar en el modo de tunelización forzada, cree una UDR con una ruta 0.0.0.0/0. Establezca el valor de NextHopType como Internet. Para mantener la conectividad a Internet, asocie la UDR con AzureFirewallSubnet. Establezca la dirección IP pública en None para implementar un plano de datos totalmente privado al configurar Azure Firewall en modo de tunelización forzada. Sin embargo, el plano de administración sigue requiriendo una dirección IP pública solo con fines de administración. El tráfico interno de las redes virtuales y locales no usa esa dirección IP pública.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2454,7 +2302,7 @@
"description": "Organice las reglas en una estructura jerárquica para que las políticas granulares puedan cumplir con los requisitos de regiones específicas. Cada política puede contener diferentes conjuntos de reglas de traducción de direcciones de red de destino (DNAT), redes y aplicaciones que tienen prioridades, acciones y órdenes de procesamiento específicos.",
"guid": "0d9c6369-6b1b-49db-8198-68f2344273d8",
"service": "Azure Firewall",
- "text": "Cree reglas para políticas de firewall en una estructura jerárquica para superponer una política base central. Para más información, consulte Uso de directivas de Azure Firewall para procesar reglas.
Cree sus reglas basadas en el principio de confianza cero de acceso con privilegios mínimos",
+ "text": "Cree reglas para políticas de firewall en una estructura jerárquica para superponer una política base central. Para más información, consulte Uso de directivas de Azure Firewall para procesar reglas.
Cree sus reglas basadas en el principio de Confianza cero de acceso con privilegios mínimos",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2470,7 +2318,7 @@
"description": "Habilite esta característica para apuntar a los clientes de las redes virtuales a Azure Firewall como servidor DNS. Esta característica protege la infraestructura DNS interna a la que no se accede ni se expone directamente.",
"guid": "68949fe5-365d-4c55-b909-d52c39d24b6d",
"service": "Azure Firewall",
- "text": "Habilite la configuración de proxy DNS de Azure Firewall.
Configure también Azure Firewall para usar DNS personalizado para reenviar consultas DNS.",
+ "text": "Habilite la configuración del proxy DNS de Azure Firewall.
Configure también Azure Firewall para que use DNS personalizado para reenviar consultas DNS.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2478,15 +2326,15 @@
"description": "Envíe tráfico a través del firewall para inspeccionar el tráfico y ayudar a identificar y bloquear el tráfico malicioso.
Use Azure Firewall como proxy explícito para el tráfico saliente, de modo que el tráfico web llegue a la dirección IP privada del firewall y, por lo tanto, salga directamente del firewall sin usar una UDR. Esta característica también facilita el uso de múltiples firewalls sin modificar las rutas de red existentes.",
"guid": "7269ebdb-4f21-41f7-846b-b0f90145a8ca",
"service": "Azure Firewall",
- "text": "Configure las UDR para forzar el tráfico a través de Azure Firewall en una arquitectura tradicional de concentrador y radio para la conectividad de radio a radio, de radio a Internet y de radio a híbrido.
En Virtual WAN, configure la intención de enrutamiento y las directivas para redirigir el tráfico privado o el tráfico de Internet a través de la instancia de Azure Firewall integrada en el centro.
Si no puede aplicar una UDR y solo necesita el redireccionamiento del tráfico web, use Azure Firewall como proxy explícito en la ruta de acceso de salida. Puede configurar una opción de proxy en la aplicación de envío, como un explorador web, al configurar Azure Firewall como proxy.",
+ "text": "Configure las UDR para forzar el tráfico a través de Azure Firewall en una arquitectura tradicional de centro y radio para la conectividad de radio a radio, de radio a Internet y de radio a híbrido.
En Virtual WAN, configure la intención de enrutamiento y las directivas para redirigir el tráfico privado o el tráfico de Internet a través de la instancia de Azure Firewall integrada en el centro.
Si no puede aplicar una UDR y solo necesita el redireccionamiento del tráfico web, use Azure Firewall como proxy explícito en la ruta de salida. Puede configurar una opción de proxy en la aplicación de envío, como un explorador web, al configurar Azure Firewall como proxy.",
"type": "recommendation",
"waf": "Seguridad"
},
{
- "description": "Use FQDN en las reglas de red de Azure Firewall para que los administradores puedan administrar nombres de dominio en lugar de varias direcciones IP, lo que simplifica la administración. Esta resolución dinámica garantiza que las reglas de firewall se actualicen automáticamente cuando cambien las direcciones IP de los dominios.",
+ "description": "Use FQDN en las reglas de red de Azure Firewall para que los administradores puedan administrar nombres de dominio en lugar de varias direcciones IP, lo que simplifica la administración. Esta resolución dinámica garantiza que las reglas de firewall se actualicen automáticamente cuando cambien las direcciones IP de dominio.",
"guid": "dbcfaeb4-af8a-4536-aea5-b0941fe8cb1c",
"service": "Azure Firewall",
- "text": "Use el filtrado de FQDN en las reglas de red. Debe habilitar la configuración del proxy DNS de Azure Firewall para usar FQDN en las reglas de red.",
+ "text": "Utilice el filtrado de FQDN en las reglas de red. Debe habilitar la configuración del proxy DNS de Azure Firewall para usar FQDN en las reglas de red.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2502,7 +2350,7 @@
"description": "Use etiquetas FQDN en las reglas de aplicación de Azure Firewall para representar un grupo de FQDN asociados a servicios conocidos de Microsoft. Este método simplifica la administración de las reglas de seguridad de la red.",
"guid": "4063f792-86cc-469b-9b6d-3c3d5e7f5d74",
"service": "Azure Firewall",
- "text": "Use etiquetas FQDN en las reglas de la aplicación para proporcionar acceso selectivo a servicios específicos de Microsoft.
Puede usar una etiqueta FQDN en las reglas de la aplicación para permitir el tráfico de red de salida necesario a través del firewall para servicios específicos de Azure, como Microsoft 365, Windows 365 y Microsoft Intune.",
+ "text": "Use etiquetas FQDN en las reglas de la aplicación para proporcionar acceso selectivo a servicios específicos de Microsoft.
Puede usar una etiqueta FQDN en las reglas de la aplicación para permitir el tráfico de red saliente necesario a través del firewall para servicios específicos de Azure, como Microsoft 365, Windows 365 y Microsoft Intune.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2534,7 +2382,7 @@
"description": "Configure un plan de protección contra DDoS de Azure para que pueda administrar de forma centralizada la protección contra DDoS junto con las directivas de firewall. Este enfoque agiliza la forma en que administra la seguridad de su red y simplifica la forma en que implementa y supervisa los procesos.",
"guid": "05a6fac9-edc2-49bc-8bf8-17950c0cd710",
"service": "Azure Firewall",
- "text": "Use Firewall Manager para crear y asociar un plan de Azure DDoS Protection con la red virtual del centro. Este enfoque no se aplica a Virtual WAN.",
+ "text": "Use Firewall Manager para crear y asociar un plan de Azure DDoS Protection con la red virtual del centro de conectividad. Este enfoque no se aplica a Virtual WAN.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2542,7 +2390,7 @@
"description": "",
"guid": "9220cde5-ecbc-4eb1-a5ac-65e56e2aa925",
"service": "Azure Firewall",
- "text": "Seleccione una SKU de Azure Firewall para implementarla. Elija entre tres SKU de Azure Firewall: Básico, Estándar y Premium. Use Azure Firewall Premium para proteger aplicaciones muy confidenciales, como el procesamiento de pagos. Use Azure Firewall Standard si la carga de trabajo necesita un firewall de nivel 3 a nivel 7 y necesita escalado automático para controlar los períodos de tráfico máximo de hasta 30 Gbps. Use Azure Firewall Basic si usa SMB y requiere hasta 250 Mbps de rendimiento. Puedes cambiar a una versión anterior o superior a una versión superior de la SKU. Para más información, consulte Elección de la SKU de Azure Firewall correcta.",
+ "text": "Seleccione una SKU de Azure Firewall para implementarla. Elija entre tres SKU de Azure Firewall: Básico, Estándar y Premium. Use Azure Firewall Premium para proteger aplicaciones muy confidenciales, como el procesamiento de pagos. Use Azure Firewall Standard si la carga de trabajo necesita un firewall de nivel 3 a nivel 7 y necesita escalado automático para controlar los períodos de tráfico máximo de hasta 30 Gbps. Use Azure Firewall Basic si usa SMB y requiere hasta 250 Mbps de rendimiento. Puedes cambiar a una versión anterior o superior entre SKU Estándar y Premium. Para más información, consulte Elección de la SKU de Azure Firewall correcta.",
"type": "checklist",
"waf": "costar"
},
@@ -2550,7 +2398,7 @@
"description": "",
"guid": "54c37b38-2e3d-4cf9-b174-bee69a2a5b5d",
"service": "Azure Firewall",
- "text": "Elimine las implementaciones de firewall no utilizadas y optimice las implementaciones infrautilizadas. Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse de forma continua. Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Para reducir los costos operativos, supervise y optimice el uso de instancias de firewall, la configuración de directivas de Azure Firewall Manager y el número de direcciones IP públicas y directivas que usa.",
+ "text": "Elimine las implementaciones de firewall no utilizadas y optimice las implementaciones infrautilizadas. Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse continuamente. Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Para reducir los costos operativos, supervise y optimice el uso de instancias de firewall, la configuración de directivas de Azure Firewall Manager y el número de direcciones IP públicas y directivas que usa.",
"type": "checklist",
"waf": "costar"
},
@@ -2558,7 +2406,7 @@
"description": "",
"guid": "a522ab1e-0659-43b3-9fad-906116bb1432",
"service": "Azure Firewall",
- "text": "Comparta la misma instancia de Azure Firewall. Puede usar una instancia central de Azure Firewall en la red virtual del centro de conectividad o en el centro de conectividad segura de Virtual WAN y compartir la misma instancia de Azure Firewall entre redes virtuales radiales que se conecten al mismo centro desde la misma región. Asegúrese de que no tiene tráfico inesperado entre regiones en una topología radial.",
+ "text": "Comparta la misma instancia de Azure Firewall. Puede usar una instancia central de Azure Firewall en la red virtual del centro de conectividad o en el centro de conectividad segura de Virtual WAN y compartir la misma instancia de Azure Firewall entre redes virtuales radiales que se conecten al mismo centro desde la misma región. Asegúrese de que no tenga tráfico inesperado entre regiones en una topología radial.",
"type": "checklist",
"waf": "costar"
},
@@ -2574,7 +2422,7 @@
"description": "",
"guid": "debc5298-dba5-4c67-a03a-1ca626025139",
"service": "Azure Firewall",
- "text": "Disminuya la cantidad de datos de registro que almacena. Azure Firewall puede usar Azure Event Hubs para registrar de forma exhaustiva los metadatos del tráfico y enviarlos a áreas de trabajo de Log Analytics, Azure Storage o soluciones que no sean de Microsoft. Todas las soluciones de registro incurren en costos para procesar datos y proporcionar almacenamiento. Grandes cantidades de datos pueden incurrir en costos significativos. Considere un enfoque rentable y una alternativa a Log Analytics, y calcule el costo. Considere si necesita registrar metadatos de tráfico para todas las categorías de registro.",
+ "text": "Disminuya la cantidad de datos de registro que almacena. Azure Firewall puede usar Azure Event Hubs para registrar de forma exhaustiva los metadatos del tráfico y enviarlos a áreas de trabajo de Log Analytics, Azure Storage o soluciones que no son de Microsoft. Todas las soluciones de registro incurren en costos para procesar datos y proporcionar almacenamiento. Grandes cantidades de datos pueden incurrir en costos significativos. Considere la posibilidad de adoptar un enfoque rentable y una alternativa a Log Analytics, y calcule el costo. Considere si necesita registrar metadatos de tráfico para todas las categorías de registro.",
"type": "checklist",
"waf": "costar"
},
@@ -2582,7 +2430,7 @@
"description": "Apague estas implementaciones durante las horas de menor actividad o cuando estén inactivas para reducir los gastos innecesarios, pero mantenga la seguridad y el rendimiento durante los momentos críticos.",
"guid": "c12bc13f-aeea-4f9c-a7c0-476028848d3c",
"service": "Azure Firewall",
- "text": "Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse de forma continua. Es posible que tenga entornos de desarrollo o prueba que solo use durante el horario comercial. Para más información, consulte Desasignación y asignación de Azure Firewall.",
+ "text": "Detenga las implementaciones de Azure Firewall que no necesitan ejecutarse continuamente. Es posible que tenga entornos de desarrollo o pruebas que solo use durante el horario comercial. Para más información, consulte Desasignación y asignación de Azure Firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2590,7 +2438,7 @@
"description": "Optimice las cargas de trabajo que generan la mayor cantidad de tráfico a través del firewall para reducir el volumen de tráfico, lo que disminuye la carga en el firewall y minimiza los costos de procesamiento de datos y ancho de banda.",
"guid": "fcd6975c-5cb6-4716-9bab-fe8e7cd50e00",
"service": "Azure Firewall",
- "text": "Revise periódicamente el tráfico que Azure Firewall procesa y busque optimizaciones de carga de trabajo de origen. El registro de flujos superiores, también conocido como registro de flujos pesados, muestra las conexiones principales que contribuyen al rendimiento más alto a través del firewall.",
+ "text": "Revise periódicamente el tráfico que Azure Firewall procesa y encuentre las optimizaciones de la carga de trabajo de origen. El registro de flujos principales, también conocido como registro de flujos pesados, muestra las conexiones principales que contribuyen al rendimiento más alto a través del firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2598,7 +2446,7 @@
"description": "Utilice este enfoque para detectar implementaciones rentables a lo largo del tiempo y eliminar los recursos no utilizados, lo que evita costos innecesarios.",
"guid": "06d0aca0-59c3-4474-aea8-314ebc1d4367",
"service": "Azure Firewall",
- "text": "Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Analice las métricas de supervisión y las UDR asociadas a las subredes que apuntan a la IP privada del firewall. Tenga en cuenta también otras validaciones y documentación interna sobre el entorno y las implementaciones. Por ejemplo, analice las reglas clásicas de NAT, red y aplicación para Azure Firewall. Y ten en cuenta tu configuración. Por ejemplo, puede configurar la configuración del proxy DNS en Deshabilitado. Para más información, consulte Supervisión de Azure Firewall.",
+ "text": "Identifique y elimine las implementaciones de Azure Firewall no utilizadas. Analice las métricas de supervisión y las UDR asociadas a las subredes que apuntan a la IP privada del firewall. Tenga en cuenta también otras validaciones y documentación interna sobre el entorno y las implementaciones. Por ejemplo, analice las reglas clásicas de NAT, red y aplicación para Azure Firewall. Y ten en cuenta tu configuración. Por ejemplo, puede configurar la opción de proxy DNS en Deshabilitado. Para más información, consulte Supervisión de Azure Firewall.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2606,7 +2454,7 @@
"description": "Utilice correctamente Firewall Manager y sus políticas para reducir los costos operativos, aumentar la eficiencia y reducir la sobrecarga de administración.",
"guid": "0afd66fd-36c6-44ad-8e71-cd3b247c6816",
"service": "Azure Firewall",
- "text": "Revise detenidamente las políticas, las asociaciones y la herencia de Firewall Manager para optimizar los costos. Las políticas se facturan en función de las asociaciones de firewall. Una política con cero o una asociación de firewall es gratuita. Una política con varias asociaciones de firewall se factura a una tarifa fija. Para obtener más información, consulte Precios de Firewall Manager.",
+ "text": "Revise detenidamente las políticas, las asociaciones y la herencia de Firewall Manager para optimizar el costo. Las políticas se facturan en función de las asociaciones de firewall. Una política con cero o una asociación de firewall es gratuita. Una política con varias asociaciones de firewall se factura a una tarifa fija. Para obtener más información, consulte Precios de Firewall Manager.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2614,7 +2462,7 @@
"description": "Elimine las direcciones IP no utilizadas para reducir costos.",
"guid": "2cbff8d4-4f59-42dc-b186-58f7c4965dbe",
"service": "Azure Firewall",
- "text": "Revise todas las direcciones IP públicas de su configuración y desvincule y elimine las que no utilice. Evalúe el uso del puerto de traducción de direcciones de red de origen (SNAT) antes de eliminar cualquier dirección IP. Para más información, consulte Supervisión de los registros y métricas de Azure Firewall y el uso de puertos SNAT.",
+ "text": "Revise todas las direcciones IP públicas de su configuración y desvincule y elimine las que no use. Evalúe el uso del puerto de traducción de direcciones de red de origen (SNAT) antes de eliminar cualquier dirección IP. Para más información, consulte Supervisión de los registros y las métricas de Azure Firewall y el uso de puertos SNAT.",
"type": "recommendation",
"waf": "Costar"
},
@@ -2630,7 +2478,7 @@
"description": "",
"guid": "8271c7ff-1472-4a86-ab05-0538a869631c",
"service": "Azure Firewall",
- "text": "Mantenga copias de seguridad periódicas de los artefactos de Azure Policy. Si usa un enfoque de infraestructura como código para mantener Azure Firewall y todas las dependencias, debe contar con una copia de seguridad y un control de versiones de las directivas de Azure Firewall. Si no lo hace, puede implementar un mecanismo complementario basado en una aplicación lógica externa para proporcionar una solución automatizada eficaz.",
+ "text": "Mantenga copias de seguridad periódicas de los artefactos de Azure Policy. Si usa un enfoque de infraestructura como código para mantener Azure Firewall y todas las dependencias, debe contar con la copia de seguridad y el control de versiones de las directivas de Azure Firewall. Si no lo hace, puede implementar un mecanismo complementario basado en una aplicación lógica externa para proporcionar una solución automatizada eficaz.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -2667,10 +2515,10 @@
"waf": "Operaciones"
},
{
- "description": "Habilite los registros de diagnóstico para optimizar las herramientas y estrategias de supervisión de Azure Firewall. Utilice registros de firewall estructurados para estructurar los datos de registro de modo que sean fáciles de buscar, filtrar y analizar. Las últimas herramientas de supervisión se basan en este tipo de registro, por lo que suele ser un requisito previo.",
+ "description": "Habilite los registros de diagnóstico para optimizar las herramientas y estrategias de supervisión de Azure Firewall. Utilice los registros de firewall estructurados para estructurar los datos de registro de modo que sean fáciles de buscar, filtrar y analizar. Las herramientas de supervisión más recientes se basan en este tipo de registro, por lo que suele ser un requisito previo.",
"guid": "1069db41-1f8c-43b3-a25f-9981cc78e397",
"service": "Azure Firewall",
- "text": "Habilite los registros de diagnóstico para Azure Firewall. Use registros o libros de firewall para supervisar Azure Firewall. También puede usar los registros de actividad para auditar las operaciones en los recursos de Azure Firewall. Utilice el formato de registros de firewall estructurado. Utilice únicamente el formato de registros de diagnóstico anterior si tiene una herramienta existente que lo requiera. No habilite ambos formatos de registro al mismo tiempo.",
+ "text": "Habilite los registros de diagnóstico para Azure Firewall. Use registros o libros de firewall para supervisar Azure Firewall. También puede usar registros de actividad para auditar las operaciones en los recursos de Azure Firewall. Utilice el formato de registros de firewall estructurado. Utilice únicamente el formato de registros de diagnóstico anterior si tiene una herramienta existente que lo requiera. No habilite ambos formatos de registro al mismo tiempo.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -2683,7 +2531,7 @@
"waf": "Operaciones"
},
{
- "description": "Configure alertas para eventos clave para notificar a los operadores antes de que surjan posibles problemas, ayudar a prevenir interrupciones e iniciar ajustes rápidos de capacidad.",
+ "description": "Configure alertas de eventos clave para notificar a los operadores antes de que surjan posibles problemas, ayudar a prevenir interrupciones e iniciar ajustes rápidos de capacidad.",
"guid": "7f972e0f-0259-4783-b9e6-82c278711b0f",
"service": "Azure Firewall",
"text": "Supervise los registros y las métricas de Azure Firewall y cree alertas para la capacidad de Azure Firewall. Cree alertas para supervisar el rendimiento, el estado de mantenimiento del firewall, la utilización del puerto SNAT y las métricas de sondeo de latencia de AZFW.",
@@ -2691,7 +2539,7 @@
"waf": "Operaciones"
},
{
- "description": "Use el análisis de directivas para analizar el impacto de las directivas de Azure Firewall. Identifique los posibles problemas en sus políticas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
+ "description": "Use el análisis de directivas para analizar el impacto de las directivas de Azure Firewall. Identifique los posibles problemas de las directivas, como el cumplimiento de los límites de las directivas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
"guid": "90c06dd6-c01a-4f49-9054-7073f5c774ae",
"service": "Azure Firewall",
"text": "Revise periódicamente el panel de análisis de políticas para identificar posibles problemas.",
@@ -2699,7 +2547,7 @@
"waf": "Operaciones"
},
{
- "description": "Use las consultas de KQL para identificar rápidamente los eventos dentro del firewall y comprobar qué regla se desencadena o qué regla permite o bloquea una solicitud.",
+ "description": "Utilice las consultas de KQL para identificar rápidamente los eventos dentro del firewall y comprobar qué regla se ha activado o qué regla permite o bloquea una solicitud.",
"guid": "a3aa7729-46bd-4de6-82e6-28ac9d631b7a",
"service": "Azure Firewall",
"text": "Comprenda las consultas de KQL para que pueda usar los registros de Azure Firewall para analizar y solucionar problemas rápidamente. Azure Firewall proporciona consultas de ejemplo.",
@@ -2710,7 +2558,7 @@
"description": "",
"guid": "9e42071b-fe43-455d-afa9-5ed2c33c7d20",
"service": "Azure Firewall",
- "text": "Optimice la configuración de Azure Firewall de acuerdo con las recomendaciones de Well-Architected Framework para optimizar el código y la infraestructura y garantizar el máximo funcionamiento. Para mantener una red eficiente y segura, revise y optimice periódicamente las reglas del firewall. Esta práctica ayuda a garantizar que las configuraciones de firewall permanezcan efectivas y actualizadas con las amenazas de seguridad más recientes.",
+ "text": "Optimice la configuración de Azure Firewall de acuerdo con las recomendaciones del Marco de buena arquitectura para optimizar el código y la infraestructura y garantizar el funcionamiento máximo. Para mantener una red eficiente y segura, revise y optimice periódicamente las reglas del firewall. Esta práctica ayuda a garantizar que las configuraciones de firewall sigan siendo efectivas y estén actualizadas con las amenazas de seguridad más recientes.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -2747,7 +2595,7 @@
"waf": "rendimiento"
},
{
- "description": "Utilice el análisis de políticas para identificar posibles problemas en sus políticas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
+ "description": "Utilice el análisis de políticas para identificar posibles problemas en las directivas, como el cumplimiento de los límites de las políticas, las reglas incorrectas y el uso incorrecto de grupos de IP. Obtenga recomendaciones para mejorar su posición de seguridad y el rendimiento del procesamiento de reglas.",
"guid": "9a20f369-25cd-45ba-bda7-e56f1e379e15",
"service": "Azure Firewall",
"text": "Use el panel de análisis de directivas para identificar formas de optimizar las directivas de Azure Firewall.",
@@ -2766,7 +2614,7 @@
"description": "Este enfoque aumenta efectivamente el número de direcciones IP que puede cubrir sin exceder el límite. Para cada regla, Azure multiplica los puertos por direcciones IP. Por lo tanto, si una regla tiene cuatro intervalos de direcciones IP y cinco puertos, consume 20 reglas de red.",
"guid": "1d2f023e-7dcf-4f55-b07f-1a93c9c0ab4e",
"service": "Azure Firewall",
- "text": "Utilice grupos de direcciones IP para resumir los intervalos de direcciones IP y evitar superar el límite de reglas de red de origen o destino único. Azure Firewall trata el grupo de direcciones IP como una única dirección al crear reglas de red.",
+ "text": "Utilice los grupos de direcciones IP para resumir los intervalos de direcciones IP y evitar superar el límite de las reglas de red de origen o destino único. Azure Firewall trata el grupo IP como una única dirección al crear reglas de red.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -2779,7 +2627,7 @@
"waf": "Rendimiento"
},
{
- "description": "Habilite IDPS en modo de alerta y denegación para detectar y prevenir actividades maliciosas en la red. Esta característica podría introducir una penalización del rendimiento. Comprenda el efecto en su carga de trabajo para que pueda planificar en consecuencia.",
+ "description": "Habilite IDPS en modo de alerta y denegación para detectar y prevenir actividad de red maliciosa. Esta característica podría introducir una penalización en el rendimiento. Comprenda el efecto en su carga de trabajo para que pueda planificar en consecuencia.",
"guid": "984c7d68-82f6-48e9-a894-a8e7717d49e2",
"service": "Azure Firewall",
"text": "Evalúe el impacto en el rendimiento de IDPS en modo de alerta y denegación. Para más información, consulte Rendimiento de Azure Firewall.",
@@ -2806,7 +2654,7 @@
"description": "",
"guid": "51f023f3-53b4-4878-8548-2b08a6b095ab",
"service": "Azure Front Door",
- "text": "Elija su estrategia de implementación. Los enfoques de implementación fundamentales son activo-activo y activo-pasivo. La implementación activo-activo significa que varios entornos o marcas que ejecutan la carga de trabajo atienden el tráfico. La implementación activa-pasiva significa que solo la región primaria controla todo el tráfico, pero conmuta por error a la región secundaria cuando es necesario. En una implementación multirregional, las marcas se ejecutan en diferentes regiones para una mayor disponibilidad con un equilibrador de carga global, como Azure Front Door, que distribuye el tráfico. Por lo tanto, es importante configurar el equilibrador de carga para el enfoque de implementación adecuado.",
+ "text": "Elija su estrategia de implementación. Los enfoques de implementación fundamentales son activo-activo y activo-pasivo. La implementación activo-activo significa que varios entornos o marcas que ejecutan la carga de trabajo atienden el tráfico. La implementación activa-pasiva significa que solo la región primaria controla todo el tráfico, pero conmuta por error a la región secundaria cuando es necesario. En una implementación de varias regiones, las marcas se ejecutan en diferentes regiones para una mayor disponibilidad con un equilibrador de carga global, como Azure Front Door, que distribuye el tráfico. Por lo tanto, es importante configurar el equilibrador de carga para el enfoque de implementación adecuado.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -2838,7 +2686,7 @@
"description": "",
"guid": "750bc3ba-30aa-44fc-88aa-bc93cdf29cdf",
"service": "Azure Front Door",
- "text": "Considere una opción de administración de tráfico redundante. Azure Front Door es un servicio distribuido globalmente que se ejecuta como un singleton en un entorno. Azure Front Door es un posible punto único de error en el sistema. Si se produce un error en el servicio, los clientes no podrán acceder a la aplicación durante el tiempo de inactividad.",
+ "text": "Considere una opción de administración de tráfico redundante. Azure Front Door es un servicio distribuido globalmente que se ejecuta como un singleton en un entorno. Azure Front Door es un posible punto único de error en el sistema. Si se produce un error en el servicio, los clientes no pueden acceder a la aplicación durante el tiempo de inactividad.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -2846,7 +2694,7 @@
"description": "Puede seleccionar el mejor recurso de origen mediante una serie de pasos de decisión y su diseño. El origen seleccionado atiende el tráfico dentro del rango de latencia permitido en la proporción de ponderaciones especificada.",
"guid": "1a6fba56-5098-4506-9be0-940fe556996c",
"service": "Azure Front Door",
- "text": "Elija un método de enrutamiento que admita su estrategia de implementación. El método ponderado, que distribuye el tráfico en función del coeficiente de ponderación configurado, admite modelos activo-activo. Un valor basado en prioridades que configura la región primaria para recibir todo el tráfico y enviar tráfico a la región secundaria como copia de seguridad admite modelos activo-pasivo. Combine los métodos anteriores con la latencia para que el origen con la latencia más baja reciba tráfico.",
+ "text": "Elija un método de enrutamiento que admita su estrategia de implementación. El método ponderado, que distribuye el tráfico en función del coeficiente de ponderación configurado, admite modelos activo-activo. Un valor basado en prioridad que configura la región primaria para recibir todo el tráfico y enviarlo a la región secundaria como copia de seguridad admite modelos activo-pasivo. Combine los métodos anteriores con la latencia para que el origen con la latencia más baja reciba tráfico.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -2859,7 +2707,7 @@
"waf": "Fiabilidad"
},
{
- "description": "Los sondeos de estado habilitados forman parte de la implementación del patrón de supervisión de estado. Los sondeos de estado se aseguran de que Azure Front Door solo enruta el tráfico a las instancias que están en buen estado para controlar las solicitudes. Para obtener más información, consulte Procedimientos recomendados sobre sondeos de estado.",
+ "description": "Los sondeos de estado habilitados forman parte de la implementación del patrón de supervisión de estado. Los sondeos de estado se aseguran de que Azure Front Door solo enruta el tráfico a las instancias que están en buen estado para controlar las solicitudes. Para obtener más información, consulte Procedimientos recomendados para sondeos de estado.",
"guid": "17fbec2c-ddb4-4490-946c-a151ae0fadd4",
"service": "Azure Front Door",
"text": "Configure sondeos de estado en el origen. Configure Azure Front Door para realizar comprobaciones de estado a fin de determinar si la instancia de back-end está disponible y lista para seguir recibiendo solicitudes.",
@@ -2870,7 +2718,7 @@
"description": "Los tiempos de espera ayudan a evitar problemas de rendimiento y disponibilidad al finalizar las solicitudes que tardan más de lo esperado en completarse.",
"guid": "1a308f11-1d93-4d57-bd84-cbd8f6198dd2",
"service": "Azure Front Door",
- "text": "Establezca un tiempo de espera para reenviar solicitudes al back-end. Ajuste la configuración de tiempo de espera según las necesidades de sus terminales. Si no lo hace, Azure Front Door podría cerrar la conexión antes de que el origen envíe la respuesta. También puede reducir el tiempo de espera predeterminado para Azure Front Door si todos los orígenes tienen un tiempo de espera más corto. Para obtener más información, consulte Solución de problemas de solicitudes que no responden.",
+ "text": "Establezca un tiempo de espera para reenviar solicitudes al back-end. Ajuste la configuración del tiempo de espera según las necesidades de sus terminales. Si no lo hace, Azure Front Door podría cerrar la conexión antes de que el origen envíe la respuesta. También puede reducir el tiempo de espera predeterminado para Azure Front Door si todos los orígenes tienen un tiempo de espera más corto. Para obtener más información, consulte Solución de problemas de solicitudes que no responden.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -2878,12 +2726,12 @@
"description": "Establezca el mismo nombre de host para evitar un mal funcionamiento con la afinidad de sesión, la autenticación y la autorización. Para obtener más información, consulte Conservar el nombre de host HTTP original entre un proxy inverso y su aplicación web back-end.",
"guid": "7af90aa7-b21f-432f-858b-2d872c752d7f",
"service": "Azure Front Door",
- "text": "Use el mismo nombre de host en Azure Front Door y en el origen. Azure Front Door puede reescribir el encabezado de host de las solicitudes entrantes, lo que resulta útil cuando hay varios nombres de dominio personalizados que se enrutan a un origen. Sin embargo, reescribir el encabezado del host puede causar problemas con las cookies de solicitud y el redireccionamiento de URL.",
+ "text": "Use el mismo nombre de host en Azure Front Door y en su origen. Azure Front Door puede reescribir el encabezado de host de las solicitudes entrantes, lo que resulta útil cuando hay varios nombres de dominio personalizados que se enrutan a un origen. Sin embargo, reescribir el encabezado del host puede causar problemas con las cookies de solicitud y el redireccionamiento de URL.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Con la afinidad de sesión, las conexiones de usuario permanecen en el mismo origen durante la sesión de usuario. Si ese origen deja de estar disponible, es posible que la experiencia del usuario se vea interrumpida.",
+ "description": "Con la afinidad de sesión, las conexiones de usuario permanecen en el mismo origen durante la sesión de usuario. Si ese origen deja de estar disponible, es posible que se interrumpa la experiencia del usuario.",
"guid": "f66a8d49-8d0a-4952-9db2-ac2e526f08ad",
"service": "Azure Front Door",
"text": "Decida si la aplicación requiere afinidad de sesión. Si tiene requisitos de alta confiabilidad, le recomendamos que deshabilite la afinidad de sesión.",
@@ -2918,7 +2766,7 @@
"description": "",
"guid": "903b1844-994a-49e8-8e08-6ef445aec4f7",
"service": "Azure Front Door",
- "text": "Permitir solo el acceso autorizado al plano de control. Use el control de acceso basado en roles (RBAC) de Azure Front Door para restringir el acceso solo a las identidades que lo necesiten.",
+ "text": "Permitir solo el acceso autorizado al plano de control. Use el control de acceso basado en rol (RBAC) de Azure Front Door para restringir el acceso solo a las identidades que lo necesiten.",
"type": "checklist",
"waf": "seguridad"
},
@@ -2934,7 +2782,7 @@
"description": "",
"guid": "d323ca3c-f7df-4f7e-b7c9-698d2bdad3e2",
"service": "Azure Front Door",
- "text": "Proteja Azure Front Door frente al tráfico inesperado. Azure Front Door usa el plan básico de protección contra DDoS de Azure para proteger los puntos de conexión de las aplicaciones frente a ataques DDoS. Si necesita exponer otras direcciones IP públicas de su aplicación, considere la posibilidad de agregar el plan estándar DDoS Protection para esas direcciones para capacidades avanzadas de protección y detección.",
+ "text": "Proteja Azure Front Door frente al tráfico inesperado. Azure Front Door usa el plan básico de protección contra DDoS de Azure para proteger los puntos de conexión de la aplicación frente a ataques DDoS. Si necesita exponer otras direcciones IP públicas de su aplicación, considere la posibilidad de agregar el plan estándar DDoS Protection para esas direcciones para capacidades avanzadas de protección y detección.",
"type": "checklist",
"waf": "seguridad"
},
@@ -2955,7 +2803,7 @@
"waf": "seguridad"
},
{
- "description": "Los conjuntos de reglas predeterminados se actualizan con frecuencia en función de los 10 tipos de ataque principales de OWASP y de la información de Microsoft Threat Intelligence. Los conjuntos de reglas especializadas detectan ciertos casos de uso. Por ejemplo, las reglas de bots clasifican los bots como buenos, malos o desconocidos en función de las direcciones IP del cliente. También bloquean los bots maliciosos y las direcciones IP conocidas y restringen el tráfico en función de la ubicación geográfica de las personas que llaman. Mediante el uso de una combinación de conjuntos de reglas, puede detectar y bloquear ataques con varias intenciones.",
+ "description": "Los conjuntos de reglas predeterminados se actualizan con frecuencia en función de los 10 tipos de ataque principales de OWASP y de la información de Microsoft Threat Intelligence. Los conjuntos de reglas especializadas detectan determinados casos de uso. Por ejemplo, las reglas de bots clasifican los bots como buenos, malos o desconocidos en función de las direcciones IP del cliente. También bloquean los bots maliciosos y las direcciones IP conocidas, y restringen el tráfico en función de la ubicación geográfica de las personas que llaman. Mediante el uso de una combinación de conjuntos de reglas, puede detectar y bloquear ataques con varias intenciones.",
"guid": "711c450c-ac42-4570-b2fd-22319b4a7913",
"service": "Azure Front Door",
"text": "Habilite los conjuntos de reglas de WAF que detectan y bloquean el tráfico potencialmente malintencionado. Esta función está disponible en el nivel Premium. Recomendamos estos conjuntos de reglas: - Predeterminado- Protección contra bots- Restricción de IP- Filtrado geográfico- Limitación de velocidad",
@@ -2974,7 +2822,7 @@
"description": "TLS garantiza que los intercambios de datos entre el explorador, Azure Front Door y los orígenes de back-end estén cifrados para evitar la manipulación. Key Vault ofrece compatibilidad con certificados administrados y renovación y rotación sencillas de certificados.",
"guid": "450b511f-9e82-45ce-986b-769ea00dbeaa",
"service": "Azure Front Door",
- "text": "Habilite TLS de extremo a extremo, redireccionamiento de HTTP a HTTPS y certificados TLS administrados cuando corresponda. Revise los procedimientos recomendados de TLS para Azure Front Door. Utilice la versión 1.2 de TLS como la versión mínima permitida con cifrados que sean relevantes para su aplicación. Los certificados administrados de Azure Front Door deben ser la opción predeterminada para facilitar las operaciones. Sin embargo, si desea administrar el ciclo de vida de los certificados, use sus propios certificados en los puntos de conexión de dominio personalizado de Azure Front Door y almacénelos en Key Vault.",
+ "text": "Habilite TLS de extremo a extremo, redireccionamiento de HTTP a HTTPS y certificados TLS administrados cuando corresponda. Revise los procedimientos recomendados de TLS para Azure Front Door. Utilice la versión 1.2 de TLS como la versión mínima permitida con cifrados que sean relevantes para su aplicación. Los certificados administrados de Azure Front Door deben ser la opción predeterminada para facilitar las operaciones. Sin embargo, si desea administrar el ciclo de vida de los certificados, use sus propios certificados en los puntos de conexión de dominio personalizados de Azure Front Door y almacénelos en Key Vault.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -2990,7 +2838,7 @@
"description": "",
"guid": "ed02627c-4a6d-4d6e-982f-a1fbee4a7259",
"service": "Azure Front Door",
- "text": "Tenga en cuenta los costos de ancho de banda. Los costos de ancho de banda de Azure Front Door dependen del nivel que elija y del tipo de transferencia de datos. Azure Front Door proporciona informes integrados para métricas facturables. Para evaluar los costos relacionados con el ancho de banda y dónde puede centrar sus esfuerzos de optimización, consulte Informes de Azure Front Door.",
+ "text": "Tenga en cuenta los costos de ancho de banda. Los costos de ancho de banda de Azure Front Door dependen del nivel que elija y del tipo de transferencia de datos. Azure Front Door proporciona informes integrados para las métricas facturables. Para evaluar los costos relacionados con el ancho de banda y dónde puede centrar sus esfuerzos de optimización, consulte Informes de Azure Front Door.",
"type": "checklist",
"waf": "costar"
},
@@ -2998,7 +2846,7 @@
"description": "",
"guid": "e2e0bb7e-521d-4729-9579-5c9539a68867",
"service": "Azure Front Door",
- "text": "Optimice las solicitudes entrantes. Azure Front Door factura las solicitudes entrantes. Puede establecer restricciones en la configuración del diseño.",
+ "text": "Optimice las solicitudes entrantes. Azure Front Door factura las solicitudes entrantes. Puede establecer restricciones en la configuración de diseño.",
"type": "checklist",
"waf": "costar"
},
@@ -3006,7 +2854,7 @@
"description": "",
"guid": "337e7030-494e-4be5-8920-9144cb02c399",
"service": "Azure Front Door",
- "text": "Utilice los recursos de manera eficiente. Azure Front Door usa un método de enrutamiento que ayuda con la optimización de recursos. A menos que la carga de trabajo sea extremadamente sensible a la latencia, distribuya el tráfico de manera uniforme en todos los entornos para usar eficazmente los recursos implementados.",
+ "text": "Utilice los recursos de manera eficiente. Azure Front Door usa un método de enrutamiento que ayuda a optimizar los recursos. A menos que la carga de trabajo sea extremadamente sensible a la latencia, distribuya el tráfico de manera uniforme en todos los entornos para usar eficazmente los recursos implementados.",
"type": "checklist",
"waf": "costar"
},
@@ -3014,7 +2862,7 @@
"description": "",
"guid": "add1a775-b13c-477b-acc7-38dbcccd51fe",
"service": "Azure Front Door",
- "text": "Considere la posibilidad de usar una instancia compartida proporcionada por la organización. Los costos incurridos por los servicios centralizados se comparten entre las cargas de trabajo. Sin embargo, considere la compensación con la confiabilidad. Para las aplicaciones críticas que tienen requisitos de alta disponibilidad, recomendamos una instancia autónoma.",
+ "text": "Considere la posibilidad de usar una instancia compartida proporcionada por la organización. Los costos incurridos por los servicios centralizados se comparten entre las cargas de trabajo. Sin embargo, considere la compensación con la confiabilidad. En el caso de las aplicaciones críticas que tienen requisitos de alta disponibilidad, se recomienda una instancia autónoma.",
"type": "checklist",
"waf": "costar"
},
@@ -3054,7 +2902,7 @@
"description": "",
"guid": "5e8bfd0e-20d9-441f-814d-c2b49e7033ea",
"service": "Azure Front Door",
- "text": "Utilice tecnologías de infraestructura como código (IaC). Use tecnologías de IaC como Bicep y plantillas de Azure Resource Manager para aprovisionar la instancia de Azure Front Door. Estos enfoques declarativos proporcionan coherencia y un mantenimiento sencillo. Por ejemplo, mediante el uso de tecnologías IaC, puede adoptar fácilmente nuevas versiones de conjuntos de reglas.",
+ "text": "Utilice tecnologías de infraestructura como código (IaC). Use tecnologías de IaC, como Bicep y plantillas de Azure Resource Manager, para aprovisionar la instancia de Azure Front Door. Estos enfoques declarativos proporcionan coherencia y un mantenimiento sencillo. Por ejemplo, mediante el uso de tecnologías IaC, puede adoptar fácilmente nuevas versiones de conjuntos de reglas.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3062,7 +2910,7 @@
"description": "",
"guid": "e9bd20e3-6e61-4907-9b84-4bd50b867875",
"service": "Azure Front Door",
- "text": "Simplifique las configuraciones. Use Azure Front Door para administrar fácilmente las configuraciones. Por ejemplo, supongamos que la arquitectura admite microservicios. Azure Front Door admite funcionalidades de redireccionamiento, por lo que puede usar el redireccionamiento basado en rutas de acceso para dirigirse a servicios individuales.",
+ "text": "Simplifique las configuraciones. Use Azure Front Door para administrar fácilmente las configuraciones. Por ejemplo, supongamos que su arquitectura admite microservicios. Azure Front Door admite funcionalidades de redireccionamiento, por lo que puede usar el redireccionamiento basado en rutas de acceso para dirigirse a servicios individuales.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3078,7 +2926,7 @@
"description": "",
"guid": "5e1264a9-c6cc-4d4e-8e73-7ca4b3f05c17",
"service": "Azure Front Door",
- "text": "Recopile y analice datos operativos de Azure Front Door como parte de la supervisión de la carga de trabajo. Capture las métricas y los registros relevantes de Azure Front Door con los registros de Azure Monitor. Estos datos le ayudan a solucionar problemas, comprender los comportamientos de los usuarios y optimizar las operaciones.",
+ "text": "Recopile y analice los datos operativos de Azure Front Door como parte de la supervisión de la carga de trabajo. Capture las métricas y los registros relevantes de Azure Front Door con los registros de Azure Monitor. Estos datos le ayudan a solucionar problemas, comprender los comportamientos de los usuarios y optimizar las operaciones.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3115,7 +2963,7 @@
"waf": "Operaciones"
},
{
- "description": "Azure Front Door puede emitir y administrar certificados por usted. Esta función elimina la necesidad de renovar certificados y minimiza el riesgo de una interrupción debido a un certificado TLS no válido o caducado.",
+ "description": "Azure Front Door puede emitir y administrar certificados automáticamente. Esta función elimina la necesidad de renovar certificados y minimiza el riesgo de una interrupción debido a un certificado TLS no válido o caducado.",
"guid": "c2fcfdfb-fedb-4b47-93ac-1988250f76cd",
"service": "Azure Front Door",
"text": "Utilice certificados TLS administrados cuando sea posible.",
@@ -3134,7 +2982,7 @@
"description": "",
"guid": "d18003c9-2d90-4e52-b503-5fcdb4ffcd96",
"service": "Azure Front Door",
- "text": "Planifique la capacidad mediante el análisis de los patrones de tráfico esperados. Realice pruebas exhaustivas para comprender el rendimiento de su aplicación bajo diferentes cargas. Tenga en cuenta factores como las transacciones simultáneas, las tasas de solicitudes y la transferencia de datos.",
+ "text": "Planifique la capacidad analizando los patrones de tráfico esperados. Realice pruebas exhaustivas para comprender el rendimiento de su aplicación bajo diferentes cargas. Tenga en cuenta factores como las transacciones simultáneas, las tasas de solicitud y la transferencia de datos.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -3182,7 +3030,7 @@
"description": "Azure Front Door ofrece una solución de red de entrega de contenido sólida que almacena en caché el contenido en el perímetro de la red. El almacenamiento en caché reduce la carga en los servidores back-end y reduce el movimiento de datos a través de la red, lo que ayuda a descargar el uso del ancho de banda.",
"guid": "2f6a39a1-884a-4661-accd-f534bf795a96",
"service": "Azure Front Door",
- "text": "Habilite el almacenamiento en caché. Puede optimizar las cadenas de consulta para el almacenamiento en caché. En el caso de contenido puramente estático, omita las cadenas de consulta para maximizar el uso de la memoria caché. Si la aplicación usa cadenas de consulta, considere la posibilidad de incluirlas en la clave de caché. La inclusión de las cadenas de consulta en la clave de caché permite a Azure Front Door servir respuestas almacenadas en caché u otras respuestas, en función de la configuración.",
+ "text": "Habilite el almacenamiento en caché. Puede optimizar las cadenas de consulta para el almacenamiento en caché. En el caso de contenido puramente estático, omita las cadenas de consulta para maximizar el uso de la memoria caché. Si la aplicación usa cadenas de consulta, considere incluirlas en la clave de caché. La inclusión de las cadenas de consulta en la clave de caché permite a Azure Front Door servir respuestas almacenadas en caché u otras respuestas, en función de la configuración.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -3206,7 +3054,7 @@
"description": "Optimice el rendimiento y mantenga la continuidad de las sesiones de usuario, especialmente cuando las aplicaciones dependen del mantenimiento de la información de estado localmente.",
"guid": "2a92f55e-a422-49f4-9a26-8ba819a17323",
"service": "Azure Front Door",
- "text": "Evalúe si debe habilitar la afinidad de sesión cuando las solicitudes del mismo usuario deben dirigirse al mismo servidor back-end. Desde el punto de vista de la confiabilidad, no recomendamos este enfoque. Si usa esta opción, la aplicación debería recuperarse correctamente sin interrumpir las sesiones de usuario. También hay una compensación en el equilibrio de carga, ya que restringe la flexibilidad de distribuir el tráfico entre varios back-ends de manera uniforme.",
+ "text": "Evalúe si debe habilitar la afinidad de sesión cuando las solicitudes del mismo usuario deben dirigirse al mismo servidor back-end. Desde el punto de vista de la confiabilidad, no se recomienda este enfoque. Si usa esta opción, la aplicación debería recuperarse correctamente sin interrumpir las sesiones de usuario. También hay una compensación en el equilibrio de carga, ya que restringe la flexibilidad de distribuir el tráfico entre varios back-ends de manera uniforme.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -3222,7 +3070,7 @@
"description": "",
"guid": "904fdfa5-af9a-4195-b683-e3bb7627b394",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: planifique el espacio de direcciones IP para asegurarse de que el clúster pueda escalar de forma fiable, incluida la gestión del tráfico de conmutación por error en topologías de varios clústeres.",
+ "text": "Arquitectura de clúster: planifique el espacio de direcciones IP para asegurarse de que el clúster pueda escalar de forma fiable, incluido el control del tráfico de conmutación por error en topologías de varios clústeres.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3259,7 +3107,7 @@
"waf": "fiabilidad"
},
{
- "description": "Permite que el programador de Kubernetes aísle lógicamente las cargas de trabajo por hardware en el nodo. A diferencia de las tolerancias, los pods sin un selector de nodos coincidentes se pueden programar en nodos etiquetados, lo que permite que se consuman los recursos no utilizados en los nodos, pero da prioridad a los pods que definen el selector de nodos coincidentes. Utilice la afinidad de nodo para obtener más flexibilidad, lo que le permite definir qué sucede si el pod no puede coincidir con un nodo.",
+ "description": "Permite que el programador de Kubernetes aísle lógicamente las cargas de trabajo por hardware en el nodo. A diferencia de las tolerancias, los pods sin un selector de nodos coincidente se pueden programar en nodos etiquetados, lo que permite que los recursos no utilizados de los nodos se consuman, pero da prioridad a los pods que definen el selector de nodos coincidente. Utilice la afinidad de nodo para obtener más flexibilidad, lo que le permite definir qué sucede si el pod no se puede hacer coincidir con un nodo.",
"guid": "b11892cd-f678-4399-bac8-b98095e250c6",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: controle la programación de pods mediante selectores de nodos y afinidad.",
@@ -3294,7 +3142,7 @@
"description": "Las cargas de trabajo orientadas a Internet deben aprovechar Azure Front Door o Azure Traffic Manager para enrutar el tráfico globalmente a través de clústeres de AKS.",
"guid": "844d923f-cfe0-4a3a-97ff-67c072c4220c",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: adopte una estrategia de varias regiones mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
+ "text": "Arquitectura de clústeres: adopte una estrategia multirregional mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -3302,7 +3150,7 @@
"description": "Los límites de recursos de memoria y CPU del contenedor son necesarios para evitar el agotamiento de recursos en el clúster de Kubernetes.",
"guid": "f1a92d3f-eab5-4dc2-b0e8-75865842f205",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: defina las solicitudes y los límites de recursos de pods en los manifiestos de implementación de aplicaciones y aplíquelos con Azure Policy.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: defina las solicitudes y los límites de recursos de pod en los manifiestos de implementación de aplicaciones y aplíquelos con Azure Policy.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -3315,10 +3163,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Es posible que las aplicaciones compartan la misma configuración y necesiten máquinas virtuales habilitadas para GPU, máquinas virtuales optimizadas para CPU o memoria, o la capacidad de escalar a cero. Evite un gran número de grupos de nodos para reducir la sobrecarga de administración adicional.",
+ "description": "Las aplicaciones pueden compartir la misma configuración y necesitar máquinas virtuales habilitadas para GPU, máquinas virtuales optimizadas para CPU o memoria, o la capacidad de escalar a cero. Evite un gran número de grupos de nodos para reducir la sobrecarga de administración adicional.",
"guid": "3603ec74-ada6-4050-baa3-fb25386fb7df",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: separe las aplicaciones de los grupos de nodos dedicados en función de requisitos específicos.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: separe las aplicaciones en grupos de nodos dedicados en función de requisitos específicos.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -3358,7 +3206,7 @@
"description": "",
"guid": "8e9c196f-b93a-46c5-9507-1e5cad83dd21",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: implemente un clúster de AKS privado para asegurarse de que el tráfico de administración de clústeres al servidor de API permanece en la red privada. O bien, utilice la lista de permitidos del servidor de API para clústeres no privados.",
+ "text": "Arquitectura de clúster: implemente un clúster privado de AKS para asegurarse de que el tráfico de administración de clústeres al servidor de API permanece en la red privada. O bien, utilice la lista de permitidos del servidor de API para clústeres no privados.",
"type": "checklist",
"waf": "seguridad"
},
@@ -3374,7 +3222,7 @@
"description": "",
"guid": "feba8909-0760-4a87-833a-b36fabbe722e",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de carga de trabajo: asegúrese de que su canalización de CI/CID esté reforzada con el análisis compatible con contenedores.",
+ "text": "Arquitectura de carga de trabajo: asegúrese de que su canalización de CI/CID esté reforzada con el análisis según contenedores.",
"type": "checklist",
"waf": "seguridad"
},
@@ -3390,7 +3238,7 @@
"description": "AKS y Microsoft Entra ID habilitan la autenticación con Azure Container Registry sin el uso de secretos 'imagePullSecrets'. Para obtener más información, consulte Autenticación con Azure Container Registry de Azure Kubernetes Service.",
"guid": "f9f7946f-b9b6-40d1-9f30-0bfb38be5c74",
"service": "Azure Kubernetes Service",
- "text": null,
+ "text": "Arquitectura de clúster: autentique con el identificador de Microsoft Entra en Azure Container Registry.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -3406,7 +3254,7 @@
"description": "Al utilizar clústeres públicos, aún puede limitar el tráfico que puede llegar al servidor de API de clústeres mediante la característica de rango de IP autorizado. Incluya orígenes como las direcciones IP públicas de los agentes de compilación de implementación, la administración de operaciones y el punto de salida de los grupos de nodos (como Azure Firewall).",
"guid": "b845e9a6-c5f3-4cf7-a956-6f1ffde88569",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: en el caso de los clústeres de AKS no privados, use intervalos de direcciones IP autorizados por el servidor de API.",
+ "text": "Arquitectura de clúster: en el caso de los clústeres de AKS no privados, use los intervalos IP autorizados por el servidor de API.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -3427,12 +3275,12 @@
"waf": "Seguridad"
},
{
- "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a gran escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo va en contra de la política de la empresa.",
+ "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo se ejecuta en contra de la política de la empresa.",
"guid": "d65686d0-3988-49b5-8a98-59818ba81c50",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clústeres: proteja clústeres y pods con Azure Policy.",
+ "text": "Arquitectura de clústeres: proteja los clústeres y los pods con Azure Policy.",
"type": "recommendation",
- "waf": null
+ "waf": "Seguridad"
},
{
"description": "Limite el acceso a las acciones que pueden realizar los contenedores. Proporcione el menor número de permisos y evite el uso de la raíz o la escalada con privilegios.",
@@ -3440,7 +3288,7 @@
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: acceso seguro de contenedores a los recursos.",
"type": "recommendation",
- "waf": null
+ "waf": "Seguridad"
},
{
"description": "Para examinar el tráfico entrante en busca de posibles ataques, use un firewall de aplicaciones web como Azure Web Application Firewall (WAF) en Azure Application Gateway o Azure Front Door.",
@@ -3448,10 +3296,10 @@
"service": "Azure Kubernetes Service",
"text": "Arquitectura de carga de trabajo: utilice un firewall de aplicaciones web para proteger el tráfico HTTP(S).",
"type": "recommendation",
- "waf": null
+ "waf": "Seguridad"
},
{
- "description": "Asegúrese de que el tráfico de salida del clúster pasa a través de un punto de seguridad de red, como Azure Firewall o un proxy HTTP.",
+ "description": "Asegúrese de que el tráfico saliente del clúster pasa a través de un punto de seguridad de red, como Azure Firewall o un proxy HTTP.",
"guid": "fa580200-65eb-4cc8-9c23-a5e68f1d86a7",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: controle el tráfico de salida del clúster.",
@@ -3459,7 +3307,7 @@
"waf": "Seguridad"
},
{
- "description": "Proteja y rote secretos, certificados y cadenas de conexión en Azure Key Vault con un cifrado seguro. Proporciona un registro de auditoría de acceso y mantiene los secretos principales fuera de la canalización de implementación.",
+ "description": "Proteja y rote secretos, certificados y cadenas de conexión en Azure Key Vault con cifrado seguro. Proporciona un registro de auditoría de acceso y mantiene los secretos principales fuera de la canalización de implementación.",
"guid": "0f5b5089-02fc-4f46-839c-7ff86610366a",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: use el identificador de carga de trabajo de Microsoft Entra de código abierto y el controlador CSI del almacén de secretos con Azure Key Vault.",
@@ -3478,7 +3326,7 @@
"description": "",
"guid": "c5148caa-6478-4ba8-993b-1a8640716d66",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: use la SKU de máquina virtual adecuada por grupo de nodos y las instancias reservadas en las que se espera capacidad a largo plazo.",
+ "text": "Arquitectura de clúster: utilice la SKU de máquina virtual adecuada por grupo de nodos e instancias reservadas en las que se espere capacidad a largo plazo.",
"type": "checklist",
"waf": "costar"
},
@@ -3494,7 +3342,7 @@
"description": "",
"guid": "df9bb42d-c34f-488f-a50c-0624ca247647",
"service": "Azure Kubernetes Service",
- "text": null,
+ "text": "Arquitectura de clúster: revise las métricas de rendimiento, empezando por la CPU, la memoria, el almacenamiento y la red, para identificar oportunidades de optimización de costos por clúster, nodos y espacio de nombres.",
"type": "checklist",
"waf": "costar"
},
@@ -3515,7 +3363,7 @@
"waf": "Costar"
},
{
- "description": "La selección del tipo de instancia de máquina virtual correcto es fundamental, ya que afecta directamente al costo de ejecutar aplicaciones en AKS. La elección de una instancia de alto rendimiento sin una utilización adecuada puede generar gastos innecesarios, mientras que la elección de una instancia menos potente puede provocar problemas de rendimiento y un mayor tiempo de inactividad. Para determinar el tipo de instancia de máquina virtual adecuado, tenga en cuenta las características de la carga de trabajo, los requisitos de recursos y las necesidades de disponibilidad.",
+ "description": "La selección del tipo de instancia de máquina virtual correcto es fundamental, ya que afecta directamente al costo de ejecutar aplicaciones en AKS. La elección de una instancia de alto rendimiento sin la utilización adecuada puede generar gastos innecesarios, mientras que la elección de una instancia menos potente puede provocar problemas de rendimiento y un mayor tiempo de inactividad. Para determinar el tipo de instancia de máquina virtual adecuado, tenga en cuenta las características de la carga de trabajo, los requisitos de recursos y las necesidades de disponibilidad.",
"guid": "1088060f-7467-48db-950d-5890503e2974",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: seleccione el tipo de instancia de máquina virtual adecuado.",
@@ -3531,7 +3379,7 @@
"waf": "Costar"
},
{
- "description": "Las máquinas virtuales de acceso puntual le permiten aprovechar la capacidad de Azure no utilizada con importantes descuentos (hasta un 90 % en comparación con los precios de pago por uso). Si Azure necesita recuperar capacidad, la infraestructura de Azure expulsa los nodos de acceso puntual.",
+ "description": "Las máquinas virtuales de acceso puntual le permiten aprovechar la capacidad de Azure no utilizada con importantes descuentos (hasta el 90 % en comparación con los precios de pago por uso). Si Azure necesita recuperar capacidad, la infraestructura de Azure expulsa los nodos de acceso puntual.",
"guid": "7a281f48-217a-4668-aa30-c9d2c84d0d72",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: seleccione Azure Spot Virtual Machines.",
@@ -3547,7 +3395,7 @@
"waf": "Costar"
},
{
- "description": "La optimización de las imágenes ayuda a reducir los costos, ya que los nuevos nodos necesitan descargar estas imágenes. Cree imágenes de forma que permita que el contenedor se inicie lo antes posible para ayudar a evitar errores de solicitud de usuario o tiempos de espera mientras se inicia la aplicación, lo que podría provocar un sobreaprovisionamiento.",
+ "description": "La optimización de las imágenes ayuda a reducir los costos, ya que los nuevos nodos necesitan descargar estas imágenes. Cree imágenes de forma que permita que el contenedor se inicie lo antes posible para ayudar a evitar errores de solicitud de usuario o tiempos de espera mientras se inicia la aplicación, lo que podría provocar un aprovisionamiento excesivo.",
"guid": "65d3f70e-457a-4d62-8140-de2b0c4f7f99",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de carga de trabajo: Mantenga imágenes pequeñas y optimizadas.",
@@ -3555,7 +3403,7 @@
"waf": "Costar"
},
{
- "description": "Reducir automáticamente el número de nodos del clúster de AKS permite ejecutar un clúster eficaz cuando la demanda es baja y escalar verticalmente cuando vuelve la demanda.",
+ "description": "La reducción vertical automática del número de nodos del clúster de AKS permite ejecutar un clúster eficaz cuando la demanda es baja y escalar verticalmente cuando se recupera la demanda.",
"guid": "b4d583e3-7268-41d9-9e93-0394bed77298",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: habilite el escalador automático de clústeres para reducir automáticamente el número de nodos de agente en respuesta al exceso de capacidad de recursos.",
@@ -3571,26 +3419,26 @@
"waf": "Costar"
},
{
- "description": "Ajuste el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas, que admitan operaciones de reducción horizontal de clústeres.",
+ "description": "Ajuste el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas, que admiten operaciones de reducción horizontal de clústeres.",
"guid": "d3194174-d037-4a35-9cd5-244d377cfabb",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de cargas de trabajo: usa el escalador automático horizontal de pods.",
+ "text": "Arquitectura de carga de trabajo: use el escalador automático de pods horizontal.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Ajusta el tamaño de tus pods y establece dinámicamente solicitudes y límites en función del uso histórico.",
+ "description": "Ajusta el tamaño de tus pods y establece dinámicamente las solicitudes y los límites en función del uso histórico.",
"guid": "091dc052-7bf8-4dd1-aca1-d514ddcb2aa8",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de carga de trabajo: use el escalador automático de pods verticales (versión preliminar).",
+ "text": "Arquitectura de carga de trabajo: use el escalador automático de pods vertical (versión preliminar).",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Escala en función del número de eventos que se están procesando. Elija entre un amplio catálogo de 50+ escaladores KEDA.",
+ "description": "Escale en función del número de eventos que se están procesando. Elija entre un amplio catálogo de 50+ escaladores KEDA.",
"guid": "fe3d7c5f-f5a9-4b5e-a4f9-81bf76930967",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de carga de trabajo: use el escalado automático basado en eventos (KEDA) de Kubernetes.",
+ "text": "Arquitectura de carga de trabajo: use el escalado automático controlado por eventos (KEDA) de Kubernetes.",
"type": "recommendation",
"waf": "Costar"
},
@@ -3630,7 +3478,7 @@
"description": "",
"guid": "1255b75f-0f3b-4fd7-96c5-17e4e30bbe11",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: cree un proceso automatizado para garantizar que sus clústeres se inicien con las configuraciones e implementaciones necesarias en todo el clúster. Esto se realiza a menudo mediante GitOps.",
+ "text": "Arquitectura de clúster: cree un proceso automatizado para garantizar que los clústeres se inicien con las configuraciones e implementaciones necesarias en todo el clúster. Esto se realiza a menudo mediante GitOps.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3662,7 +3510,7 @@
"description": "",
"guid": "20301c55-a815-4a3a-83ec-fe6d1789e697",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de la carga de trabajo: la carga de trabajo debe diseñarse para emitir datos de telemetría que se puedan recopilar, que también deben incluir estados de vitalidad y preparación.",
+ "text": "Arquitectura de la carga de trabajo: la carga de trabajo debe diseñarse para emitir telemetría que se pueda recopilar, que también debe incluir estados de vitalidad y preparación.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3670,7 +3518,7 @@
"description": "",
"guid": "13d37985-5266-4064-97f0-7c7aa7491941",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: utilice prácticas de ingeniería del caos dirigidas a Kubernetes para identificar problemas de fiabilidad de aplicaciones o plataformas.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: utilice prácticas de ingeniería del caos dirigidas a Kubernetes para identificar problemas de confiabilidad de aplicaciones o plataformas.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -3691,7 +3539,7 @@
"waf": "Operaciones"
},
{
- "description": "Para compilar y ejecutar aplicaciones correctamente en AKS, hay que comprender e implementar consideraciones clave. Estas áreas incluyen funciones de multiusuario y programador, seguridad de clústeres y pods, o continuidad del negocio y recuperación ante desastres.",
+ "description": "Para compilar y ejecutar aplicaciones correctamente en AKS, hay consideraciones clave que se deben comprender e implementar. Estas áreas incluyen funciones de multiusuario y programador, seguridad de clústeres y pods, o continuidad del negocio y recuperación ante desastres.",
"guid": "95ee25c6-37fc-47c0-a3e1-eea5c1324edb",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: consulte la documentación de procedimientos recomendados de AKS.",
@@ -3702,7 +3550,7 @@
"description": "Azure Chaos Studio puede ayudar a simular errores y desencadenar situaciones de recuperación ante desastres.",
"guid": "2695b4b9-e125-4644-a27c-977eefdbce73",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: Revisión de Azure Chaos Studio.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: revise Azure Chaos Studio.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -3710,12 +3558,12 @@
"description": "Las cargas de trabajo orientadas a Internet deben aprovechar Azure Front Door o Azure Traffic Manager para enrutar el tráfico globalmente a través de clústeres de AKS.",
"guid": "844d923f-cfe0-4a3a-97ff-67c072c4220c",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: adopte una estrategia de varias regiones mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
+ "text": "Arquitectura de clústeres: adopte una estrategia multirregional mediante la implementación de clústeres de AKS implementados en diferentes regiones de Azure para maximizar la disponibilidad y proporcionar continuidad empresarial.",
"type": "recommendation",
"waf": "Operaciones"
},
{
- "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a gran escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo va en contra de la política de la empresa.",
+ "description": "Azure Policy puede ayudar a aplicar la aplicación y las protecciones a escala en los clústeres de forma centralizada y coherente. También puede controlar qué funciones se otorgan a los pods y si algo se ejecuta en contra de la política de la empresa.",
"guid": "02f47a84-6d0c-4243-a5ab-743c85dcce67",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clústeres: ponga en funcionamiento los estándares de configuración de clústeres y pods con Azure Policy.",
@@ -3723,7 +3571,7 @@
"waf": "Operaciones"
},
{
- "description": "Los controladores de entrada y Kubernetes admiten muchos patrones de implementación avanzados para su inclusión en el proceso de ingeniería de versiones. Tenga en cuenta patrones como las implementaciones azul-verde o las versiones controladas.",
+ "description": "Los controladores de entrada y Kubernetes admiten muchos patrones de implementación avanzados para su inclusión en el proceso de ingeniería de versiones. Considere patrones como las implementaciones azul-verde o las versiones canary.",
"guid": "ecbf4266-e97a-4b02-8d02-ca2fd42cea5b",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de carga de trabajo: utilice las capacidades de la plataforma en el proceso de ingeniería de versiones.",
@@ -3750,7 +3598,7 @@
"description": "",
"guid": "b78aea0e-3fd2-4dcc-b617-34a26892aa76",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: habilite el escalador automático de clústeres para ajustar automáticamente el número de nodos de agente en las demandas de carga de trabajo de respuesta.",
+ "text": "Arquitectura de clúster: habilite el escalador automático de clústeres para ajustar automáticamente el número de nodos de agente en respuesta a las demandas de carga de trabajo.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -3758,7 +3606,7 @@
"description": "",
"guid": "9b168db7-a88b-4e2c-b555-bc525c7e48da",
"service": "Azure Kubernetes Service",
- "text": "Arquitectura de clúster: use el escalador automático de pods horizontal para ajustar el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas.",
+ "text": "Arquitectura de clúster: utilice el escalador automático de pods horizontal para ajustar el número de pods de una implementación en función del uso de la CPU u otras métricas seleccionadas.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -3766,7 +3614,7 @@
"description": "",
"guid": "deadeedd-dab6-4774-84df-f5223ed6ede1",
"service": "Azure Kubernetes Service",
- "text": "Arquitecturas de clústeres y cargas de trabajo: realice actividades de pruebas de carga continuas que ejerzan tanto el escalador automático de pods como el clúster.",
+ "text": "Arquitecturas de clústeres y cargas de trabajo: Realice actividades de pruebas de carga continuas que ejerzan el escalador automático de pods y clústeres.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -3787,7 +3635,7 @@
"waf": "Rendimiento"
},
{
- "description": "La capacidad de escalar o reducir verticalmente automáticamente el número de nodos del clúster de AKS le permite ejecutar un clúster eficaz y rentable.",
+ "description": "La capacidad de escalar o reducir verticalmente automáticamente el número de nodos del clúster de AKS permite ejecutar un clúster eficaz y rentable.",
"guid": "631272b4-9ca7-4e6f-ae9b-3c55946b3924",
"service": "Azure Kubernetes Service",
"text": "Arquitectura de clúster: habilite el escalador automático de clústeres para ajustar automáticamente el número de nodos de agente en respuesta a las restricciones de recursos.",
@@ -3795,7 +3643,7 @@
"waf": "Rendimiento"
},
{
- "description": "A diferencia de los grupos de nodos del sistema que siempre requieren nodos en ejecución, los grupos de nodos de usuario permiten escalar o reducir verticalmente.",
+ "description": "A diferencia de los grupos de nodos del sistema que siempre requieren la ejecución de nodos, los grupos de nodos de usuario permiten escalar o reducir verticalmente.",
"guid": "85ffe644-7c4b-4f2d-b2fa-ed8e7c8d2e84",
"service": "Azure Kubernetes Service",
"text": "Arquitecturas de clústeres y cargas de trabajo: separe las cargas de trabajo en diferentes grupos de nodos y considere la posibilidad de escalar los grupos de nodos de usuario.",
@@ -3822,7 +3670,7 @@
"description": "",
"guid": "f4804af8-4f42-450d-916c-5593c145ccf9",
"service": "Azure Machine Learning",
- "text": "Resistencia: implemente modelos en entornos que admitan zonas de disponibilidad, como AKS. Al asegurarse de que las implementaciones se distribuyen entre las zonas de disponibilidad, se asegura de que una implementación esté disponible incluso en caso de que se produzca un error en el centro de datos. Para mejorar la confiabilidad y la disponibilidad, considere la posibilidad de una topología de implementación de varias regiones.",
+ "text": "Resistencia: implemente modelos en entornos que admitan zonas de disponibilidad, como AKS. Al asegurarse de que las implementaciones se distribuyen entre las zonas de disponibilidad, se asegura de que una implementación esté disponible incluso en caso de que se produzca un error en el centro de datos. Para mejorar la confiabilidad y la disponibilidad, considere una topología de implementación de varias regiones.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3830,7 +3678,7 @@
"description": "",
"guid": "995d097a-0de2-4431-947f-561b49a60f21",
"service": "Azure Machine Learning",
- "text": "Resistencia: asegúrese de que tiene suficiente proceso tanto para el entrenamiento como para la inferencia. A través de la planeación de recursos, asegúrese de que la SKU de proceso y la configuración de escalado cumplan los requisitos de la carga de trabajo.",
+ "text": "Resistencia: asegúrese de tener suficiente proceso para el entrenamiento y la inferencia. A través de la planeación de recursos, asegúrese de que la SKU de proceso y la configuración de escalado cumplan los requisitos de la carga de trabajo.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3838,7 +3686,7 @@
"description": "",
"guid": "d494b7f5-ad32-471f-9fc7-18945ca454ab",
"service": "Azure Machine Learning",
- "text": "Resistencia: Separe los espacios de trabajo de Machine Learning utilizados para el trabajo exploratorio de los utilizados para la producción.",
+ "text": "Resistencia: Separe los espacios de trabajo de Machine Learning utilizados para el trabajo exploratorio de los que se usan para la producción.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3846,7 +3694,7 @@
"description": "",
"guid": "6f1dd2cc-e0af-4203-ab0b-b7c65b7b18ae",
"service": "Azure Machine Learning",
- "text": "Resistencia: al usar puntos de conexión en línea administrados para la inferencia, use una estrategia de versión, como implementaciones azul-verde, para minimizar el tiempo de inactividad y reducir el riesgo asociado con la implementación de nuevas versiones.",
+ "text": "Resistencia: al usar puntos de conexión en línea administrados para la inferencia, use una estrategia de lanzamiento, como implementaciones azul-verde, para minimizar el tiempo de inactividad y reducir el riesgo asociado con la implementación de nuevas versiones.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3862,7 +3710,7 @@
"description": "",
"guid": "de5be058-1d22-4f38-96aa-3fbca5071a8f",
"service": "Azure Machine Learning",
- "text": "Recuperación: asegúrese de tener capacidades de recuperación automática, como las características de puntos de control compatibles con Machine Learning, al entrenar modelos grandes.",
+ "text": "Recuperación: asegúrese de tener capacidades de autorrecuperación, como las características de puntos de control compatibles con Machine Learning, al entrenar modelos grandes.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -3878,7 +3726,7 @@
"description": "Una implementación en varias regiones garantiza que las cargas de trabajo de Machine Learning continúen ejecutándose incluso si una región experimenta una interrupción. La implementación en varias regiones mejora la distribución de la carga entre regiones, lo que podría mejorar el rendimiento para los usuarios ubicados en diferentes áreas geográficas. Para obtener más información, consulte Conmutación por error para la continuidad empresarial y la recuperación ante desastres.",
"guid": "046ff188-7d68-492f-850c-c65ee0c9a962",
"service": "Azure Machine Learning",
- "text": "Implementación de modelos en varias regiones: para mejorar la confiabilidad y la disponibilidad, considere la posibilidad de utilizar un entorno de implementación en varias regiones cuando sea posible.",
+ "text": "Implementación de modelos de varias regiones: para mejorar la confiabilidad y la disponibilidad, considere la posibilidad de utilizar un entorno de implementación de varias regiones cuando sea posible.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -3886,7 +3734,7 @@
"description": "Los puntos de control del modelo guardan periódicamente el estado del modelo de aprendizaje automático durante el entrenamiento, de modo que se pueda restaurar en caso de interrupción, error o finalización. Para obtener más información, consulte Aumentar la velocidad de los puntos de control y reducir el costo con Nebula.",
"guid": "8eaf992c-ccd9-495f-b625-d4f544d38d38",
"service": "Azure Machine Learning",
- "text": "Resistencia de entrenamiento de modelos: use las características de puntos de control compatibles con Machine Learning, como Azure Container for PyTorch, la clase TensorFlow Estimator o el objeto Run y la clase FileDataset que admiten puntos de control de modelos.",
+ "text": "Resistencia de entrenamiento del modelo: use las características de puntos de control compatibles con Machine Learning, como Azure Container for PyTorch, la clase TensorFlow Estimator o el objeto Run y la clase FileDataset que admiten puntos de control del modelo.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -3958,7 +3806,7 @@
"description": "",
"guid": "8d9aea78-3ebe-4ec6-968d-3daa07abc239",
"service": "Azure Machine Learning",
- "text": "Integridad: requiere que se firme el código usado para el entrenamiento en entornos informáticos de Machine Learning. Requerir la firma de código garantiza que el código que se ejecuta proviene de una fuente de confianza y no ha sido manipulado.",
+ "text": "Integridad: requiere que se firme el código usado para el entrenamiento en entornos informáticos de Machine Learning. Requerir la firma de código garantiza que el código que se ejecuta proviene de una fuente de confianza y no se ha manipulado.",
"type": "checklist",
"waf": "seguridad"
},
@@ -3966,7 +3814,7 @@
"description": "",
"guid": "a6664b76-0292-4bd4-841e-859b65a569c0",
"service": "Azure Machine Learning",
- "text": "Confidencialidad: adhiérase al principio de privilegios mínimos para el control de acceso basado en roles (RBAC) para el área de trabajo de Machine Learning y los recursos relacionados, como la cuenta de almacenamiento del área de trabajo, para garantizar que las personas solo tengan los permisos necesarios para su rol, minimizando así los posibles riesgos de seguridad.",
+ "text": "Confidencialidad: cumpla con el principio de privilegios mínimos para el control de acceso basado en roles (RBAC) en el área de trabajo de Machine Learning y los recursos relacionados, como la cuenta de almacenamiento del área de trabajo, para asegurarse de que las personas solo tienen los permisos necesarios para su rol, minimizando así los posibles riesgos de seguridad.",
"type": "checklist",
"waf": "seguridad"
},
@@ -3974,12 +3822,12 @@
"description": "",
"guid": "2a509fe2-ce1d-410c-a5cb-780eb8dfaf15",
"service": "Azure Machine Learning",
- "text": "Integridad: Establezca la confianza y el acceso verificado mediante la implementación del cifrado para los datos en reposo y los datos en tránsito.",
+ "text": "Integridad: establezca la confianza y el acceso verificado mediante la implementación del cifrado para los datos en reposo y los datos en tránsito.",
"type": "checklist",
"waf": "seguridad"
},
{
- "description": "La línea de base de seguridad proporciona orientación personalizada sobre aspectos de seguridad cruciales, como la seguridad de la red, la gestión de identidades, la protección de datos y el acceso con privilegios. Para una seguridad óptima, use Microsoft Defender for Cloud para supervisar estos aspectos.",
+ "description": "La línea de base de seguridad proporciona orientación personalizada sobre aspectos de seguridad cruciales, como la seguridad de la red, la administración de identidades, la protección de datos y el acceso con privilegios. Para una seguridad óptima, use Microsoft Defender for Cloud para supervisar estos aspectos.",
"guid": "0e30e670-0c69-4c8a-82f5-b88494e56879",
"service": "Azure Machine Learning",
"text": "Línea base de seguridad: para mejorar la seguridad y el cumplimiento de su servicio de Machine Learning, aplique la línea base de seguridad de Azure para Machine Learning.",
@@ -3987,10 +3835,10 @@
"waf": "Seguridad"
},
{
- "description": "El aislamiento de red virtual administrado mejora la seguridad al aislar el área de trabajo de otras redes, lo que reduce el riesgo de acceso no autorizado. En un escenario en el que se produce una infracción en otra red dentro de la organización, la red aislada del área de trabajo de Machine Learning no se ve afectada, lo que protege las cargas de trabajo de machine learning.",
+ "description": "El aislamiento de red virtual administrado mejora la seguridad al aislar el área de trabajo de otras redes, lo que reduce el riesgo de acceso no autorizado. En un escenario en el que se produce una infracción en otra red de la organización, la red aislada del área de trabajo de Machine Learning no se ve afectada, lo que protege las cargas de trabajo de machine learning.",
"guid": "aeb66f5c-45bc-45d8-a7bf-a6bd5c6e5f9a",
"service": "Azure Machine Learning",
- "text": "Aislamiento de red virtual administrada: configure el aislamiento de red virtual administrada para Machine Learning. Al habilitar el aislamiento de red virtual administrada, se crea una red virtual administrada para el área de trabajo. Los recursos de proceso administrados que cree para el área de trabajo usan automáticamente esta red virtual administrada. Si no puede implementar el aislamiento de red virtual administrado, debe seguir las recomendaciones de topología de red para separar el proceso en una subred dedicada lejos del resto de los recursos de la solución, incluidos los puntos de conexión privados para los recursos del área de trabajo.",
+ "text": "Aislamiento de red virtual administrada: configure el aislamiento de red virtual administrada para Machine Learning. Al habilitar el aislamiento de red virtual administrada, se crea una red virtual administrada para el área de trabajo. Los recursos de proceso administrados que cree para el área de trabajo usarán automáticamente esta red virtual administrada. Si no puede implementar el aislamiento de red virtual administrado, debe seguir las recomendaciones de topología de red para separar el proceso en una subred dedicada del resto de los recursos de la solución, incluidos los puntos de conexión privados para los recursos del área de trabajo.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -4006,7 +3854,7 @@
"description": "Esta configuración minimiza el riesgo de exfiltración de datos, mejorando la seguridad de los datos. Con esta configuración habilitada, un actor malintencionado que obtenga acceso a su sistema no puede enviar sus datos a un destino externo no aprobado.",
"guid": "d1cdc5a5-eb9a-43d7-ad74-6169482b28d0",
"service": "Azure Machine Learning",
- "text": "Permitir solo el acceso saliente aprobado: configure el modo de salida en el acceso saliente administrado del área de trabajo de Machine Learning en \"Permitir solo el acceso saliente aprobado\" para minimizar el riesgo de filtración de datos. Configure puntos de conexión privados, etiquetas de servicio o nombres de dominio completos (FQDN) para los recursos a los que necesita acceder.",
+ "text": "Permitir solo el acceso saliente aprobado: configure el modo de salida en el acceso saliente administrado del área de trabajo de Machine Learning a \"Permitir solo el acceso saliente aprobado\" para minimizar el riesgo de filtración de datos. Configure puntos de conexión privados, etiquetas de servicio o nombres de dominio completos (FQDN) para los recursos a los que necesita acceder.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -4027,7 +3875,7 @@
"waf": "Seguridad"
},
{
- "description": "La deshabilitación de la autenticación local aumenta la seguridad del proceso de Machine Learning y proporciona un control y una administración centralizados de las identidades y las credenciales de recursos.",
+ "description": "La deshabilitación de la autenticación local aumenta la seguridad del proceso de Machine Learning y proporciona un control y una administración centralizados de las identidades y las credenciales de los recursos.",
"guid": "70477454-0ddb-4ad6-9342-1ad6290bbb06",
"service": "Azure Machine Learning",
"text": "Deshabilitar la autenticación local: deshabilite la autenticación local para clústeres e instancias de proceso de Machine Learning.",
@@ -4051,7 +3899,7 @@
"waf": "Seguridad"
},
{
- "description": "El uso de las imágenes más recientes garantiza que se mantenga un entorno coherente, estable y seguro, lo que incluye asegurarse de tener los parches de seguridad más recientes.",
+ "description": "El uso de las imágenes más recientes garantiza que mantenga un entorno coherente, estable y seguro, lo que incluye asegurarse de tener los parches de seguridad más recientes.",
"guid": "cb49b636-1011-43a0-a12b-25378f677153",
"service": "Azure Machine Learning",
"text": "Obtener la imagen más reciente del sistema operativo: vuelva a crear instancias informáticas para obtener la imagen más reciente del sistema operativo.",
@@ -4075,7 +3923,7 @@
"waf": "Seguridad"
},
{
- "description": "El cifrado de datos en reposo mejora la seguridad de los datos al garantizar que los datos confidenciales se cifren mediante el uso de claves administradas directamente por usted. Si tiene un requisito normativo para administrar sus propias claves de cifrado, utilice esta función para cumplir con ese requisito.",
+ "description": "El cifrado de datos en reposo mejora la seguridad de los datos, ya que garantiza que los datos confidenciales se cifren mediante el uso de claves administradas directamente por usted. Si tiene un requisito normativo para administrar sus propias claves de cifrado, use esta función para cumplir con ese requisito.",
"guid": "5e14c11e-83fb-40f1-a8dc-d96767d73a13",
"service": "Azure Machine Learning",
"text": "Cifrar datos en reposo: considere la posibilidad de usar claves administradas por el cliente con Machine Learning.",
@@ -4102,7 +3950,7 @@
"description": "",
"guid": "8e98fc4b-2fa4-44b9-9aa7-1c01f67aecb7",
"service": "Azure Machine Learning",
- "text": "Optimización del uso: asegúrese de que los recursos informáticos que no se utilizan se reduzcan o se apaguen cuando estén inactivos para reducir el desperdicio.",
+ "text": "Optimización del uso: asegúrese de que los recursos informáticos que no se utilizan se reduzcan verticalmente o se apaguen cuando estén inactivos para reducir el desperdicio.",
"type": "checklist",
"waf": "costar"
},
@@ -4126,7 +3974,7 @@
"description": "",
"guid": "945e262b-3a0f-4ac9-ac51-69b5500f9ee6",
"service": "Azure Machine Learning",
- "text": "Optimización de tarifas: compre Azure Reserved Virtual Machine Instances si tiene una buena estimación del uso para los próximos uno a tres años.",
+ "text": "Optimización de tarifas: compre Azure Reserved Virtual Machine Instances si tiene una buena estimación del uso durante los próximos uno a tres años.",
"type": "checklist",
"waf": "costar"
},
@@ -4139,18 +3987,18 @@
"waf": "costar"
},
{
- "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al costo de ejecución de la carga de trabajo. Elegir una GPU o una SKU de alto rendimiento sin un uso adecuado puede generar gastos innecesarios, mientras que elegir un proceso de tamaño insuficiente puede provocar tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento.",
+ "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al costo de ejecución de la carga de trabajo. La elección de una GPU o una SKU de alto rendimiento sin un uso adecuado puede dar lugar a un gasto innecesario, mientras que la elección de un proceso de tamaño insuficiente puede dar lugar a tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento.",
"guid": "3d87f935-99a6-4aee-aac2-069994de09ff",
"service": "Azure Machine Learning",
- "text": "Optimice los recursos informáticos: optimice los recursos informáticos en función de los requisitos de la carga de trabajo. Elija la SKU que mejor se adapte a su carga de trabajo:- Propósito general: relación equilibrada entre CPU y memoria, buena para todos los propósitos.
- Optimizado para cómputo: alta relación entre CPU y memoria, buena para cálculos matemáticos pesados.
- Optimizado para memoria: alta memoria para CPU, buena para cálculos en memoria o aplicaciones de bases de datos.
- Serie M: máquinas muy grandes que tienen grandes cantidades de memoria y CPU.
- GPU: mejor para modelos con un gran número de variables que pueden beneficiarse de un mayor paralelismo e instrucciones de núcleo especializadas. Las aplicaciones típicas son el aprendizaje profundo, el procesamiento de imágenes o vídeos, las simulaciones científicas, la minería de datos y el aprovechamiento de los marcos de desarrollo de GPU. Pruebe con varias familias y documente los resultados como referencia. A medida que el modelo y los datos evolucionan, es posible que cambie el recurso informático más adecuado. Supervise los tiempos de ejecución y reevalúe según sea necesario.",
+ "text": "Optimice los recursos informáticos: optimice los recursos informáticos en función de los requisitos de la carga de trabajo. Elija la SKU que mejor se adapte a su carga de trabajo:
- Propósito general: relación equilibrada entre CPU y memoria, buena para todos los propósitos.
- Optimizado para computación: alta relación entre CPU y memoria, buena para cálculos matemáticos pesados.
- Optimizado para memoria: alta memoria para la CPU, buena para cálculos en memoria o aplicaciones de bases de datos.
- Serie M: máquinas muy grandes que tienen grandes cantidades de memoria y CPU.
- GPU: mejor para modelos con un gran número de variables que pueden beneficiarse de un mayor paralelismo e instrucciones básicas especializadas. Las aplicaciones típicas son el aprendizaje profundo, el procesamiento de imágenes o vídeos, las simulaciones científicas, la minería de datos y el aprovechamiento de los marcos de desarrollo de GPU. Pruebe con varias familias y documente los resultados como referencia. A medida que el modelo y los datos evolucionan, es posible que cambie el recurso informático más adecuado. Supervise los tiempos de ejecución y reevalúe según sea necesario.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Configure el escalado automático para que los clústeres de proceso reduzcan verticalmente cuando su uso sea bajo. Establezca el número mínimo de nodos en 0 para que los clústeres de entrenamiento se reduzcan verticalmente a 0 cuando no estén en uso.",
+ "description": "Configure el escalado automático para que los clústeres de proceso se reduzcan verticalmente cuando su uso sea bajo. Establezca el número mínimo de nodos en 0 para que los clústeres de entrenamiento se reduzcan verticalmente a 0 cuando no estén en uso.",
"guid": "d30cfeeb-6c61-4a9d-9a56-c8296cec72cb",
"service": "Azure Machine Learning",
- "text": "Optimice el escalado de proceso: configure los clústeres de proceso para el escalado automático a fin de asegurarse de que solo usa lo que necesita. Para los clústeres de entrenamiento, establezca el número mínimo de nodos en 0 y configure la cantidad de tiempo que el nodo está inactivo en un tiempo adecuado. Para una experimentación menos iterativa, reduzca el tiempo para ahorrar costos. Para una experimentación más iterativa, use un tiempo más alto para evitar pagar por escalar hacia arriba o hacia abajo después de cada cambio.",
+ "text": "Optimice el escalado de proceso: configure los clústeres de proceso para el escalado automático a fin de asegurarse de que solo usa lo que necesita. Para los clústeres de entrenamiento, establezca el número mínimo de nodos en 0 y configure la cantidad de tiempo que el nodo está inactivo en un tiempo adecuado. Para una experimentación menos iterativa, reduzca el tiempo para ahorrar costos. Para una experimentación más iterativa, use un tiempo mayor para evitar pagar por escalar hacia arriba o hacia abajo después de cada cambio.",
"type": "recommendation",
"waf": "Costar"
},
@@ -4158,20 +4006,20 @@
"description": "La configuración de directivas de terminación puede ayudarle a ahorrar costos al detener las ejecuciones que no funcionan antes de tiempo.",
"guid": "098a7bee-444c-4351-aeb1-8bd97036299c",
"service": "Azure Machine Learning",
- "text": "Establecer políticas de finalización del entrenamiento: establezca políticas de finalización anticipada para limitar la duración de las ejecuciones de entrenamiento o finalizarlas antes de tiempo.",
+ "text": "Establecer directivas de finalización del entrenamiento: establezca directivas de finalización anticipada para limitar la duración de las ejecuciones de entrenamiento o finalizarlas antes de tiempo.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Las máquinas virtuales de baja prioridad permiten utilizar una gran cantidad de potencia de proceso a bajo costo. Aprovechan el excedente de capacidad de Azure.",
+ "description": "Las máquinas virtuales de baja prioridad permiten usar una gran cantidad de potencia de proceso a bajo costo. Aprovechan el excedente de capacidad de Azure.",
"guid": "41f2dd91-5765-4dfb-9db0-9b3e976b4afb",
"service": "Azure Machine Learning",
- "text": "Usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes: considere la posibilidad de usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes que no sean urgentes y en las que las interrupciones sean recuperables.",
+ "text": "Usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes: considere la posibilidad de usar máquinas virtuales de prioridad baja para cargas de trabajo por lotes que no sean sensibles al tiempo y en las que se puedan recuperar las interrupciones.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "De forma predeterminada, las instancias de proceso están disponibles para usted, acumulando costos. Configurar instancias de proceso para que se apaguen cuando estén inactivas o configurar una programación para ellas ahorra costos cuando no están en uso.",
+ "description": "De forma predeterminada, las instancias informáticas están disponibles para usted, acumulando costos. La configuración de instancias informáticas para que se apaguen cuando estén inactivas o la configuración de una programación para ellas ahorra costos cuando no están en uso.",
"guid": "e3150ddd-f553-425f-bb91-249a9598e25e",
"service": "Azure Machine Learning",
"text": "Habilitar el apagado inactivo para instancias informáticas: habilite el apagado inactivo para instancias informáticas o programe una hora de inicio y finalización si se conoce el tiempo de uso.",
@@ -4187,7 +4035,7 @@
"waf": "Costar"
},
{
- "description": "Compre Azure Reserved VM Instances para pagar por adelantado el uso de máquinas virtuales y ofrecer descuentos con precios de pago por uso. El descuento se aplica automáticamente por el uso de la máquina virtual que coincida con la reserva.",
+ "description": "Compre Azure Reserved VM Instances para pagar por adelantado el uso de máquinas virtuales y ofrecer descuentos con precios de pago por uso. El descuento se aplica automáticamente al uso de la máquina virtual que coincida con la reserva.",
"guid": "b4470844-d54d-4a1c-980c-37d09e17940d",
"service": "Azure Machine Learning",
"text": "Azure Reserved VM Instances: compre Azure Reserved VM Instances si tiene una buena estimación del uso durante los próximos uno a tres años. Aproveche las opciones de capacidad reservada para los servicios cuando tenga buenas estimaciones de uso.",
@@ -4206,7 +4054,7 @@
"description": "",
"guid": "2fe1daf9-b388-4d25-8ff8-39908ada7f27",
"service": "Azure Machine Learning",
- "text": "Automatice para lograr la eficiencia: siga las buenas prácticas de operaciones de aprendizaje automático (MLOps). Cuando sea posible, cree canalizaciones automatizadas de extremo a extremo para los procesos de preparación, capacitación y puntuación de datos. En el desarrollo, use scripts en lugar de cuadernos para entrenar modelos, ya que los scripts son más fáciles de integrar en canalizaciones automatizadas.",
+ "text": "Automatice para lograr la eficiencia: siga las buenas prácticas de operaciones de aprendizaje automático (MLOps). Cuando sea posible, cree canalizaciones automatizadas de extremo a extremo para los procesos de preparación, capacitación y puntuación de datos. En el desarrollo, use scripts en lugar de cuadernos para los modelos de entrenamiento, ya que los scripts son más fáciles de integrar en canalizaciones automatizadas.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4222,7 +4070,7 @@
"description": "",
"guid": "f8196404-8f76-4e65-9b32-46d8d777d1d3",
"service": "Azure Machine Learning",
- "text": "Observabilidad: Supervise el rendimiento de sus modelos implementados, incluido el desfase de datos.",
+ "text": "Observabilidad: Supervise el rendimiento de los modelos implementados, incluido el desfase de datos.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4251,10 +4099,10 @@
"waf": "Operaciones"
},
{
- "description": "Use los registros de modelos de Machine Learning para almacenar y versionar los modelos de Machine Learning para realizar un seguimiento de los cambios y mantener el linaje con el trabajo y los conjuntos de datos utilizados para el entrenamiento. Con los catálogos de modelos de Machine Learning, los equipos de ciencia de datos pueden descubrir, evaluar y ajustar modelos fundamentales de aprendizaje automático preentrenados. El almacenamiento de modelos con versiones en registros de modelos de Machine Learning admite estrategias de implementación como versiones A/B, versiones Canary y reversiones.",
+ "description": "Use los registros de modelos de Machine Learning para almacenar y versionar los modelos de Machine Learning para realizar un seguimiento de los cambios y mantener el linaje con el trabajo y los conjuntos de datos utilizados para el entrenamiento. Con los catálogos de modelos de Machine Learning, los equipos de ciencia de datos pueden detectar, evaluar y ajustar modelos fundamentales de aprendizaje automático preentrenados. El almacenamiento de modelos con versiones en registros de modelos de Machine Learning admite estrategias de implementación como versiones A/B, versiones canary y reversiones.",
"guid": "31841d05-3372-4bd4-b8bc-efcaaee1bd88",
"service": "Azure Machine Learning",
- "text": "Aproveche los catálogos y registros de modelos: aproveche los catálogos y registros de modelos de Machine Learning para almacenar, versionar y compartir activos de Machine Learning. Utilice los catálogos de modelos de Machine Learning para ayudarle a implementar las pruebas A/B y la implementación de modelos.",
+ "text": "Aproveche los catálogos y registros de modelos: aproveche los catálogos y registros de modelos de Machine Learning para almacenar, versionar y compartir activos de Machine Learning. Use los catálogos de modelos de Machine Learning para ayudarle a implementar pruebas A/B e implementación de modelos.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -4267,7 +4115,7 @@
"waf": "Operaciones"
},
{
- "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos de proceso en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarte si te estás acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir horizontalmente, escalar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
+ "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos informáticos en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarle si se está acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir verticalmente, aumentar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
"guid": "b1d87076-b253-47ae-8727-97f804e49a3c",
"service": "Azure Machine Learning",
"text": "Supervisar la infraestructura: si los modelos se implementan en puntos de conexión en línea, habilite Application Insights para supervisar los puntos de conexión y las implementaciones en línea. Supervise la infraestructura de formación para asegurarse de que cumple con los requisitos básicos. Asegúrese de recopilar registros de recursos para Machine Learning.",
@@ -4294,7 +4142,7 @@
"description": "",
"guid": "5e526216-1b94-4cfe-86ef-bbce971f7f3a",
"service": "Azure Machine Learning",
- "text": "Objetivos de rendimiento: defina los objetivos de rendimiento aceptables para los modelos implementados, incluido el tiempo de respuesta, las solicitudes por segundo, la tasa de errores y el tiempo de actividad. Los objetivos de rendimiento actúan como punto de referencia para la eficiencia del modelo implementado. Los destinos pueden ayudarle a determinar la CPU frente a la GPU, las opciones de SKU de CPU y los requisitos de escalado.",
+ "text": "Objetivos de rendimiento: defina los objetivos de rendimiento aceptables para los modelos implementados, incluido el tiempo de respuesta, las solicitudes por segundo, la tasa de errores y el tiempo de actividad. Los objetivos de rendimiento actúan como punto de referencia para la eficiencia del modelo implementado. Los destinos pueden ayudarle a tomar decisiones de CPU frente a GPU, opciones de SKU de CPU y requisitos de escalado.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4318,7 +4166,7 @@
"description": "",
"guid": "d47bd862-5302-4ecb-a551-37cb0d15e802",
"service": "Azure Machine Learning",
- "text": "Cumpla con los requisitos de capacidad: elija entornos de implementación con capacidades de escalado automático para agregar y eliminar capacidad a medida que fluctúa la demanda.",
+ "text": "Cumpla con los requisitos de capacidad: elija entornos de implementación con capacidades de escalado automático para agregar y quitar capacidad a medida que fluctúa la demanda.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4334,15 +4182,15 @@
"description": "",
"guid": "e257de8e-a8ef-4b91-81a3-3d832682b1eb",
"service": "Azure Machine Learning",
- "text": "Logre y mantenga el rendimiento: supervise continuamente el rendimiento de su infraestructura de modelos implementados, revise los resultados y tome las medidas adecuadas. Supervise la infraestructura de formación para asegurarse de que cumple con sus requisitos de tiempo de formación.",
+ "text": "Logre y mantenga el rendimiento: supervise continuamente el rendimiento de su infraestructura de modelos implementados, revise los resultados y tome las medidas adecuadas. Supervise la infraestructura de formación para asegurarse de que cumple con los requisitos de tiempo de formación.",
"type": "checklist",
"waf": "rendimiento"
},
{
- "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al tiempo de entrenamiento. La elección de la SKU y la CPU correctas en comparación con la GPU garantiza que el entrenamiento de su modelo pueda cumplir con sus requisitos y objetivos de rendimiento. Elegir una SKU de bajo rendimiento que se use en exceso puede provocar tiempos de entrenamiento prohibitivamente largos y problemas de rendimiento. Los clústeres de proceso proporcionan la capacidad de mejorar el rendimiento mediante el escalado horizontal de las cargas de trabajo que admiten el escalado horizontal. Este método proporciona flexibilidad para manejar cargas de trabajo con diferentes demandas y le permite agregar o quitar máquinas según sea necesario.",
+ "description": "La selección del proceso adecuado es fundamental, ya que afecta directamente al tiempo de entrenamiento. Elegir la SKU y la CPU correctas en lugar de la GPU garantiza que el entrenamiento de su modelo pueda cumplir con sus requisitos y objetivos de rendimiento. Elegir una SKU de bajo rendimiento que se use en exceso puede provocar tiempos de entrenamiento prohibitivos y problemas de rendimiento. Los clústeres de proceso proporcionan la capacidad de mejorar el rendimiento mediante el escalado horizontal de las cargas de trabajo que admiten el escalado horizontal. Este método proporciona flexibilidad para manejar cargas de trabajo con diferentes demandas y le permite agregar o quitar máquinas según sea necesario.",
"guid": "352a223c-dabd-46da-8752-56a87c6f18b7",
"service": "Azure Machine Learning",
- "text": "Seleccione los servicios de proceso adecuados para el entrenamiento de modelos: considere la posibilidad de utilizar clústeres de proceso de Machine Learning en lugar de instancias de proceso para el entrenamiento de modelos si necesita escalado automático. Optimice sus recursos informáticos en función de los requisitos de formación. En primer lugar, elija entre CPU y GPU. De forma predeterminada, utilice CPU, pero considere las GPU para cargas de trabajo como el aprendizaje profundo, el procesamiento de imágenes o vídeos, o grandes cantidades de datos. A continuación, elija la SKU de imagen que mejor se adapte a su carga de trabajo. Use las pruebas para elegir la opción de proceso que optimiza el costo en función del tiempo de entrenamiento al determinar la línea base.",
+ "text": "Seleccione los servicios de proceso adecuados para el entrenamiento de modelos: considere la posibilidad de utilizar clústeres de proceso de Machine Learning en lugar de instancias de proceso para el entrenamiento de modelos si necesita el escalado automático. Optimice sus recursos informáticos en función de los requisitos de formación. En primer lugar, elija entre CPU y GPU. De forma predeterminada, utilice CPU, pero considere las GPU para cargas de trabajo como el aprendizaje profundo, el procesamiento de imágenes o vídeos, o grandes cantidades de datos. A continuación, elija la SKU de imagen que mejor se adapte a su carga de trabajo. Use las pruebas para elegir la opción de proceso que optimiza el costo en función del tiempo de entrenamiento al determinar la línea base.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -4358,15 +4206,15 @@
"description": "El seguimiento del rendimiento de los modelos en producción le alerta de posibles problemas, como el desfase de datos, el desfase de predicción, la calidad de los datos y el desfase de atribución de características. La supervisión del desfase de datos le ayuda a detectar cambios en los datos de entrada que pueden provocar una disminución en el rendimiento del modelo. La administración del desfase de datos le ayuda a garantizar que el modelo proporcione resultados precisos a lo largo del tiempo.",
"guid": "eccdaab6-7458-4967-9cd4-da6a89e3ce8c",
"service": "Azure Machine Learning",
- "text": "Supervise el rendimiento del modelo: supervise el rendimiento de los modelos implementados.",
+ "text": "Supervisar el rendimiento del modelo: supervise el rendimiento de los modelos implementados.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos de proceso en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarte si te estás acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir horizontalmente, escalar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
+ "description": "La supervisión de los puntos de conexión le proporciona visibilidad de métricas como la latencia de las solicitudes y las solicitudes por minuto. Puede comparar el rendimiento con la línea base y usar esta información para realizar cambios en los recursos informáticos en consecuencia. Las métricas de supervisión, como los bytes de red, pueden alertarle si se está acercando a los límites de cuota y evitar la limitación. Del mismo modo, la supervisión de su entorno de entrenamiento le proporciona la información necesaria para realizar cambios en su entorno de entrenamiento. Use esa información para decidir si escalar o reducir verticalmente, aumentar o reducir verticalmente con diferentes SKU de alto rendimiento, o elegir entre CPU o GPU.",
"guid": "76b80c26-8252-416e-aae1-ace03a9403dd",
"service": "Azure Machine Learning",
- "text": "Supervise la infraestructura: supervise los puntos finales en línea e intégrelos con Monitor para realizar un seguimiento y supervisar las métricas y los registros adecuados. Habilite Application Insights al crear implementaciones en línea. Supervise la infraestructura de entrenamiento y revise el uso de recursos, como la memoria y el uso de CPU o GPU, al entrenar modelos para asegurarse de que cumple con los requisitos básicos.",
+ "text": "Supervise la infraestructura: supervise los puntos finales en línea e intégrelo con Monitor para realizar un seguimiento y supervisar las métricas y los registros adecuados. Habilite Application Insights al crear implementaciones en línea. Supervise la infraestructura de entrenamiento y revise el uso de recursos, como la memoria y el uso de CPU o GPU, al entrenar modelos para asegurarse de que cumple con los requisitos básicos.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -4374,7 +4222,7 @@
"description": "",
"guid": "154d9075-f8f8-4dc8-b8f4-651d875d5dfe",
"service": "Azure Openai",
- "text": "Resistencia: elija la opción de implementación adecuada de rendimiento de pago por uso o aprovisionado en función de su caso de uso. Dado que la capacidad reservada aumenta la resistencia, elija el rendimiento aprovisionado para las soluciones de producción. El enfoque de pago por uso es ideal para entornos de desarrollo y pruebas.",
+ "text": "Resistencia: elija la opción de implementación adecuada de rendimiento aprovisionado o de pago por uso en función de su caso de uso. Dado que la capacidad reservada aumenta la resistencia, elija el rendimiento aprovisionado para las soluciones de producción. El enfoque de pago por uso es ideal para entornos de desarrollo y pruebas.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -4406,7 +4254,7 @@
"description": "",
"guid": "950e6010-4345-43e6-a8e9-d8c95e45f818",
"service": "Azure Openai",
- "text": "Resistencia: siga las instrucciones para ajustar con archivos de datos de gran tamaño e importe los datos de un almacén de blobs de Azure. Los archivos grandes, de 100 MB o más, pueden volverse inestables cuando se cargan a través de formularios de varias partes porque las solicitudes son atómicas y no se pueden volver a intentar ni reanudar.",
+ "text": "Resistencia: siga las instrucciones para el ajuste con archivos de datos de gran tamaño e importe los datos de un almacén de blobs de Azure. Los archivos grandes, de 100 MB o más, pueden volverse inestables cuando se cargan a través de formularios de varias partes porque las solicitudes son atómicas y no se pueden volver a intentar ni reanudar.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -4422,15 +4270,15 @@
"description": "Esta importante información de rendimiento proporciona la información necesaria para asegurarse de que asigna suficiente TPM de la cuota para satisfacer la demanda de las implementaciones. La asignación de una cuota suficiente evita la limitación de las llamadas a los modelos implementados.",
"guid": "f109deb2-54f9-4405-a9f0-f90fd0f76adf",
"service": "Azure Openai",
- "text": "Supervise los límites de frecuencia para el pago por uso: si usa el enfoque de pago por uso, administre los límites de velocidad para las implementaciones del modelo y supervise el uso de tokens por minuto (TPM) y solicitudes por minuto (RPM).",
+ "text": "Supervisión de los límites de frecuencia para el pago por uso: si usa el enfoque de pago por uso, administre los límites de velocidad para las implementaciones del modelo y supervise el uso de tokens por minuto (TPM) y solicitudes por minuto (RPM).",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "Es importante supervisar el uso administrado por el aprovisionamiento para asegurarse de que no supera el 100 % para evitar la limitación de las llamadas a los modelos implementados.",
+ "description": "Es importante supervisar el uso administrado por el aprovisionamiento para asegurarse de que no supere el 100 % para evitar la limitación de las llamadas a los modelos implementados.",
"guid": "ef12f5c3-dbe2-4040-be82-724eebc6f87e",
"service": "Azure Openai",
- "text": "Supervisión del uso administrado por aprovisionamiento para el rendimiento aprovisionado: si usa el modelo de pago por rendimiento aprovisionado, supervise el uso administrado por aprovisionamiento.",
+ "text": "Supervisión de la utilización administrada por el aprovisionamiento para el rendimiento aprovisionado: si usa el modelo de pago por el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -4446,7 +4294,7 @@
"description": "",
"guid": "a61b826b-9f3b-4f51-8e0e-a32a92865386",
"service": "Azure Openai",
- "text": "Proteja la confidencialidad: si carga datos de entrenamiento en Azure OpenAI, use claves administradas por el cliente para el cifrado de datos, implemente una estrategia de rotación de claves y elimine los datos de entrenamiento, validación y resultados de entrenamiento. Si usa un almacén de datos externo para los datos de entrenamiento, siga las prácticas recomendadas de seguridad para ese almacén. Por ejemplo, para Azure Blob Storage, use claves administradas por el cliente para el cifrado e implemente una estrategia de rotación de claves. Utilice el acceso administrado basado en identidades, implemente un perímetro de red mediante puntos de conexión privados y habilite los registros de acceso.",
+ "text": "Proteja la confidencialidad: si carga datos de entrenamiento en Azure OpenAI, use claves administradas por el cliente para el cifrado de datos, implemente una estrategia de rotación de claves y elimine los datos de los resultados de entrenamiento, validación y entrenamiento. Si usa un almacén de datos externo para los datos de entrenamiento, siga las prácticas recomendadas de seguridad para ese almacén. Por ejemplo, para Azure Blob Storage, use claves administradas por el cliente para el cifrado e implemente una estrategia de rotación de claves. Use el acceso administrado basado en identidades, implemente un perímetro de red mediante puntos de conexión privados y habilite los registros de acceso.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4454,7 +4302,7 @@
"description": "",
"guid": "9f4bdfff-2c6c-4662-9139-1de51d2dbd20",
"service": "Azure Openai",
- "text": "Proteja la confidencialidad: protéjase contra la filtración de datos limitando las direcciones URL de salida a las que pueden acceder los recursos de Azure OpenAI.",
+ "text": "Proteja la confidencialidad: protéjase contra la filtración de datos limitando las direcciones URL salientes a las que pueden acceder los recursos de Azure OpenAI.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4478,7 +4326,7 @@
"description": "",
"guid": "e0383d3b-71f1-4fda-9759-24cfd293abff",
"service": "Azure Openai",
- "text": "Proteja la disponibilidad: use controles de seguridad para evitar ataques que puedan agotar las cuotas de uso del modelo. Puede configurar controles para aislar el servicio en una red. Si el servicio debe ser accesible desde Internet, considere la posibilidad de usar una puerta de enlace para bloquear los posibles abusos mediante el enrutamiento o la limitación.",
+ "text": "Proteger la disponibilidad: use controles de seguridad para evitar ataques que puedan agotar las cuotas de uso del modelo. Puede configurar controles para aislar el servicio en una red. Si se debe poder acceder al servicio desde Internet, considere la posibilidad de usar una puerta de enlace para bloquear los posibles abusos mediante el enrutamiento o la limitación.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4491,7 +4339,7 @@
"waf": "Seguridad"
},
{
- "description": "Controlar el acceso a Azure OpenAI ayuda a evitar ataques de usuarios no autorizados. El uso de puntos de conexión privados garantiza que el tráfico de red permanezca privado entre la aplicación y la plataforma.",
+ "description": "El control del acceso a Azure OpenAI ayuda a evitar ataques de usuarios no autorizados. El uso de puntos de conexión privados garantiza que el tráfico de red permanezca privado entre la aplicación y la plataforma.",
"guid": "4a7a9a07-0229-4175-b784-9a99eded4d54",
"service": "Azure Openai",
"text": "Restringir el acceso: deshabilite el acceso público a Azure OpenAI a menos que la carga de trabajo lo requiera. Cree puntos de conexión privados si se conecta desde consumidores en una red virtual de Azure.",
@@ -4502,7 +4350,7 @@
"description": "El uso de Microsoft Entra ID centraliza el componente de administración de identidades y elimina el uso de claves de API. El uso de RBAC con Microsoft Entra ID garantiza que los usuarios o grupos tengan exactamente los permisos que necesitan para realizar su trabajo. Este tipo de control de acceso detallado no es posible con las claves de API de Azure OpenAI.",
"guid": "d5892190-2da9-43f4-b1e1-76b38b369643",
"service": "Azure Openai",
- "text": "Id. de Microsoft Entra: use el id. de Microsoft Entra para la autenticación y para autorizar el acceso a Azure OpenAI mediante el control de acceso basado en roles (RBAC). Deshabilite la autenticación local en Azure AI Services y establezca 'disableLocalAuth' en 'true'. Otorgue a las identidades que realicen finalizaciones o generación de imágenes el rol de usuario de OpenAI de Cognitive Services. Otorgue a las canalizaciones de automatización de modelos y al acceso ad-hoc a la ciencia de datos un rol como el de Colaborador de OpenAI de Cognitive Services.",
+ "text": "Id. de Microsoft Entra: use el id. de Microsoft Entra para la autenticación y para autorizar el acceso a Azure OpenAI mediante el control de acceso basado en roles (RBAC). Deshabilite la autenticación local en Azure AI Services y establezca 'disableLocalAuth' en 'true'. Conceda a las identidades que realicen finalizaciones o generación de imágenes el rol de usuario de OpenAI de Cognitive Services. Otorgue a las canalizaciones de automatización de modelos y al acceso ad-hoc a la ciencia de datos un rol como el de Colaborador de OpenAI de Cognitive Services.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -4510,7 +4358,7 @@
"description": "El uso de claves administradas por el cliente le proporciona una mayor flexibilidad para crear, rotar, deshabilitar y revocar controles de acceso.",
"guid": "60a4703c-1086-45e1-9384-ebb32ab50696",
"service": "Azure Openai",
- "text": "Use claves administradas por el cliente: use claves administradas por el cliente para los modelos optimizados y los datos de entrenamiento que se cargan en Azure OpenAI.",
+ "text": "Use claves administradas por el cliente: use claves administradas por el cliente para modelos ajustados y datos de entrenamiento que se cargan en Azure OpenAI.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -4526,7 +4374,7 @@
"description": "",
"guid": "08f7b66c-7679-479b-8e2f-41b3305613dc",
"service": "Azure Openai",
- "text": "Gestión de costos: Desarrolle su modelo de costos, teniendo en cuenta los tamaños de las solicitudes. Comprender los tamaños de entrada y respuesta de las solicitudes, y cómo el texto se traduce en tokens, lo ayuda a crear un modelo de costos viable.",
+ "text": "Gestión de costos: Desarrolle su modelo de costos, teniendo en cuenta los tamaños de las solicitudes. Comprender los tamaños de entrada y respuesta de los mensajes y cómo se traduce el texto en tokens lo ayuda a crear un modelo de costos viable.",
"type": "checklist",
"waf": "costar"
},
@@ -4550,7 +4398,7 @@
"description": "",
"guid": "2b2303c0-e057-431d-9a02-20a1a0b2b5b9",
"service": "Azure Openai",
- "text": "Optimización del uso: tenga en cuenta los precios y las capacidades del modelo al elegir los modelos. Comience con modelos menos costosos para tareas menos complejas, como la generación de texto o las tareas de finalización. Para tareas más complejas, como la traducción de idiomas o la comprensión de contenidos, considere la posibilidad de utilizar modelos más avanzados. Tenga en cuenta las diferentes capacidades del modelo y los límites máximos de uso de tokens cuando elija un modelo que sea adecuado para casos de uso como escenarios de incrustación de texto, generación de imágenes o transcripción. Al seleccionar cuidadosamente el modelo que mejor se adapte a sus necesidades, puede optimizar los costos y, al mismo tiempo, lograr el rendimiento deseado de la aplicación.",
+ "text": "Optimización del uso: tenga en cuenta los precios y las capacidades del modelo al elegir los modelos. Comience con modelos menos costosos para tareas menos complejas, como la generación de texto o las tareas de finalización. Para tareas más complejas, como la traducción de idiomas o la comprensión de contenidos, considere la posibilidad de utilizar modelos más avanzados. Tenga en cuenta las diferentes capacidades del modelo y los límites máximos de uso de tokens cuando elija un modelo que sea adecuado para casos de uso como la incrustación de texto, la generación de imágenes o los escenarios de transcripción. Al seleccionar cuidadosamente el modelo que mejor se adapte a sus necesidades, puede optimizar los costos y, al mismo tiempo, lograr el rendimiento deseado de la aplicación.",
"type": "checklist",
"waf": "costar"
},
@@ -4566,7 +4414,7 @@
"description": "",
"guid": "fb44ea80-44a3-465f-9d50-98b800a90fd6",
"service": "Azure Openai",
- "text": "Optimización de uso: maximice los puntos de interrupción de precios de Azure OpenAI, por ejemplo, el ajuste preciso y los puntos de interrupción del modelo, como la generación de imágenes. Debido a que el ajuste fino se cobra por hora, use todo el tiempo que tenga disponible por hora para mejorar los resultados del ajuste fino y evitar pasar al siguiente período de facturación. Del mismo modo, el costo de generar 100 imágenes es el mismo que el costo de 1 imagen. Maximice los puntos de ruptura de precios a su favor.",
+ "text": "Optimización de uso: maximice los puntos de interrupción de precios de Azure OpenAI, por ejemplo, el ajuste preciso y los puntos de interrupción del modelo, como la generación de imágenes. Dado que el ajuste fino se cobra por hora, utilice todo el tiempo que tenga disponible por hora para mejorar los resultados del ajuste fino y evitar pasar al siguiente período de facturación. Del mismo modo, el costo de generar 100 imágenes es el mismo que el costo de 1 imagen. Maximice los puntos de ruptura de precios a su favor.",
"type": "checklist",
"waf": "costar"
},
@@ -4614,7 +4462,7 @@
"description": "El uso de las funciones de la API para restringir el uso alinea el consumo de servicios con las necesidades del cliente. Esto ahorra dinero al garantizar que el modelo no genere una respuesta demasiado larga que consuma más tokens de los necesarios.",
"guid": "afb53b41-825a-4310-b445-bf391792c568",
"service": "Azure Openai",
- "text": "Diseño del código de cliente para establecer límites: los clientes personalizados deben usar las características de límite de la API de finalizaciones de Azure OpenAI, como el límite máximo en el número de tokens por modelo ('max_tokens') o el número de finalizaciones hasta la generación ('n'). Establecer límites garantiza que el servidor no produzca más de lo que el cliente necesita.",
+ "text": "Diseño del código de cliente para establecer límites: los clientes personalizados deben usar las características de límite de la API de finalizaciones de Azure OpenAI, como el límite máximo en el número de tokens por modelo ('max_tokens') o el número de finalizaciones para la generación ('n'). Establecer límites garantiza que el servidor no produzca más de lo que el cliente necesita.",
"type": "recommendation",
"waf": "Costar"
},
@@ -4627,10 +4475,10 @@
"waf": "Costar"
},
{
- "description": "La supervisión continua del uso administrado por el aprovisionamiento le proporciona la información que necesita para comprender si está infrautilizando el rendimiento aprovisionado.",
+ "description": "La supervisión continua de la utilización administrada por el aprovisionamiento le proporciona la información que necesita para comprender si está infrautilizando el rendimiento aprovisionado.",
"guid": "06a0b95c-b014-4205-8d0c-f074ec393239",
"service": "Azure Openai",
- "text": "Supervise el uso del rendimiento aprovisionado: si usa el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento para asegurarse de que no está infrautilizando el rendimiento aprovisionado que adquirió.",
+ "text": "Supervise el uso del rendimiento aprovisionado: si usa el rendimiento aprovisionado, supervise el uso administrado por el aprovisionamiento para asegurarse de que no está infrautilizando el rendimiento aprovisionado que compró.",
"type": "recommendation",
"waf": "Costar"
},
@@ -4638,7 +4486,7 @@
"description": "La supervisión de costos, el establecimiento de presupuestos y la configuración de alertas proporcionan a la gobernanza los procesos de responsabilidad adecuados.",
"guid": "f18aba52-5587-43e6-b994-8cab7022167f",
"service": "Azure Openai",
- "text": "Gestión de costes: Utilice las funciones de gestión de costes con OpenAI para supervisar los costes, establecer presupuestos para gestionarlos y crear alertas para notificar a las partes interesadas sobre riesgos o anomalías.",
+ "text": "Gestión de costes: Utilice las funciones de gestión de costes con OpenAI para supervisar los costes, establecer presupuestos para gestionar los costes y crear alertas para notificar a las partes interesadas los riesgos o anomalías.",
"type": "recommendation",
"waf": "Costar"
},
@@ -4654,7 +4502,7 @@
"description": "",
"guid": "56e72e7c-32bb-414b-bf04-d2883871aacb",
"service": "Azure Openai",
- "text": "Observabilidad: Monitoree, agregue y visualice las métricas adecuadas.",
+ "text": "Observabilidad: Supervise, agregue y visualice las métricas adecuadas.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4662,7 +4510,7 @@
"description": "",
"guid": "63aedcb9-e01e-4df3-b9a6-13c13d6971d4",
"service": "Azure Openai",
- "text": "Observabilidad: si los diagnósticos de Azure OpenAI son insuficientes para sus necesidades, considere la posibilidad de usar una puerta de enlace como Azure API Management delante de Azure OpenAI para registrar tanto las solicitudes entrantes como las respuestas salientes cuando esté permitido. Esta información puede ayudarle a comprender la eficacia del modelo para las solicitudes entrantes.",
+ "text": "Observabilidad: si los diagnósticos de Azure OpenAI son insuficientes para sus necesidades, considere la posibilidad de usar una puerta de enlace como Azure API Management frente a Azure OpenAI para registrar las solicitudes entrantes y las respuestas salientes cuando esté permitido. Esta información puede ayudarle a comprender la eficacia del modelo para las solicitudes entrantes.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4670,7 +4518,7 @@
"description": "",
"guid": "fe7a8e0a-b53a-48f0-a204-4e1e7e20ea4b",
"service": "Azure Openai",
- "text": "Implemente con confianza: use la infraestructura como código (IaC) para implementar Azure OpenAI, implementaciones de modelos y otra infraestructura necesaria para ajustar modelos.",
+ "text": "Implemente con confianza: use la infraestructura como código (IaC) para implementar Azure OpenAI, implementaciones de modelos y otra infraestructura necesaria para ajustar los modelos.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4686,7 +4534,7 @@
"description": "",
"guid": "4c82d2b3-c083-4a0e-9cd2-92d2b00b4c96",
"service": "Azure Openai",
- "text": "Automatice para aumentar la eficiencia: si utiliza la autenticación basada en claves, implemente una estrategia de rotación de claves automatizada.",
+ "text": "Automatice para aumentar la eficiencia: si utiliza la autenticación basada en claves, implemente una estrategia automatizada de rotación de claves.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -4718,7 +4566,7 @@
"description": "",
"guid": "59c8767d-1b78-4016-92d5-ebd83032fafa",
"service": "Azure Openai",
- "text": "Capacidad: use el rendimiento aprovisionado para las cargas de trabajo de producción. El rendimiento aprovisionado ofrece memoria y proceso dedicados, capacidad reservada y latencia máxima constante para la versión del modelo especificada. La oferta de pago por uso puede sufrir problemas de vecinos ruidosos, como una mayor latencia y limitación en regiones con un uso intensivo. Además, el enfoque de pago por uso no ofrece capacidad garantizada.",
+ "text": "Capacidad: use el rendimiento aprovisionado para las cargas de trabajo de producción. El rendimiento aprovisionado ofrece memoria y proceso dedicados, capacidad reservada y latencia máxima coherente para la versión del modelo especificada. La oferta de pago por uso puede sufrir problemas de vecinos ruidosos, como una mayor latencia y limitación en regiones con un uso intensivo. Además, el enfoque de pago por uso no ofrece capacidad garantizada.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4734,7 +4582,7 @@
"description": "",
"guid": "ceb21879-94da-485e-a24b-b30180fb566c",
"service": "Azure Openai",
- "text": "Capacidad: asigne PTU para cubrir el uso previsto y complemente estas PTU con una implementación de TPM para controlar la elasticidad por encima de ese límite. Este enfoque combina el rendimiento base con el rendimiento elástico para mayor eficiencia. Al igual que otras consideraciones, este enfoque requiere una implementación de puerta de enlace personalizada para enrutar las solicitudes a la implementación de TPM cuando se alcanzan los límites de PTU.",
+ "text": "Capacidad: asigne PTU para cubrir el uso previsto y complemente estas PTU con una implementación de TPM para controlar la elasticidad por encima de ese límite. Este enfoque combina el rendimiento base con el rendimiento elástico para lograr eficiencia. Al igual que otras consideraciones, este enfoque requiere una implementación de puerta de enlace personalizada para enrutar las solicitudes a la implementación de TPM cuando se alcanzan los límites de PTU.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4750,7 +4598,7 @@
"description": "",
"guid": "cdf82e76-ee07-47e6-9985-6b1c0a39dd42",
"service": "Azure Openai",
- "text": "Capacidad: seleccione un modelo que se adapte a sus requisitos de rendimiento, teniendo en cuenta el equilibrio entre la velocidad y la complejidad de la salida. El rendimiento del modelo puede variar significativamente en función del tipo de modelo elegido. Los modelos diseñados para la velocidad ofrecen tiempos de respuesta más rápidos, lo que puede ser beneficioso para aplicaciones que requieren interacciones rápidas. Por el contrario, los modelos más sofisticados podrían ofrecer resultados de mayor calidad a expensas de un mayor tiempo de respuesta.",
+ "text": "Capacidad: seleccione un modelo que se alinee con sus requisitos de rendimiento, teniendo en cuenta el equilibrio entre la velocidad y la complejidad de la salida. El rendimiento del modelo puede variar significativamente en función del tipo de modelo elegido. Los modelos diseñados para la velocidad ofrecen tiempos de respuesta más rápidos, lo que puede ser beneficioso para aplicaciones que requieren interacciones rápidas. Por el contrario, los modelos más sofisticados podrían ofrecer resultados de mayor calidad a expensas de un mayor tiempo de respuesta.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4766,7 +4614,7 @@
"description": "",
"guid": "456cbf54-9c2f-4c6e-9739-eca408fa6baf",
"service": "Azure Openai",
- "text": "Logre el rendimiento: determine cuándo usar el ajuste fino antes de comprometerse con el ajuste. Aunque hay buenos casos de uso para el ajuste, como cuando la información necesaria para dirigir el modelo es demasiado larga o compleja para caber en la solicitud, asegúrese de que los enfoques de ingeniería de solicitud y generación aumentada de recuperación (RAG) no funcionen o sean demostrablemente más costosos.",
+ "text": "Logre el rendimiento: determine cuándo usar el ajuste fino antes de comprometerse con el ajuste. Aunque hay buenos casos de uso para el ajuste, como cuando la información necesaria para dirigir el modelo es demasiado larga o compleja para caber en el mensaje, asegúrese de que los enfoques de ingeniería de avisos y generación aumentada de recuperación (RAG) no funcionen o sean demostrablemente más costosos.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -4830,7 +4678,7 @@
"description": "",
"guid": "3395416e-27c6-4ded-941a-de4e562c5c00",
"service": "Virtual Machines",
- "text": "Explora las opciones de recuperación automática. Azure admite la supervisión de la degradación del estado y las características de recuperación automática para las máquinas virtuales. Por ejemplo, los conjuntos de escalado proporcionan reparaciones automáticas de instancias. En escenarios más avanzados, la recuperación automática implica el uso de Azure Site Recovery, tener un modo de espera pasivo para conmutar por error o volver a implementar desde la infraestructura como código (IaC). El método que elija debe alinearse con los requisitos empresariales y las operaciones de la organización. Para obtener más información, consulte Interrupciones del servicio de máquina virtual.",
+ "text": "Explora las opciones de recuperación automática. Azure admite la degradación del estado, la supervisión y las características de recuperación automática de las máquinas virtuales. Por ejemplo, los conjuntos de escalado proporcionan reparaciones automáticas de instancias. En escenarios más avanzados, la recuperación automática implica el uso de Azure Site Recovery, tener un modo de espera pasivo para conmutar por error o volver a implementar desde la infraestructura como código (IaC). El método que elija debe alinearse con los requisitos empresariales y las operaciones de la organización. Para obtener más información, consulte Interrupciones del servicio de máquina virtual.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -4838,7 +4686,7 @@
"description": "",
"guid": "3d633098-6fc7-4752-907c-5a02d53ffba2",
"service": "Virtual Machines",
- "text": "Ajuste el tamaño de las máquinas virtuales y sus dependencias. Comprenda el trabajo esperado de su máquina virtual para asegurarse de que no sea de tamaño insuficiente y pueda manejar la carga máxima. Tener capacidad extra para mitigar fallos.",
+ "text": "Ajuste el tamaño de las máquinas virtuales y sus dependencias. Comprenda el trabajo esperado de su máquina virtual para asegurarse de que no tenga un tamaño insuficiente y pueda manejar la carga máxima. Tener capacidad adicional para mitigar fallos.",
"type": "checklist",
"waf": "fiabilidad"
},
@@ -4854,12 +4702,12 @@
"description": "",
"guid": "6bbb44ad-f6ed-4990-b519-a56e4d995170",
"service": "Virtual Machines",
- "text": "Ejecute las operaciones con rigor. Las opciones de diseño de confiabilidad deben estar respaldadas por operaciones efectivas basadas en los principios de supervisión, pruebas de resistencia en producción, parches y actualizaciones de máquinas virtuales de aplicaciones automatizadas y coherencia de las implementaciones. Para obtener orientación operativa, consulte Excelencia operativa.",
+ "text": "Ejecute las operaciones con rigor. Las opciones de diseño de confiabilidad deben estar respaldadas por operaciones efectivas basadas en los principios de supervisión, pruebas de resistencia en producción, parches y actualizaciones automatizadas de máquinas virtuales de aplicaciones y coherencia de las implementaciones. Para obtener orientación operativa, consulte Excelencia operativa.",
"type": "checklist",
"waf": "fiabilidad"
},
{
- "description": "Prepare su aplicación para el futuro para el escalado y aproveche las garantías de alta disponibilidad que distribuyen las máquinas virtuales a través de dominios de error en una región o una zona de disponibilidad.",
+ "description": "Prepare su aplicación para el futuro para el escalado y aproveche las garantías de alta disponibilidad que distribuyen las máquinas virtuales entre dominios de error en una región o una zona de disponibilidad.",
"guid": "bb45d3f7-dae7-4eb6-a823-76737e6d0d88",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Use conjuntos de escalado de máquinas virtuales en modo de orquestación flexible para implementar máquinas virtuales.",
@@ -4870,12 +4718,12 @@
"description": "Mantenga la disponibilidad incluso si una instancia se considera incorrecta. Las reparaciones automáticas inician la recuperación mediante la sustitución de la instancia defectuosa. Establecer una ventana de tiempo puede evitar operaciones de reparación inadvertidas o prematuras.",
"guid": "29912435-4c36-465e-91e2-6c8fcb42b33f",
"service": "Virtual Machines",
- "text": "(Máquinas virtuales) Implemente puntos de conexión de estado que emitan estados de mantenimiento de instancia en máquinas virtuales. (Conjunto de escalas) Habilite las reparaciones automáticas en el conjunto de báscula especificando la acción de reparación preferida. Considere la posibilidad de establecer un período de tiempo durante el cual las reparaciones automáticas se detengan si cambia el estado de la máquina virtual.",
+ "text": "(Máquinas virtuales) Implemente puntos de conexión de estado que emitan estados de mantenimiento de instancias en máquinas virtuales. (Conjunto de escalas) Habilite las reparaciones automáticas en el conjunto de básculas especificando la acción de reparación preferida. Considere la posibilidad de establecer un período de tiempo durante el cual las reparaciones automáticas se detengan si cambia el estado de la máquina virtual.",
"type": "recommendation",
"waf": "Fiabilidad"
},
{
- "description": "El sobreaprovisionamiento reduce los tiempos de implementación y tiene una ventaja en cuanto a costos, ya que no se facturan las máquinas virtuales adicionales.",
+ "description": "El sobreaprovisionamiento reduce los tiempos de implementación y tiene una ventaja de costo, ya que no se facturan las máquinas virtuales adicionales.",
"guid": "71982e91-2b16-4f49-b91e-7c52a6e0042a",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Habilite el sobreaprovisionamiento en conjuntos de escalado.",
@@ -4891,10 +4739,10 @@
"waf": "Fiabilidad"
},
{
- "description": "Las instancias de máquina virtual se aprovisionan en ubicaciones físicamente separadas dentro de cada región de Azure que son tolerantes a errores locales. Tenga en cuenta que, en función de la disponibilidad de recursos, puede haber un número impar de instancias en todas las zonas. El equilibrio de zonas admite la disponibilidad al asegurarse de que, si una zona está inactiva, las otras zonas tengan suficientes instancias. Dos instancias en cada zona proporcionan un búfer durante las actualizaciones.",
+ "description": "Las instancias de máquina virtual se aprovisionan en ubicaciones físicamente separadas dentro de cada región de Azure que son tolerantes a errores locales. Tenga en cuenta que, en función de la disponibilidad de recursos, puede haber un número impar de instancias en todas las zonas. El equilibrio de zona admite la disponibilidad al asegurarse de que, si una zona está inactiva, las otras zonas tengan suficientes instancias. Dos instancias en cada zona proporcionan un búfer durante las actualizaciones.",
"guid": "056b1e06-a521-4662-9c87-19371260efe6",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Implemente en zonas de disponibilidad en conjuntos de escalado. Configure al menos dos instancias en cada zona. El equilibrio de zonas distribuye equitativamente las instancias entre zonas.",
+ "text": "(Conjunto de escalas) Implementación en zonas de disponibilidad en conjuntos de escalado. Configure al menos dos instancias en cada zona. El equilibrio de zonas distribuye equitativamente las instancias entre zonas.",
"type": "recommendation",
"waf": "Fiabilidad"
},
@@ -4926,7 +4774,7 @@
"description": "",
"guid": "5bc85e31-f7fa-4102-8e43-6fbe7add0d89",
"service": "Virtual Machines",
- "text": "Identifique las máquinas virtuales que mantienen el estado. Asegúrese de que los datos se clasifican según las etiquetas de confidencialidad proporcionadas por su organización. Proteja los datos mediante el uso de controles de seguridad, como niveles adecuados de cifrado en reposo y en tránsito. Si tiene requisitos de alta confidencialidad, considere la posibilidad de usar controles de alta seguridad, como el cifrado doble y la informática confidencial de Azure, para proteger los datos en uso.",
+ "text": "Identifique las máquinas virtuales que mantienen el estado. Asegúrese de que los datos se clasifican según las etiquetas de confidencialidad proporcionadas por su organización. Proteja los datos mediante el uso de controles de seguridad, como los niveles adecuados de cifrado en reposo y en tránsito. Si tiene requisitos de alta confidencialidad, considere la posibilidad de usar controles de alta seguridad, como el cifrado doble y la informática confidencial de Azure, para proteger los datos en uso.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4934,7 +4782,7 @@
"description": "",
"guid": "d5320544-6d25-46c7-ab46-e81e5d85d9b3",
"service": "Virtual Machines",
- "text": "Proporcione segmentación a las máquinas virtuales y a los conjuntos de escalado mediante el establecimiento de límites de red y controles de acceso. Coloque las máquinas virtuales en grupos de recursos que compartan el mismo ciclo de vida.",
+ "text": "Proporcione segmentación a las máquinas virtuales y los conjuntos de escalado mediante el establecimiento de límites de red y controles de acceso. Coloque las máquinas virtuales en grupos de recursos que compartan el mismo ciclo de vida.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4942,7 +4790,7 @@
"description": "",
"guid": "becd6031-a256-4186-995e-75817fc7783c",
"service": "Virtual Machines",
- "text": "Aplique controles de acceso a las identidades que intentan llegar a las máquinas virtuales y también a las máquinas virtuales que acceden a otros recursos. Use el identificador de Microsoft Entra para las necesidades de autenticación y autorización. Implemente contraseñas seguras, autenticación multifactor y control de acceso basado en roles (RBAC) para las máquinas virtuales y sus dependencias, como los secretos, para permitir que las identidades permitidas realicen solo las operaciones que se esperan de sus roles.",
+ "text": "Aplique controles de acceso a las identidades que intentan llegar a las máquinas virtuales y también a las máquinas virtuales que acceden a otros recursos. Use el identificador de Microsoft Entra para las necesidades de autenticación y autorización. Implemente contraseñas seguras, autenticación multifactor y control de acceso basado en roles (RBAC) para las máquinas virtuales y sus dependencias, como secretos, para permitir que las identidades permitidas realicen solo las operaciones que se esperan de sus roles.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4950,7 +4798,7 @@
"description": "",
"guid": "cc96d188-8a1f-4b48-9525-d6f3f867f322",
"service": "Virtual Machines",
- "text": "Utilice los controles de red para restringir el tráfico de entrada y salida. Aísle las máquinas virtuales y los conjuntos de escalado en Azure Virtual Network y defina grupos de seguridad de red para filtrar el tráfico. Protéjase contra ataques de denegación de servicio distribuido (DDoS). Utilice equilibradores de carga y reglas de firewall para protegerse contra el tráfico malicioso y los ataques de exfiltración de datos.",
+ "text": "Utilice los controles de red para restringir el tráfico de entrada y salida. Aísle las máquinas virtuales y los conjuntos de escalado en Azure Virtual Network y defina grupos de seguridad de red para filtrar el tráfico. Protéjase contra ataques de denegación de servicio distribuido (DDoS). Utilice equilibradores de carga y reglas de firewall para protegerse contra el tráfico malintencionado y los ataques de exfiltración de datos.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4958,7 +4806,7 @@
"description": "",
"guid": "66e5f683-0d57-4ed1-b2bd-68e4549631bc",
"service": "Virtual Machines",
- "text": "Reduzca la superficie expuesta a ataques mediante la protección de las imágenes del sistema operativo y la eliminación de los componentes no utilizados. Use imágenes más pequeñas y quite los archivos binarios que no sean necesarios para ejecutar la carga de trabajo. Ajuste las configuraciones de la máquina virtual eliminando características, como cuentas y puertos predeterminados, que no necesite.",
+ "text": "Reduzca la superficie expuesta a ataques mediante la protección de las imágenes del sistema operativo y la eliminación de los componentes no utilizados. Use imágenes más pequeñas y quite los archivos binarios que no sean necesarios para ejecutar la carga de trabajo. Ajuste las configuraciones de la máquina virtual eliminando características, como las cuentas y los puertos predeterminados, que no necesite.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4974,7 +4822,7 @@
"description": "",
"guid": "39b32108-5423-42aa-beaa-1601df1971f6",
"service": "Virtual Machines",
- "text": "Detección de amenazas. Supervise las máquinas virtuales en busca de amenazas y configuraciones incorrectas. Use Defender para servidores para capturar los cambios en la máquina virtual y el sistema operativo, y mantener un registro de auditoría del acceso, las nuevas cuentas y los cambios en los permisos.",
+ "text": "Detección de amenazas. Supervise las máquinas virtuales en busca de amenazas y errores de configuración. Use Defender para servidores para capturar los cambios en la máquina virtual y el sistema operativo, y mantener un registro de auditoría del acceso, las cuentas nuevas y los cambios en los permisos.",
"type": "checklist",
"waf": "seguridad"
},
@@ -4982,7 +4830,7 @@
"description": "",
"guid": "fb9921a8-884c-40df-a588-a554143809f2",
"service": "Virtual Machines",
- "text": "Prevención de amenazas. Protéjase contra ataques de malware y actores maliciosos mediante la implementación de controles de seguridad como firewalls, software antivirus y sistemas de detección de intrusos. Determine si se requiere un entorno de ejecución de confianza (TEE).",
+ "text": "Prevención de amenazas. Protéjase contra los ataques de malware y los actores maliciosos mediante la implementación de controles de seguridad como firewalls, software antivirus y sistemas de detección de intrusos. Determine si se requiere un entorno de ejecución de confianza (TEE).",
"type": "checklist",
"waf": "seguridad"
},
@@ -5006,7 +4854,7 @@
"description": "El etiquetado es una forma común de segmentar y organizar los recursos, y puede ser crucial durante la gestión de incidentes. Para obtener más información, consulte Propósito de la nomenclatura y el etiquetado.",
"guid": "944802d9-671c-479f-b973-fd6111a18486",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Aplique etiquetas recomendadas por la organización en los recursos aprovisionados.",
+ "text": "(VMs, conjunto de escalado) Aplique las etiquetas recomendadas por la organización en los recursos aprovisionados.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -5014,7 +4862,7 @@
"description": "Las características del perfil de seguridad se habilitan automáticamente cuando se crea la máquina virtual. Para más información, consulte Línea base de seguridad de Azure para conjuntos de escalado de máquinas virtuales.",
"guid": "a6b12603-c2e3-43fd-9a79-6e6317817278",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca un perfil de seguridad con las características de seguridad que desea habilitar en la configuración de la máquina virtual. Por ejemplo, cuando se especifica el cifrado en el host en el perfil, los datos almacenados en el host de la máquina virtual se cifran en reposo y los flujos se cifran en el servicio de almacenamiento.",
+ "text": "(VMs, conjunto de escalado) Establezca un perfil de seguridad con las características de seguridad que desea habilitar en la configuración de la máquina virtual. Por ejemplo, cuando se especifica el cifrado en el host en el perfil, los datos almacenados en el host de la máquina virtual se cifran en reposo y los flujos se cifran en el servicio de almacenamiento.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -5038,7 +4886,7 @@
"description": "Las extensiones se usan para arrancar las máquinas virtuales con el software adecuado que protege el acceso hacia y desde las máquinas virtuales. Las extensiones proporcionadas por Microsoft se actualizan con frecuencia para mantenerse al día con la evolución de los estándares de seguridad.",
"guid": "06c4068a-2562-4cc4-9269-8bdb6b349c3a",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Incluya extensiones en las máquinas virtuales que protejan contra las amenazas. Por ejemplo, - Extensión de Key Vault para Windows y Linux - Autenticación de identificador de Microsoft Entra - Microsoft Antimalware para Azure Cloud Services y Virtual Machines - Extensión de Azure Disk Encryption para Windows y Linux.",
+ "text": "(VMs, conjunto de escalado) Incluya extensiones en las máquinas virtuales que protejan contra las amenazas. Por ejemplo, - Extensión de Key Vault para Windows y Linux - Autenticación de identificador de Microsoft Entra - Microsoft Antimalware para Azure Cloud Services y Virtual Machines - Extensión de Azure Disk Encryption para Windows y Linux.",
"type": "recommendation",
"waf": "Seguridad"
},
@@ -5046,7 +4894,7 @@
"description": "",
"guid": "3e760d37-8430-4da5-833d-95bff2d43e4f",
"service": "Virtual Machines",
- "text": "Calcule costos realistas. Use la calculadora de precios para calcular los costos de sus máquinas virtuales. Identifique la mejor máquina virtual para su carga de trabajo mediante el selector de máquinas virtuales. Para obtener más información, consulte Precios de Linux y Windows.",
+ "text": "Calcule costos realistas. Use la calculadora de precios para calcular los costos de las máquinas virtuales. Identifique la mejor máquina virtual para su carga de trabajo mediante el selector de máquinas virtuales. Para obtener más información, consulte Precios de Linux y Windows.",
"type": "checklist",
"waf": "costar"
},
@@ -5062,7 +4910,7 @@
"description": "",
"guid": "353f0d7a-b104-43c3-b3e9-926af6458844",
"service": "Virtual Machines",
- "text": "Elija los recursos adecuados. La selección de los tamaños de plan de VM y SKU afecta directamente al costo total. Elija las máquinas virtuales en función de las características de la carga de trabajo. ¿La carga de trabajo hace un uso intensivo de la CPU o ejecuta procesos interrumpibles? Cada SKU tiene opciones de disco asociadas que afectan al costo total.",
+ "text": "Elija los recursos adecuados. La selección de los tamaños de plan de VM y las SKU afecta directamente al costo total. Elija las máquinas virtuales en función de las características de la carga de trabajo. ¿La carga de trabajo hace un uso intensivo de la CPU o ejecuta procesos interrumpibles? Cada SKU tiene opciones de disco asociadas que afectan al costo total.",
"type": "checklist",
"waf": "costar"
},
@@ -5070,7 +4918,7 @@
"description": "",
"guid": "dff9f383-b459-4359-907e-bd33a92d4bd6",
"service": "Virtual Machines",
- "text": "Elija las capacidades adecuadas para los recursos dependientes. Ahorre en costos de almacenamiento de copia de seguridad para el nivel estándar de almacén mediante el almacenamiento de Azure Backup con capacidad reservada. Ofrece un descuento cuando te comprometes a una reserva por un año o tres años.",
+ "text": "Elija las capacidades adecuadas para los recursos dependientes. Ahorre en costos de almacenamiento de copia de seguridad para el nivel estándar de almacén mediante el almacenamiento de Azure Backup con capacidad reservada. Ofrece un descuento cuando se compromete a una reserva por un año o tres años.",
"type": "checklist",
"waf": "costar"
},
@@ -5094,31 +4942,31 @@
"description": "",
"guid": "877c04dd-441f-4202-9b87-9eeb3c60b564",
"service": "Virtual Machines",
- "text": "Busca formas de optimizar. Algunas estrategias incluyen la elección del enfoque más rentable entre aumentar los recursos de un sistema existente, o escalar verticalmente, y agregar más instancias de ese sistema, o escalar horizontalmente. Puede descargar la demanda distribuyéndola a otros recursos, o puede reducir la demanda mediante la implementación de colas de prioridad, descarga de puerta de enlace, almacenamiento en búfer y limitación de velocidad. Para obtener más información, consulte las recomendaciones de Eficiencia del rendimiento.",
+ "text": "Busca formas de optimizar. Algunas estrategias incluyen elegir el enfoque más rentable entre aumentar los recursos de un sistema existente, o escalar verticalmente, y agregar más instancias de ese sistema, o escalar horizontalmente. Puede descargar la demanda distribuyéndola a otros recursos, o puede reducir la demanda mediante la implementación de colas de prioridad, descarga de puerta de enlace, almacenamiento en búfer y limitación de velocidad. Para obtener más información, consulte las recomendaciones de Eficiencia del rendimiento.",
"type": "checklist",
"waf": "costar"
},
{
- "description": "Los SKU tienen un precio según las capacidades que ofrecen. Si no necesitas capacidades avanzadas, no gastes de más en SKU. Las máquinas virtuales de acceso puntual aprovechan la capacidad excedente de Azure a un costo menor.",
+ "description": "Los SKU tienen un precio de acuerdo con las capacidades que ofrecen. Si no necesitas capacidades avanzadas, no gastes de más en SKU. Las máquinas virtuales de acceso puntual aprovechan la capacidad excedente de Azure a un costo menor.",
"guid": "90700d86-70f6-433f-b995-b9ad8cfdec84",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Elija el tamaño del plan de máquina virtual y la SKU adecuados. Identifique los mejores tamaños de máquina virtual para su carga de trabajo. Utilice el selector de máquina virtual para identificar la mejor máquina virtual para su carga de trabajo. Consulta los precios de Windows y Linux. En el caso de las cargas de trabajo, como los trabajos de procesamiento por lotes muy paralelos que pueden tolerar algunas interrupciones, considere la posibilidad de usar Azure Spot Virtual Machines. Las máquinas virtuales puntuales son buenas para experimentar, desarrollar y probar soluciones a gran escala.",
+ "text": "(VMs, conjunto de escalado) Elija el tamaño del plan de máquina virtual y la SKU adecuados. Identifique los mejores tamaños de máquina virtual para su carga de trabajo. Use el selector de máquina virtual para identificar la mejor máquina virtual para su carga de trabajo. Consulta los precios de Windows y Linux. En el caso de cargas de trabajo, como trabajos de procesamiento por lotes muy paralelos que pueden tolerar algunas interrupciones, considere la posibilidad de usar Azure Spot Virtual Machines. Las máquinas virtuales puntuales son buenas para experimentar, desarrollar y probar soluciones a gran escala.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Algunos tipos de discos de alto rendimiento ofrecen funciones y estrategias de optimización de costos adicionales. La capacidad de ajuste del disco SSD prémium v2 puede reducir los costos, ya que proporciona un alto rendimiento sin sobreaprovisionamiento, lo que, de otro modo, podría conducir a recursos infrautilizados.",
+ "description": "Algunos tipos de discos de alto rendimiento ofrecen funciones y estrategias de optimización de costos adicionales. La capacidad de ajuste del disco SSD prémium v2 puede reducir los costos, ya que proporciona un alto rendimiento sin sobreaprovisionamiento, lo que, de otro modo, podría dar lugar a recursos infrautilizados.",
"guid": "14211a5a-ea48-4aa1-9f24-e46689328dda",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Evalúe las opciones de disco asociadas a las SKU de la máquina virtual. Determine sus necesidades de rendimiento teniendo en cuenta sus necesidades de capacidad de almacenamiento y teniendo en cuenta los patrones de carga de trabajo fluctuantes. Por ejemplo, el disco SSD prémium v2 de Azure permite ajustar de forma granular el rendimiento independientemente del tamaño del disco.",
+ "text": "(VMs, conjunto de escalado) Evalúe las opciones de disco asociadas a las SKU de la máquina virtual. Determine sus necesidades de rendimiento teniendo en cuenta sus necesidades de capacidad de almacenamiento y teniendo en cuenta los patrones de carga de trabajo fluctuantes. Por ejemplo, el disco SSD prémium v2 de Azure permite ajustar de forma granular el rendimiento independientemente del tamaño del disco.",
"type": "recommendation",
"waf": "Costar"
},
{
- "description": "Reduzca los costos de infraestructura informática aplicando los grandes descuentos de las máquinas virtuales de acceso puntual.",
+ "description": "Reduzca los costos de infraestructura informática aplicando los grandes descuentos de las máquinas virtuales puntuales.",
"guid": "38d3a88b-a84f-46f3-95ce-76a4e245027b",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Combine máquinas virtuales normales con máquinas virtuales de acceso puntual. La orquestación flexible le permite distribuir máquinas virtuales de acceso puntual en función de un porcentaje especificado.",
+ "text": "(Conjunto de escalas) Mezcle máquinas virtuales normales con máquinas virtuales de acceso puntual. La orquestación flexible le permite distribuir máquinas virtuales de acceso puntual en función de un porcentaje especificado.",
"type": "recommendation",
"waf": "Costar"
},
@@ -5126,7 +4974,7 @@
"description": "El escalado vertical o la detención de recursos cuando no están en uso reduce el número de máquinas virtuales que se ejecutan en el conjunto de escalado, lo que ahorra costos. La función Start/Stop es una opción de automatización de bajo costo.",
"guid": "eccee9b1-70f3-4c96-8223-35e24d842201",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Reduzca el número de instancias de VM cuando la demanda disminuya. Establezca una política de reducción horizontal basada en criterios. Detenga las máquinas virtuales durante las horas de inactividad. Puede usar la característica Iniciar/Detener de Azure Automation y configurarla según las necesidades de su empresa.",
+ "text": "(Conjunto de escalas) Reduzca el número de instancias de VM cuando la demanda disminuye. Establezca una política de reducción horizontal basada en criterios. Detenga las máquinas virtuales durante las horas de inactividad. Puede usar la característica Iniciar/Detener de Azure Automation y configurarla según las necesidades de su empresa.",
"type": "recommendation",
"waf": "Costar"
},
@@ -5134,7 +4982,7 @@
"description": "Puede maximizar sus licencias locales mientras obtiene los beneficios de la nube.",
"guid": "3c34c3e4-5715-472e-953e-2d5030bf18a0",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Aproveche la movilidad de licencias mediante la Ventaja híbrida de Azure. Las máquinas virtuales tienen una opción de licencia que le permite traer sus propias licencias locales del SO de servidor Windows a Azure. La Ventaja híbrida de Azure también le permite incorporar determinadas suscripciones de Linux a Azure.",
+ "text": "(VMs, conjunto de escalado) Aproveche la movilidad de licencias mediante la Ventaja híbrida de Azure. Las máquinas virtuales tienen una opción de licencia que le permite traer sus propias licencias locales del SO de servidor Windows a Azure. La Ventaja híbrida de Azure también le permite incorporar determinadas suscripciones de Linux a Azure.",
"type": "recommendation",
"waf": "Costar"
},
@@ -5158,7 +5006,7 @@
"description": "",
"guid": "f99e71a9-05ee-41c2-81b7-8d794763040b",
"service": "Virtual Machines",
- "text": "Cree un plan de mantenimiento que incluya la aplicación regular de parches en el sistema como parte de las operaciones rutinarias. Incluir procesos de emergencia que permitan la aplicación inmediata de parches. Puede tener procesos personalizados para administrar la aplicación de revisiones o delegar parcialmente la tarea a Azure.",
+ "text": "Cree un plan de mantenimiento que incluya la aplicación periódica de parches al sistema como parte de las operaciones rutinarias. Incluir procesos de emergencia que permitan la aplicación inmediata de parches. Puede tener procesos personalizados para administrar la aplicación de revisiones o delegar parcialmente la tarea a Azure.",
"type": "checklist",
"waf": "Operaciones"
},
@@ -5190,12 +5038,12 @@
"description": "",
"guid": "77cdbef0-ba18-4ef0-9ef4-088931e331c7",
"service": "Virtual Machines",
- "text": "Administra tu cuota. Planifique el nivel de cuota que requiere su carga de trabajo y revise ese nivel con regularidad a medida que evoluciona la carga de trabajo. Si necesita aumentar o disminuir su cuota, solicite esos cambios con anticipación.",
+ "text": "Administra tu cuota. Planifique el nivel de cuota que requiere su carga de trabajo y revise ese nivel periódicamente a medida que evoluciona la carga de trabajo. Si necesita aumentar o disminuir su cuota, solicite esos cambios con anticipación.",
"type": "checklist",
"waf": "Operaciones"
},
{
- "description": "La orquestación flexible puede administrar instancias de VM a escala. La entrega de máquinas virtuales individuales agrega sobrecarga operativa. Por ejemplo, cuando se eliminan instancias de VM, los discos y las NIC asociados también se eliminan automáticamente. Las instancias de VM se distribuyen en varios dominios de error para que las operaciones de actualización no interrumpan el servicio.",
+ "description": "La orquestación flexible puede administrar instancias de VM a escala. La entrega de máquinas virtuales individuales agrega una sobrecarga operativa. Por ejemplo, cuando se eliminan instancias de VM, los discos y las NIC asociados también se eliminan automáticamente. Las instancias de VM se distribuyen en varios dominios de error para que las operaciones de actualización no interrumpan el servicio.",
"guid": "3049efb5-d3ae-4e36-a8fa-12f2c4a44144",
"service": "Virtual Machines",
"text": "(Conjunto de escalas) Los conjuntos de escalado de máquinas virtuales en modo de orquestación flexible pueden ayudar a simplificar la implementación y la administración de la carga de trabajo. Por ejemplo, puede administrar fácilmente la autorreparación mediante el uso de reparaciones automáticas.",
@@ -5203,10 +5051,10 @@
"waf": "Operaciones"
},
{
- "description": "La seguridad es la razón principal de las actualizaciones. Las garantías de seguridad de las instancias no deben deteriorarse con el tiempo. Las actualizaciones graduales se realizan en lotes, lo que garantiza que todas las instancias no estén inactivas al mismo tiempo.",
+ "description": "La seguridad es la razón principal de las actualizaciones. Las garantías de seguridad de las instancias no deben deteriorarse con el tiempo. Las actualizaciones sucesivas se realizan en lotes, lo que garantiza que todas las instancias no estén inactivas al mismo tiempo.",
"guid": "19de83a6-2f87-49b1-8241-d1d687f46658",
"service": "Virtual Machines",
- "text": "(Conjunto de escalas) Mantenga sus máquinas virtuales actualizadas mediante la configuración de una directiva de actualización. Recomendamos actualizaciones continuas. Sin embargo, si necesita un control granular, elija actualizar manualmente. Para la orquestación flexible, puede usar Azure Update Manager.",
+ "text": "(Conjunto de escalas) Mantenga sus máquinas virtuales actualizadas mediante la configuración de una directiva de actualización. Recomendamos actualizaciones continuas. Sin embargo, si necesita un control granular, elija actualizar manualmente. En el caso de la orquestación flexible, puede usar Azure Update Manager.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -5214,7 +5062,7 @@
"description": "Se crean las máquinas virtuales del conjunto de escalado y se preinstalan las aplicaciones especificadas, lo que facilita la administración.",
"guid": "65c832e8-2882-45ed-b239-0e68f74975aa",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Implemente automáticamente aplicaciones de máquina virtual desde Azure Compute Gallery definiendo las aplicaciones en el perfil.",
+ "text": "(VMs, conjunto de escalado) Implemente automáticamente aplicaciones de máquina virtual desde Azure Compute Gallery definiendo las aplicaciones en el perfil.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -5230,7 +5078,7 @@
"description": "La monitorización de los datos es el núcleo de la resolución de incidentes. Una pila de supervisión completa proporciona información sobre el rendimiento de las máquinas virtuales y su estado. Al monitorear continuamente las instancias, puede estar preparado para errores o prevenirlos, como la sobrecarga de rendimiento y los problemas de confiabilidad.",
"guid": "72e210dc-5abb-4569-b650-ec27003bb1cf",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Supervise y mida el estado de las instancias de VM. Implemente la extensión del agente Monitor en las máquinas virtuales para recopilar datos de supervisión del sistema operativo invitado con reglas de recopilación de datos específicas del sistema operativo. Permita que VM Insights supervise el estado y el rendimiento, y vea las tendencias de los datos recopilados. Use los diagnósticos de arranque para obtener información a medida que arrancan las máquinas virtuales. Los diagnósticos de arranque también diagnostican errores de arranque.",
+ "text": "(VMs, conjunto de escalado) Supervise y mida el estado de las instancias de VM. Implemente la extensión del agente Monitor en las máquinas virtuales para recopilar datos de supervisión del sistema operativo invitado con reglas de recopilación de datos específicas del sistema operativo. Habilite la información de la máquina virtual para supervisar el estado y el rendimiento, y para ver las tendencias de los datos recopilados. Use los diagnósticos de arranque para obtener información a medida que arrancan las máquinas virtuales. Los diagnósticos de arranque también diagnostican errores de arranque.",
"type": "recommendation",
"waf": "Operaciones"
},
@@ -5238,7 +5086,7 @@
"description": "",
"guid": "0303e75c-321d-42b0-9226-b05f43633d50",
"service": "Virtual Machines",
- "text": "Definir objetivos de rendimiento. Identifique las métricas de VM para realizar un seguimiento y medir los indicadores de rendimiento, como el tiempo de respuesta, la utilización de la CPU y la utilización de la memoria, así como las métricas de la carga de trabajo, como las transacciones por segundo, los usuarios simultáneos y la disponibilidad y el estado.",
+ "text": "Definir objetivos de rendimiento. Identifique las métricas de VM para realizar un seguimiento y medir con indicadores de rendimiento como el tiempo de respuesta, la utilización de la CPU y la utilización de la memoria, así como las métricas de la carga de trabajo, como las transacciones por segundo, los usuarios simultáneos y la disponibilidad y el estado.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -5246,7 +5094,7 @@
"description": "",
"guid": "f2c0ba97-9170-43ab-90b5-b30f159913ba",
"service": "Virtual Machines",
- "text": "Tenga en cuenta el perfil de rendimiento de las máquinas virtuales, los conjuntos de escalado y la configuración de disco en la planeación de la capacidad. Cada SKU tiene un perfil diferente de memoria y CPU y se comporta de forma diferente en función del tipo de carga de trabajo. Realice pruebas piloto y pruebas de concepto para comprender el comportamiento del rendimiento en la carga de trabajo específica.",
+ "text": "Tenga en cuenta el perfil de rendimiento de las máquinas virtuales, los conjuntos de escalado y la configuración del disco en la planeación de la capacidad. Cada SKU tiene un perfil diferente de memoria y CPU y se comporta de forma diferente en función del tipo de carga de trabajo. Realice pruebas piloto y pruebas de concepto para comprender el comportamiento del rendimiento en la carga de trabajo específica.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -5254,7 +5102,7 @@
"description": "",
"guid": "ffee7b2f-b57c-40cc-a8ab-9044dead9dc7",
"service": "Virtual Machines",
- "text": "Ajuste del rendimiento de la máquina virtual. Aproveche la optimización del rendimiento y la mejora de las características según lo requiera la carga de trabajo. Por ejemplo, use Memoria no volátil Express (NVMe) conectada localmente para casos de uso de alto rendimiento y redes aceleradas, y use SSD Premium v2 para mejorar el rendimiento y la escalabilidad.",
+ "text": "Ajuste del rendimiento de la máquina virtual. Aproveche la optimización del rendimiento y la mejora de las funciones según lo requiera la carga de trabajo. Por ejemplo, utilice Memoria no volátil Express (NVMe) conectada localmente para casos de uso de alto rendimiento y redes aceleradas, y utilice SSD prémium v2 para mejorar el rendimiento y la escalabilidad.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -5270,7 +5118,7 @@
"description": "",
"guid": "739525ea-4d0a-4965-baef-ab0325fbed67",
"service": "Virtual Machines",
- "text": "Recopilar datos de rendimiento. Siga las prácticas recomendadas de Excelencia operativa para supervisar e implementar las extensiones adecuadas para ver las métricas que se basan en los indicadores de rendimiento.",
+ "text": "Recopilar datos de rendimiento. Siga las prácticas recomendadas de Excelencia operativa para supervisar e implementar las extensiones adecuadas para ver las métricas que se sitúan en función de los indicadores de rendimiento.",
"type": "checklist",
"waf": "rendimiento"
},
@@ -5278,15 +5126,15 @@
"description": "",
"guid": "39acd43b-a405-439b-83c9-b9d79d9cdba6",
"service": "Virtual Machines",
- "text": "Grupos de ubicación por proximidad. Use grupos de ubicación por proximidad en cargas de trabajo en las que se requiera una latencia baja para asegurarse de que las máquinas virtuales estén ubicadas físicamente cerca unas de otras.",
+ "text": "Grupos de ubicación por proximidad. Use grupos de ubicación por proximidad en cargas de trabajo en las que se requiera una latencia baja para garantizar que las máquinas virtuales se encuentren físicamente cerca unas de otras.",
"type": "checklist",
"waf": "rendimiento"
},
{
- "description": "El tamaño correcto de las máquinas virtuales es una decisión fundamental que afecta significativamente al rendimiento de la carga de trabajo. Sin el conjunto adecuado de máquinas virtuales, es posible que experimente problemas de rendimiento y acumule costos innecesarios.",
+ "description": "El redimensionamiento de las máquinas virtuales es una decisión fundamental que afecta significativamente al rendimiento de la carga de trabajo. Sin el conjunto adecuado de máquinas virtuales, es posible que experimente problemas de rendimiento y acumule costos innecesarios.",
"guid": "67cc04db-4b74-40f4-9bf6-0ba5f758b45e",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Elija SKU para máquinas virtuales que se alineen con su planificación de capacidad. Comprenda bien los requisitos de su carga de trabajo, incluido el número de núcleos, la memoria, el almacenamiento y el ancho de banda de red para que pueda filtrar las SKU inadecuadas.",
+ "text": "(VMs, conjunto de escalado) Elija SKU para máquinas virtuales que se alineen con su planificación de capacidad. Comprenda bien los requisitos de la carga de trabajo, incluido el número de núcleos, la memoria, el almacenamiento y el ancho de banda de red para poder filtrar las SKU inadecuadas.",
"type": "recommendation",
"waf": "Rendimiento"
},
@@ -5294,20 +5142,20 @@
"description": "Los grupos de selección de ubicación por proximidad reducen la distancia física entre los recursos de proceso de Azure, lo que puede mejorar el rendimiento y reducir la latencia de red entre máquinas virtuales independientes, máquinas virtuales de varios conjuntos de disponibilidad o máquinas virtuales de varios conjuntos de escalado.",
"guid": "ef3de2ad-d5b6-4931-9fc7-28249d9300c0",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Implemente máquinas virtuales de carga de trabajo sensibles a la latencia en grupos con ubicación de proximidad.",
+ "text": "(VMs, conjunto de escalado) Implemente máquinas virtuales de carga de trabajo sensibles a la latencia en grupos de selección de ubicación por proximidad.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Las SSD prémium ofrecen máquinas virtuales compatibles con discos de alto rendimiento y baja latencia con cargas de trabajo intensivas en E/S. SSD prémium v2 no requiere cambiar el tamaño del disco, lo que permite un alto rendimiento sin un sobreaprovisionamiento excesivo y minimiza el costo de la capacidad no utilizada. Cuando están disponibles en SKU de máquina virtual, NVMe conectado localmente o dispositivos similares pueden ofrecer un alto rendimiento, especialmente para casos de uso que requieren altas operaciones de entrada/salida por segundo (IOPS) y baja latencia.",
+ "description": "Las SSD prémium ofrecen máquinas virtuales compatibles con discos de alto rendimiento y baja latencia con cargas de trabajo intensivas de E/S. Premium SSD v2 no requiere cambiar el tamaño del disco, lo que permite un alto rendimiento sin un sobreaprovisionamiento excesivo y minimiza el costo de la capacidad no utilizada. Cuando están disponibles en SKU de máquina virtual, NVMe conectado localmente o dispositivos similares pueden ofrecer un alto rendimiento, especialmente para casos de uso que requieren operaciones de entrada/salida por segundo (IOPS) altas y baja latencia.",
"guid": "a91aae92-2b2c-4c88-b268-2c70b995a952",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca el perfil de almacenamiento analizando el rendimiento del disco de las cargas de trabajo existentes y la SKU de la máquina virtual. Use SSD prémium para máquinas virtuales de producción. Ajuste el rendimiento de los discos con SSD prémium v2. Utilice dispositivos NVMe conectados localmente.",
+ "text": "(VMs, conjunto de escalado) Establezca el perfil de almacenamiento analizando el rendimiento del disco de las cargas de trabajo existentes y la SKU de la máquina virtual. Use SSD prémium para las máquinas virtuales de producción. Ajuste el rendimiento de los discos con SSD prémium v2. Utilice dispositivos NVMe conectados localmente.",
"type": "recommendation",
"waf": "Rendimiento"
},
{
- "description": "Permite la virtualización de E/S de raíz única (SR-IOV) en una máquina virtual, lo que mejora en gran medida su rendimiento de red.",
+ "description": "Permite la virtualización de E/S de raíz única (SR-IOV) en una máquina virtual, lo que mejora en gran medida el rendimiento de su red.",
"guid": "57e446da-1b2e-4bdc-abc9-3e978a11e940",
"service": "Virtual Machines",
"text": "(Máquinas virtuales) Considere la posibilidad de habilitar redes aceleradas.",
@@ -5315,10 +5163,10 @@
"waf": "Rendimiento"
},
{
- "description": "Si aumenta la demanda de la aplicación, aumenta la carga de las instancias de máquina virtual del conjunto de escalado. Las reglas de escalado automático garantizan que tenga suficientes recursos para satisfacer la demanda.",
+ "description": "Si aumenta la demanda de la aplicación, aumenta la carga en las instancias de máquina virtual del conjunto de escalado. Las reglas de escalado automático garantizan que tenga suficientes recursos para satisfacer la demanda.",
"guid": "785858b0-2f0b-476d-9f1e-af92b57314c9",
"service": "Virtual Machines",
- "text": "(VM, conjunto de escalado) Establezca reglas de escalado automático para aumentar o disminuir el número de instancias de VM en el conjunto de escalado en función de la demanda.",
+ "text": "(VMs, conjunto de escalado) Establezca reglas de escalado automático para aumentar o disminuir el número de instancias de máquina virtual del conjunto de escalado en función de la demanda.",
"type": "recommendation",
"waf": "Rendimiento"
}
@@ -5326,7 +5174,7 @@
"metadata": {
"name": "WAF Service Guides",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -5353,31 +5201,31 @@
],
"waf": [
{
- "name": "Rendimiento"
+ "name": "fiabilidad"
},
{
- "name": "seguridad"
+ "name": "Costar"
},
{
- "name": "rendimiento"
+ "name": "Operaciones"
},
{
- "name": "Costar"
+ "name": "seguridad"
},
{
- "name": "Fiabilidad"
+ "name": "Rendimiento"
},
{
- "name": "Operaciones"
+ "name": "Fiabilidad"
},
{
"name": "Operaciones"
},
{
- "name": "fiabilidad"
+ "name": "Seguridad"
},
{
- "name": "Seguridad"
+ "name": "rendimiento"
},
{
"name": "costar"
diff --git a/checklists-ext/wafsg_checklist.ja.json b/checklists-ext/wafsg_checklist.ja.json
index d8e523d98..c91534485 100644
--- a/checklists-ext/wafsg_checklist.ja.json
+++ b/checklists-ext/wafsg_checklist.ja.json
@@ -476,489 +476,337 @@
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "Azure Application Gateway",
- "text": "インスタンスをゾーン対応構成でデプロイします (使用可能な場合)。",
+ "text": "ワークロードが特に Application Gateway v1 を必要とする場合を除き、新しいデプロイでは Application Gateway v2 を使用します。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "Azure Application Gateway",
- "text": "仮想ネットワーク内で Application Gateway と Web Application Firewall (WAF) を使用して、インターネットからの受信 'HTTP/S' トラフィックを保護します。",
+ "text": "設計に冗長性を構築します。Application Gateway インスタンスを可用性ゾーン全体に分散して、フォールト トレランスを向上させ、冗長性を構築します。1 つのゾーンに障害が発生すると、トラフィックは他のゾーンに送られます。詳細については、「可用性ゾーンとリージョンの使用に関する推奨事項」を参照してください。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "Azure Application Gateway",
- "text": "新しいデプロイでは、Azure Application Gateway v1 を使用するやむを得ない理由がない限り、Azure Application Gateway v2 を使用します。",
+ "text": "Application Gateway にアクセスしたり、さらに変更を加えたりする前に、ルールの更新やその他の構成変更のための追加の時間を計画してください。たとえば、既存の接続をドレインする必要があるため、バックエンド プールからサーバーを削除するために余分な時間が必要になる場合があります。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "Azure Application Gateway",
- "text": "ルールの更新を計画する",
+ "text": "ヘルスエンドポイントモニタリングパターンを実装します。アプリケーションでは、アプリケーションが要求を処理するために必要な重要なサービスと依存関係の状態を集約する正常性エンドポイントを公開する必要があります。Application Gateway の正常性プローブは、エンドポイントを使用して、バックエンド プール内のサーバーの正常性を検出します。詳細については、「 正常性エンドポイント監視パターン」を参照してください。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "Azure Application Gateway",
- "text": "正常性プローブを使用してバックエンドの可用性の低さを検出する",
+ "text": "間隔としきい値の設定が正常性プローブに与える影響を評価します。正常性プローブは、設定された間隔で構成されたエンドポイントに要求を送信します。また、バックエンドは、異常としてマークされる前に、限られた数の失敗した要求を許容します。これらの設定は競合する可能性があり、トレードオフが発生します。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "Azure Application Gateway",
- "text": "正常性プローブに対する間隔としきい値の設定の影響を確認します",
+ "text": "正常性エンドポイントを通じてダウンストリームの依存関係を確認します。障害を特定するために、各バックエンドに独自の依存関係がある場合があります。たとえば、Application Gateway の背後でホストするアプリケーションには複数のバックエンドがあり、各バックエンドが異なるデータベース (レプリカ) に接続する場合があります。このような依存関係が失敗すると、アプリケーションは動作する可能性がありますが、有効な結果は返されません。そのため、正常性エンドポイントは、理想的にはすべての依存関係を検証する必要があります。",
"type": "checklist",
"waf": "確実"
},
{
"description": "",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "Azure Application Gateway",
- "text": "正常性エンドポイントによるダウンストリームの依存関係の確認",
+ "text": "Application Gateway の制限事項と、信頼性に影響を与える可能性のある既知の問題を考慮してください。Application Gateway の FAQ で、設計上の動作、作成中の修正プログラム、プラットフォームの制限、および可能な回避策や軽減戦略に関する重要な情報を確認してください。Application Gateway 専用サブネットで UDR を使用しないでください。",
"type": "checklist",
"waf": "確実"
},
{
- "description": "Application Gateway にアクセスしたり、さらに変更を加えたりする前に、更新のための十分な時間を計画してください。たとえば、バックエンド プールからサーバーを削除すると、既存の接続をドレインする必要があるため、時間がかかる場合があります。",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "Azure Application Gateway",
- "text": "ルールの更新を計画する",
- "type": "recommendation",
+ "text": "Application Gateway のバックエンド接続に影響を与える可能性のあるソース・ネットワーク・アドレス変換 (SNAT) ポートの制限を設計で考慮してください。Application Gateway が SNAT ポートの制限に達する方法には、いくつかの要因が影響します。たとえば、バックエンドがパブリック IP アドレスの場合、独自の SNAT ポートが必要です。SNAT ポートの制限を回避するには、次のいずれかのオプションを実行できます。",
+ "type": "checklist",
"waf": "確実"
},
{
- "description": "Application Gateway を使用して複数のバックエンド インスタンスで受信トラフィックの負荷を分散する場合は、正常性プローブを使用することをお勧めします。これにより、トラフィックを処理できないバックエンドにトラフィックがルーティングされなくなります。",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "複数のインスタンスを複数のゾーンに分散すると、ワークロードは 1 つのゾーンでの障害に耐えることができます。使用できないゾーンがある場合、トラフィックは他のゾーンの正常なインスタンスに自動的に移行されるため、アプリケーションの信頼性が維持されます。",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "Azure Application Gateway",
- "text": "正常性プローブを使用してバックエンドの可用性の低さを検出する",
+ "text": "Application Gateway インスタンスをゾーン対応構成でデプロイします。 ゾーン冗長のリージョン サポートを確認してください (すべてのリージョンでこの機能が提供されているわけではありません)。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "正常性プローブは、設定された間隔で構成されたエンドポイントに要求を送信します。また、バックエンドが異常とマークされる前に許容される失敗した要求のしきい値があります。これらの数値はトレードオフを示しています。- 間隔を長く設定すると、サービスに高い負荷がかかります。各 Application Gateway インスタンスは独自の正常性プローブを送信するため、30 秒ごとに 100 インスタンスは 30 秒あたり 100 要求を意味します。- 間隔を短く設定すると、停止が検出されるまでの時間が長くなります。- 異常なしきい値を低く設定すると、短時間の一時的な障害によってバックエンドがダウンする可能性があります。- しきい値を高く設定すると、バックエンドをローテーションから外すのに時間がかかる場合があります。",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "正常性プローブは、トラフィックを処理できるバックエンドにのみトラフィックがルーティングされるようにします。Application Gateway は、バックエンド プール内のすべてのサーバーの正常性を監視し、異常と見なされたサーバーへのトラフィックの送信を自動的に停止します。",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "Azure Application Gateway",
- "text": "正常性プローブに対する間隔としきい値の設定の影響を確認します",
+ "text": "Application Gateway の正常性プローブを使用して、バックエンドの使用不可を検出します。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "各バックエンドに独自の依存関係があり、障害が分離されているとします。たとえば、Application Gateway の背後でホストされているアプリケーションには、複数のバックエンドがあり、それぞれが異なるデータベース (レプリカ) に接続されている場合があります。このような依存関係が失敗すると、アプリケーションは動作している可能性がありますが、有効な結果は返されません。そのため、正常性エンドポイントは、理想的にはすべての依存関係を検証する必要があります。正常性エンドポイントへの各呼び出しに直接依存関係の呼び出しがある場合、そのデータベースは 1 回ではなく 30 秒ごとに 100 回のクエリを受け取ることに注意してください。これを回避するには、正常性エンドポイントで依存関係の状態を短時間キャッシュする必要があります。",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "レート制限を使用して、再試行ストームなどの問題を回避します。",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "Azure Application Gateway",
- "text": "正常性エンドポイントによるダウンストリームの依存関係の確認",
+ "text": "Azure WAF のレート制限ルールを構成して、クライアントがアプリケーションに大量のトラフィックを送信できないようにします。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "特定のシナリオでは、Application Gateway にルールを実装することを余儀なくされる場合があります。たとえば、ModSec CRS 2.2.9、CRS 3.0、または CRS 3.1 のルールが必要な場合、これらのルールは Application Gateway にのみ実装できます。逆に、レート制限と geo フィルタリングは Azure Front Door でのみ使用でき、AppGateway では使用できません。",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "Application Gateway サブネット上の UDR は、いくつかの問題を引き起こす可能性があります。バックエンドの正常性、ログ、メトリックを表示できるように、Application Gateway サブネットで UDR を使用しないでください。",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "Azure Application Gateway",
- "text": "Azure Front Door と Application Gateway を使用して \"HTTP/S\" アプリケーションを保護する場合は、Front Door で WAF ポリシーを使用し、Azure Front Door からのトラフィックのみを受信するように Application Gateway をロックダウンします。",
+ "text": "バックエンドの正常性レポートが適切に機能し、正しいログとメトリックを生成するように、Application Gateway で UDR を使用しないでください。 Application Gateway サブネットで UDR を使用する必要がある場合は、「サポートされている UDR」を参照してください。",
"type": "recommendation",
"waf": "確実"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "バックエンドと一致するように IdleTimeout を設定します。この設定により、バックエンドが要求に応答するのに 4 分以上かかる場合でも、Application Gateway とクライアント間の接続が開いたままになります。この設定を構成しない場合、接続は閉じられ、クライアントにはバックエンドの応答が表示されません。",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "Azure Application Gateway",
- "text": "セキュリティを強化するための TLS ポリシーの設定",
- "type": "checklist",
- "waf": "安全"
+ "text": "バックエンド・アプリケーションのリスナーおよびトラフィック特性に一致するように IdleTimeout 設定を構成します。デフォルト値は 4 分です。最大 30 分に設定できます。 詳細については、「ロード バランサーの伝送制御プロトコル (TCP) のリセットとアイドル タイムアウト」を参照してください。",
+ "type": "recommendation",
+ "waf": "確実"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "Azure Application Gateway",
- "text": "AppGateway を TLS ターミネーションに使用する",
+ "text": "Application Gateway のセキュリティ ベースラインを確認します。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "Azure Application Gateway",
- "text": "Azure Key Vault を使用して TLS 証明書を格納する",
+ "text": "エッジで一般的な脅威をブロックします。WAF は Application Gateway と統合されます。フロントエンドでWAFルールを有効にして、攻撃元に近いネットワークエッジで一般的なエクスプロイトや脆弱性からアプリケーションを保護します。詳細については、「Application Gateway の WAF」を参照してください。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "Azure Application Gateway",
- "text": "バックエンド トラフィックを再暗号化する場合は、バックエンド サーバー証明書にルート認証局 (CA) と中間認証局 (CA) の両方が含まれていることを確認します",
+ "text": "コントロールプレーンへの許可されたアクセスのみを許可します。Application Gateway のロールベースのアクセス制御 (RBAC) を使用して、必要な ID のみにアクセスを制限します。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "Azure Application Gateway",
- "text": "バックエンド プール リソースに適切な DNS サーバーを使用する",
+ "text": "転送中のデータを保護します。エンドツーエンドのトランスポート層セキュリティ (TLS)、TLS 終端、およびエンドツーエンドの TLS 暗号化を有効にします。バックエンド トラフィックを再暗号化する場合は、バックエンド サーバー証明書にルート認証局 (CA) と中間認証局 (CA) の両方が含まれていることを確認してください。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "Azure Application Gateway",
- "text": "Application Gateway のすべての NSG 制限に準拠する",
+ "text": "アプリケーションのシークレットを保護します。Azure Key Vault を使用して TLS 証明書を格納すると、セキュリティが強化され、証明書の更新とローテーションのプロセスが容易になります。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "Azure Application Gateway",
- "text": "Application Gateway サブネットでの UDR の使用を控える",
+ "text": "攻撃対象領域を縮小し、構成を強化します。不要な既定の構成を削除し、Application Gateway の構成を強化してセキュリティ制御を強化します。Application Gateway のすべてのネットワーク セキュリティ グループ (NSG) の制限に準拠します。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "Azure Application Gateway",
- "text": "WAF を有効にするときは、Application Gateway の容量の変更に注意してください",
+ "text": "異常なアクティビティを監視します。ログを定期的に確認して、攻撃や誤検知がないか確認します。Application Gateway から WAF ログを組織の一元化されたセキュリティ情報およびイベント管理 (SIEM) (Microsoft Sentinel など) に送信して、脅威のパターンを検出し、ワークロードの設計に予防策を組み込みます。",
"type": "checklist",
"waf": "安全"
},
{
- "description": "セキュリティを強化するために TLS ポリシーを設定します。常に利用可能な最新の TLS ポリシーバージョンを使用していることを確認してください。これにより、TLS 1.2 以上の暗号が適用されます。",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "Azure Application Gateway",
- "text": "セキュリティを強化するための TLS ポリシーの設定",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "TLS 終了に Application Gateway を使用することには、次のような利点があります。- 異なるバックエンドに送信される要求が各バックエンドに対して再認証を必要とするため、パフォーマンスが向上します。- TLS 処理を実行する必要がないため、バックエンド サーバーの使用率が向上します。- 要求コンテンツへのアクセスによるインテリジェントなルーティング - 証明書を Application Gateway にインストールするだけで済むため、証明書の管理が容易になります。",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
- "service": "Azure Application Gateway",
- "text": "AppGateway を TLS ターミネーションに使用する",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "Application Gateway は Key Vault と統合できます。これにより、セキュリティが強化され、役割と責任の分離が容易になり、管理された証明書のサポート、証明書の更新とローテーションのプロセスが容易になります。",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
- "service": "Azure Application Gateway",
- "text": "Azure Key Vault を使用して TLS 証明書を格納する",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "バックエンド サーバーの TLS 証明書は、既知の CA によって発行される必要があります。証明書が信頼された CA によって発行されていない場合、Application Gateway は、信頼された CA 証明書が見つかるまで、証明書が信頼された CA によって発行されたかどうかなどを確認します。その後、安全な接続が確立されます。それ以外の場合、Application Gateway はバックエンドを異常としてマークします。",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
- "service": "Azure Application Gateway",
- "text": "バックエンド トラフィックを再暗号化する場合は、バックエンド サーバー証明書にルート認証局 (CA) と中間認証局 (CA) の両方が含まれていることを確認します",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "バックエンド プールに解決可能な FQDN が含まれている場合、DNS 解決はプライベート DNS ゾーンまたはカスタム DNS サーバー (VNet で構成されている場合) に基づいているか、Azure が提供する既定の DNS を使用します。",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "最新の TLS ポリシーを使用して、TLS 1.2 以上の暗号の使用を強制します。TLS ポリシーには、TLS プロトコルのバージョンと暗号スイートの制御、および TLS ハンドシェイクで暗号を使用する順序の制御が含まれます。",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "Azure Application Gateway",
- "text": "バックエンド プール リソースに適切な DNS サーバーを使用する",
+ "text": "セキュリティを強化するために TLS ポリシーを設定します。最新の TLS ポリシーバージョンを使用していることを確認してください。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "NSG は Application Gateway サブネットでサポートされていますが、いくつかの制限があります。たとえば、特定のポート範囲との一部の通信は禁止されています。これらの制限の影響を理解していることを確認してください。詳細については、「ネットワーク セキュリティ グループ」を参照してください。",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "description": "異なるバックエンドに送信される要求が各バックエンドに対して再認証する必要がないため、パフォーマンスが向上します。ゲートウェイは、要求コンテンツにアクセスし、インテリジェントなルーティング決定を行うことができます。Application Gateway に証明書をインストールするだけで、証明書の管理が簡単になります。",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "Azure Application Gateway",
- "text": "Application Gateway のすべての NSG 制限に準拠する",
+ "text": "TLS 終了には Application Gateway を使用します。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "Application Gateway サブネットでユーザー定義ルート (UDR) を使用すると、いくつかの問題が発生する可能性があります。バックエンドの正常性状態が不明な場合があります。Application Gateway のログとメトリックが生成されない場合があります。バックエンドの正常性、ログ、メトリックを表示できるように、Application Gateway サブネットで UDR を使用しないことをお勧めします。組織で Application Gateway サブネットで UDR を使用する必要がある場合は、サポートされているシナリオを確認してください。詳細については、「サポートされているユーザー定義ルート」を参照してください。",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
+ "description": "このアプローチにより、セキュリティが強化され、役割と責任の分離が容易になり、管理された証明書のサポートが実現し、証明書の更新とローテーションのプロセスが容易になります。",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "Azure Application Gateway",
- "text": "Application Gateway サブネットで UDR を使用しないようにする",
+ "text": "Application Gateway を Key Vault と統合して、TLS 証明書を格納します。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "WAF が有効になっている場合、すべての要求は、完全に到着するまで Application Gateway によってバッファーに格納され、要求がコア ルール セットのルール違反と一致するかどうかを確認してから、パケットをバックエンド インスタンスに転送する必要があります。大きなファイル(サイズが30MB+)のアップロードがある場合、大幅な遅延が発生する可能性があります。Application Gateway の容量要件は WAF によって異なるため、適切なテストと検証を行わずに Application Gateway で WAF を有効にすることはお勧めしません。",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "description": "Application Gateway サブネットは NSG をサポートしていますが、いくつかの制限があります。たとえば、特定のポート範囲との一部の通信は禁止されています。これらの制限の影響を理解していることを確認してください。",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "Azure Application Gateway",
- "text": "WAF を有効にするときは、Application Gateway の容量の変更に注意してください",
+ "text": "Application Gateway のすべての NSG 制限に準拠します。",
"type": "recommendation",
"waf": "安全"
},
{
"description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Application Gateway の価格について理解する",
- "type": "checklist",
- "waf": "費用"
- },
- {
- "description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "Azure Application Gateway",
- "text": "十分に活用されていないリソースを確認する",
+ "text": "Application Gateway と WAF の価格について理解しておいてください。ワークロード容量の需要を満たし、リソースを無駄にすることなく期待されるパフォーマンスを提供できるように、適切なサイズのオプションを選択してください。コストを見積もるには、料金計算ツールを使用します。",
"type": "checklist",
"waf": "費用"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "Azure Application Gateway",
- "text": "使用されていない Application Gateway インスタンスの停止",
+ "text": "未使用の Application Gateway インスタンスを削除し、使用率の低いインスタンスを最適化します。不要なコストを回避するには、空のバックエンド プールを持つ Application Gateway インスタンスを特定して削除します。Application Gateway インスタンスは、使用されていないときに停止します。",
"type": "checklist",
"waf": "費用"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "Azure Application Gateway",
- "text": "スケールインとスケールアウトのポリシーがある",
+ "text": "Application Gateway インスタンスのスケーリング コストを最適化します。スケーリング戦略を最適化し、wokload の要求を減らすには、スケーリングコストの最適化に関する推奨事項を参照してください。",
"type": "checklist",
"waf": "費用"
},
{
"description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "Azure Application Gateway",
- "text": "さまざまなパラメーターにわたる消費メトリックを確認する",
+ "text": "Application Gateway の消費メトリックを監視し、そのコストへの影響を理解します。Azure は、追跡されたメトリックに基づいて、Application Gateway の従量制課金インスタンスに対して課金されます。さまざまなメトリクスとキャパシティーユニットを評価し、コストドライバーを決定します。詳細については、「Microsoft Cost Management」を参照してください。",
"type": "checklist",
"waf": "費用"
},
{
- "description": "Application Gateway の価格については、「Azure Application Gateway と Web Application Firewall の価格について」を参照してください。また、料金計算ツールを活用することもできます。オプションが容量の需要を満たすために適切なサイズに設定され、リソースを無駄にすることなく期待されるパフォーマンスを提供することを確認します。",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Application Gateway の価格について理解する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "不要なコストを回避するために、空のバックエンド プールを持つ Application Gateway インスタンスを特定して削除します。",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "Azure Application Gateway",
- "text": "十分に活用されていないリソースを確認する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "Application Gateway が停止状態の場合、課金されません。Application Gateway インスタンスを継続的に実行すると、余分なコストが発生する可能性があります。使用パターンを評価し、不要なインスタンスを停止します。たとえば、Dev/Test 環境での営業時間後の使用量は低いと予想されます。インスタンスを停止および開始する方法については、次の記事を参照してください。",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "Azure Application Gateway",
- "text": "使用していないときに Application Gateway インスタンスを停止する",
- "type": "recommendation",
- "waf": "費用"
- },
- {
- "description": "スケールアウトポリシーにより、受信トラフィックとスパイクを処理するのに十分なインスタンスが確保されます。また、需要が減少したときにインスタンスの数が減るようにするスケールインポリシーがあります。インスタンスサイズの選択を検討してください。サイズはコストに大きな影響を与える可能性があります。いくつかの考慮事項については、「Application Gateway インスタンス数の見積もり」で説明されています。詳細については、「Azure Application Gateway v2 とは」を参照してください。",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "description": "停止した Application Gateway インスタンスにはコストは発生しません。継続的に実行される Application Gateway インスタンスでは、不要なコストが発生する可能性があります。使用パターンを評価し、不要な場合はインスタンスを停止します。たとえば、開発/テスト環境では、営業時間後の使用量が少なくなることが予想されます。",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "Azure Application Gateway",
- "text": "スケールインとスケールアウトのポリシーがある",
+ "text": "Application Gateway インスタンスは、使用されていないときに停止します。詳細については、「Stop-AzApplicationGateway」と「Start-AzApplicationGateway」を参照してください。",
"type": "recommendation",
"waf": "費用"
},
{
- "description": "Azure によって追跡されるメトリックに基づく Application Gateway の従量制課金インスタンスに基づいて課金されます。さまざまなメトリクスとキャパシティーユニットを評価し、コストドライバーを決定します。詳細については、「Microsoft Cost Management and Billing」を参照してください。次のメトリックは、Application Gateway のキーです。この情報は、プロビジョニングされたインスタンス数が受信トラフィックの量と一致することを検証するために使用できます。- 推定請求キャパシティ ユニット- 固定請求可能キャパシティ ユニット- 現在のキャパシティ ユニット詳細については、「Application Gateway メトリック」を参照してください。帯域幅のコストを考慮してください。",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "これらのメトリクスを使用して、プロビジョニングされたインスタンス数が受信トラフィックの量と一致するかどうかを検証し、割り当てられたリソースを完全に活用していることを確認します。",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "Azure Application Gateway",
- "text": "さまざまなパラメーターにわたる消費メトリックを確認する",
+ "text": "主要なコスト ドライバーである Application Gateway のメトリックを監視します: - 請求される容量ユニットの見積もり。 - 固定請求可能な容量ユニット。- 現在の容量ユニット。 帯域幅のコストを考慮してください。",
"type": "recommendation",
"waf": "費用"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "容量メトリックの監視",
- "type": "checklist",
- "waf": "オペレーションズ"
- },
- {
- "description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Application Gateway と Web アプリケーション ファイアウォール (WAF) で診断を有効にする",
- "type": "checklist",
- "waf": "オペレーションズ"
- },
- {
- "description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights を使用する",
+ "text": "Application Gateway と WAF で診断を有効にします。ログとメトリクスを収集して、ワークロードの正常性をモニタリングし、ワークロードのパフォーマンスと信頼性の傾向を特定し、問題のトラブルシューティングを行うことができます。全体的な監視アプローチを設計するには、監視システムの設計と作成に関する推奨事項を参照してください。",
"type": "checklist",
"waf": "オペレーションズ"
},
{
"description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "Azure Application Gateway",
- "text": "タイムアウト設定をバックエンドアプリケーションと一致させる",
+ "text": "Azure Monitor Network Insights を使用して、Application Gateway などのネットワーク リソースの正常性とメトリックを包括的に表示します。一元化された監視を使用して、問題を迅速に特定して解決し、パフォーマンスを最適化し、アプリケーションの信頼性を確保します。",
"type": "checklist",
"waf": "オペレーションズ"
},
{
"description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "Azure Application Gateway",
- "text": "Azure Advisor を使用して Key Vault の構成の問題を監視する",
+ "text": "Azure Advisor で Application Gateway の推奨事項を監視します。アラートを構成して、Application Gateway インスタンスに関する新しい重要な推奨事項がある場合にチームに通知します。Advisor は、カテゴリ、影響レベル、推奨タイプなどのプロパティに基づいて推奨を生成します。",
"type": "checklist",
"waf": "オペレーションズ"
},
{
- "description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
+ "description": "メトリックがしきい値を超えたときにアラートを設定して、使用量が増加したときに把握できるようにします。このアプローチにより、ワークロードに必要な変更を実装するのに十分な時間を確保し、パフォーマンスの低下や停止を防ぐことができます。",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "Azure Application Gateway",
- "text": "SNAT ポートの制限を構成および監視する",
- "type": "checklist",
- "waf": "オペレーションズ"
- },
- {
- "description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
- "service": "Azure Application Gateway",
- "text": "設計では SNAT ポートの制限を考慮してください",
- "type": "checklist",
- "waf": "オペレーションズ"
- },
- {
- "description": "これらのメトリックは、プロビジョニングされた Application Gateway 容量の使用率の指標として使用します。容量に関するアラートを設定することを強くお勧めします。詳細については、「Application Gateway の高トラフィックのサポート」を参照してください。",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "容量メトリックの監視",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "Application Gateway またはバックエンドの問題を示す可能性のあるメトリックは他にもあります。次のアラートを評価することをお勧めします:- 異常なホスト数- 応答状態 (ディメンション 4xx と 5xx)- バックエンド応答状態 (ディメンション 4xx と 5xx)- バックエンドの最終バイト応答時間 - Application Gateway 合計時間詳細については、「Application Gateway のメトリック」を参照してください。",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "Azure Application Gateway",
- "text": "メトリクスを使用したトラブルシューティング",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "診断ログを使用すると、ファイアウォール ログ、パフォーマンス ログ、およびアクセス ログを表示できます。これらのログを使用して、Application Gateway インスタンスの問題を管理およびトラブルシューティングします。詳細については、「Application Gateway のバックエンドの正常性ログと診断ログ」を参照してください。",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Application Gateway と Web アプリケーション ファイアウォール (WAF) で診断を有効にする",
- "type": "recommendation",
- "waf": "オペレーションズ"
- },
- {
- "description": "Azure Monitor Network Insights は、Application Gateway を含むネットワーク リソースの正常性とメトリックの包括的なビューを提供します。Application Gateway の詳細とサポートされている機能については、「Azure Monitor ネットワーク分析情報」を参照してください。",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
- "service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights を使用する",
+ "text": "CPU 使用率やコンピューティング ユニットの使用量などの容量メトリックが推奨されるしきい値を超えたときにチームに通知するアラートを構成します。 容量メトリックに基づいてアラートの包括的なセットを構成するには、「Application Gateway の高トラフィックのサポート」を参照してください。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "バックエンド・アプリケーションのリスナーおよびトラフィック特性と一致するようにIdleTimeout設定が構成されていることを確認します。デフォルト値は 4 分に設定され、最大 30 に設定できます。詳細については、Load Balancer の TCP リセットとアイドル・タイムアウトを参照してください。ワークロードに関する考慮事項については、信頼性のためのアプリケーション・ヘルスのモニタリングを参照してください。",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "アラートを使用すると、チームが問題にタイムリーに対応し、トラブルシューティングを容易に行うことができます。",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "Azure Application Gateway",
- "text": "タイムアウト設定をバックエンドアプリケーションと一致させる",
+ "text": "アラートを構成して、Application Gateway またはバックエンドの問題を示すメトリックについてチームに通知します。- 異常なホスト数 - 応答状態 (4xx エラーや 5xx エラーなど) - バックエンド応答状態 (4xx エラーや 5xx エラーなど) - バックエンドの最終バイト応答時間 - Application Gateway の合計時間詳細については、「Application Gateway のメトリック」を参照してください。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "Application Gateway は、リンクされた Key Vault で更新された証明書のバージョンを 4 時間間隔で確認します。Key Vault の構成が正しくないためにアクセスできない場合は、そのエラーをログに記録し、対応する Advisor の推奨事項をプッシュします。Advisor アラートは、常に最新の状態を維持し、このような問題をすぐに修正するように構成して、コントロールプレーンまたはデータプレーン関連の問題を回避する必要があります。詳細については、「キー コンテナーのエラーの調査と解決」を参照してください。この特定のケースのアラートを設定するには、Application Gateway の [推奨事項の種類] を [Azure Key Vault の問題を解決する] として使用します。",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "description": "ログを使用して、Application Gateway インスタンスとワークロードの問題を検出、調査、トラブルシューティングします。",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "Azure Application Gateway",
- "text": "Azure Advisor を使用して Key Vault の構成の問題を監視する",
+ "text": "Application Gateway と WAF で診断ログを有効にして、ファイアウォール ログ、パフォーマンス ログ、アクセス ログを収集します。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
- "description": "SNAT ポートの制限は、Application Gateway でのバックエンド接続にとって重要です。Application Gateway が SNAT ポートの制限に達する方法に影響を与える要因は別々です。たとえば、バックエンドがパブリック IP アドレスの場合、独自の SNAT ポートが必要になります。SNAT ポートの制限を回避するために、Application Gateway あたりのインスタンス数を増やすか、バックエンドをスケールアウトしてより多くの IP アドレスを持つようにするか、バックエンドを同じ仮想ネットワークに移動してバックエンドにプライベート IP アドレスを使用できます。Application Gateway の 1 秒あたりの要求数 (RPS) は、SNAT ポートの制限に達した場合に影響を受けます。たとえば、Application Gateway が SNAT ポートの制限に達した場合、バックエンドへの新しい接続を開くことができず、要求は失敗します。",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "Advisor アラートを使用して、常に最新の情報を入手し、問題を迅速に修正します。コントロールプレーンまたはデータプレーン関連の問題を防止します。 Application Gateway は、リンクされた Key Vault インスタンス内の更新された証明書のバージョンを 4 時間ごとに確認します。Key Vault の構成が正しくないために証明書のバージョンにアクセスできない場合は、そのエラーをログに記録し、対応する Advisor の推奨事項をプッシュします。",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "Azure Application Gateway",
- "text": "設計では SNAT ポートの制限を考慮してください",
+ "text": "Advisor を使用して、Key Vault の構成の問題を監視します。Application Gateway の Azure Key Vault の問題を解決するという推奨事項を受け取ったときにチームに通知するアラートを設定します。",
"type": "recommendation",
"waf": "オペレーションズ"
},
{
"description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "Azure Application Gateway",
- "text": "Application Gateway インスタンス数を見積もる",
+ "text": "ワークロード要件をサポートするための Application Gateway の容量要件を見積もります。Application Gateway v2 の自動スケール機能を活用します。インスタンスの最小数と最大数に適切な値を設定します。Application Gateway に必要な専用サブネットのサイズを適切に設定します。詳細については、「容量計画の推奨事項」を参照してください。",
"type": "checklist",
"waf": "パフォーマンス"
},
{
"description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "Azure Application Gateway",
- "text": "最大インスタンス数の定義",
+ "text": "自動スケーリングとパフォーマンス上の利点を実現する機能を活用します。v2 SKU は、トラフィックの増加に応じて Application Gateway をスケールアップする自動スケーリングを提供します。v1 SKU と比較すると、v2 SKU にはワークロードのパフォーマンスを向上させる機能があります。たとえば、v2 SKU は、TLS オフロード パフォーマンスが向上し、デプロイと更新の時間が短縮され、ゾーン冗長がサポートされます。詳細については、「Application Gateway v2 と WAF v2 のスケーリング」を参照してください。",
"type": "checklist",
"waf": "パフォーマンス"
},
{
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "最小インスタンス数の定義",
- "type": "checklist",
- "waf": "パフォーマンス"
- },
- {
- "description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "Application Gateway v2 の場合、自動スケールは、追加のインスタンス セットがトラフィックを処理する準備が整うまでに約 6 分から 7 分かかります。その間、Application Gateway のトラフィックの急増が短い場合は、一時的な待機時間またはトラフィックの損失が予想されます。",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "Azure Application Gateway",
- "text": "Application Gateway サブネット サイズを定義する",
- "type": "checklist",
- "waf": "パフォーマンス"
- },
- {
- "description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
- "service": "Azure Application Gateway",
- "text": "Application Gateway V2 の機能を利用して、自動スケーリングとパフォーマンスの利点を実現",
- "type": "checklist",
- "waf": "パフォーマンス"
- },
- {
- "description": "Application Gateway v2 SKU の場合、自動スケールは、追加のインスタンス セットがトラフィックを処理する準備が整うまでに、ある程度の時間 (約 6 分から 7 分) かかります。その間、トラフィックが急増する場合は、一時的な遅延またはトラフィックの損失が予想されます。最小インスタンス数を最適なレベルに設定することをお勧めします。平均インスタンス数を見積もり、Application Gateway の自動スケールの傾向を決定したら、アプリケーション パターンに基づいて最小インスタンス数を定義します。詳細については、「Application Gateway の高トラフィックのサポート」を参照してください。過去 1 か月の現在のコンピューティング ユニットを確認します。このメトリクスは、ゲートウェイの CPU 使用率を表します。最小インスタンス数を定義するには、ピーク使用量を 10 で割ります。たとえば、過去 1 か月の平均 Current Compute Units が 50 の場合は、最小インスタンス数を 5 に設定します。",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "最小インスタンス数の定義",
- "type": "recommendation",
- "waf": "パフォーマンス"
- },
- {
- "description": "自動スケーリング インスタンスの最大数として 125 をお勧めします。Application Gateway を持つサブネットに、インスタンスのスケールアップ セットをサポートするのに十分な使用可能な IP アドレスがあることを確認します。最大インスタンス数を 125 に設定しても、消費された容量に対してのみ請求されるため、コストへの影響はありません。",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "最大インスタンス数の定義",
+ "text": "最小インスタンス数は、推定インスタンス数、実際の Application Gateway 自動スケールの傾向、およびアプリケーション パターンに基づいて最適なレベルに設定します。 過去 1 か月の現在のコンピューティング ユニットを確認します。このメトリクスは、ゲートウェイの CPU 使用率を表します。最小インスタンス数を定義するには、ピーク使用量を 10 で割ります。たとえば、過去 1 か月の現在の平均コンピューティング ユニットが 50 の場合は、最小インスタンス数を 5 に設定します。",
"type": "recommendation",
"waf": "パフォーマンス"
},
{
- "description": "Application Gateway には、仮想ネットワーク内に専用のサブネットが必要です。サブネットには、デプロイされた Application Gateway リソースの複数のインスタンスを含めることができます。また、そのサブネット (v1 または v2 SKU) に他の Application Gateway リソースをデプロイすることもできます。サブネット サイズの定義に関する考慮事項を次に示します。- Application Gateway は、インスタンスごとに 1 つのプライベート IP アドレスを使用し、プライベート フロントエンド IP が構成されている場合は別のプライベート IP アドレスを使用します。- Azure では、各サブネットに 5 つの IP アドレスが内部使用のために予約されています。- Application Gateway (Standard または WAF SKU) は、最大 32 個のインスタンスをサポートできます。32 個のインスタンス IP アドレス + 1 個のプライベート フロントエンド IP + 5 個の Azure 予約済みの場合、最小サブネット サイズは /26 にすることをお勧めします。Standard_v2 SKU または WAF_v2 SKU は最大 125 個のインスタンスをサポートできるため、同じ計算を使用して、サブネット サイズ /24 をお勧めします。- 同じサブネットに追加の Application Gateway リソースをデプロイする場合は、Standard と Standard v2 の両方の最大インスタンス数に必要な追加の IP アドレスを検討してください。",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "Application Gateway は、アプリケーションへのトラフィックの増加を処理するために、必要に応じてスケールアウトできます。この設定では、消費された容量に対してのみ支払うため、コストは増加しません。",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "Azure Application Gateway",
- "text": "Application Gateway サブネット サイズを定義する",
+ "text": "自動スケーリング インスタンスの最大数を、可能な最大数 (125 インスタンス) に設定します。Application Gateway 専用サブネットに、増加したインスタンスのセットをサポートするのに十分な使用可能な IP アドレスがあることを確認します。",
"type": "recommendation",
"waf": "パフォーマンス"
},
{
- "description": "v2 SKU には、トラフィックの増加に合わせて Application Gateway をスケールアップできるように、自動スケーリングが用意されています。v1 SKU と比較すると、v2 にはワークロードのパフォーマンスを向上させる機能があります。たとえば、TLS オフロード パフォーマンスの向上、デプロイと更新時間の短縮、ゾーン冗長性などです。自動スケール機能の詳細については、「Application Gateway v2 と WAF v2 のスケーリング」を参照してください。v1 SKU Application gateway を実行している場合は、Application gateway v2 SKU への移行を検討してください。詳細については、「Azure Application Gateway と Web アプリケーション ファイアウォールを v1 から v2 に移行する」を参照してください。",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
+ "description": "/24 サブネットを使用して、Application Gateway v2 のデプロイに必要なすべての IP アドレスをサポートします。 Application Gateway では、インスタンスごとに 1 つのプライベート IP アドレスが使用され、プライベート フロントエンド IP を構成する場合は別のプライベート IP アドレスが使用されます。Standard_v2 SKU または WAF_v2 SKU は、最大 125 個のインスタンスをサポートできます。Azure では、内部使用のために各サブネットに 5 つの IP アドレスが予約されています。",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "Azure Application Gateway",
- "text": "自動スケーリングとパフォーマンス上の利点のための機能を活用する",
+ "text": "Application Gateway 専用サブネットのサイズを適切に設定します。Application Gateway v2 のデプロイには /24 サブネットを使用することを強くお勧めします。 同じサブネットに他の Application Gateway リソースをデプロイする場合は、最大インスタンス数に必要な追加の IP アドレスを検討してください。 サブネットのサイズ設定に関するその他の考慮事項については、「Application Gateway インフラストラクチャの構成」を参照してください。",
"type": "recommendation",
"waf": "パフォーマンス"
},
@@ -5326,7 +5174,7 @@
"metadata": {
"name": "WAF Service Guides",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -5353,31 +5201,31 @@
],
"waf": [
{
- "name": "パフォーマンス"
+ "name": "確実"
},
{
- "name": "安全"
+ "name": "費用"
},
{
- "name": "パフォーマンス"
+ "name": "オペレーションズ"
},
{
- "name": "費用"
+ "name": "安全"
},
{
- "name": "確実"
+ "name": "パフォーマンス"
},
{
- "name": "オペレーションズ"
+ "name": "確実"
},
{
"name": "オペレーションズ"
},
{
- "name": "確実"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "パフォーマンス"
},
{
"name": "費用"
diff --git a/checklists-ext/wafsg_checklist.ko.json b/checklists-ext/wafsg_checklist.ko.json
index d847b95a5..50df441f3 100644
--- a/checklists-ext/wafsg_checklist.ko.json
+++ b/checklists-ext/wafsg_checklist.ko.json
@@ -6,7 +6,7 @@
"description": "",
"guid": "a549f1f2-55ec-4094-b8c5-1be6fd4f4d38",
"service": "App Service Web Apps",
- "text": "사용자 흐름의 우선 순위 지정: 모든 흐름이 똑같이 중요한 것은 아닙니다. 각 흐름에 우선 순위를 할당하여 설계 결정을 안내합니다. 사용자 흐름 디자인은 App Service 계획 및 구성에 대해 선택하는 서비스 계층과 인스턴스 수에 영향을 줄 수 있습니다.",
+ "text": "사용자 흐름 우선 순위 지정: 모든 흐름이 똑같이 중요한 것은 아닙니다. 각 흐름에 우선 순위를 할당하여 설계 결정을 안내합니다. 사용자 흐름 디자인은 App Service 계획 및 구성에 대해 선택하는 서비스 계층과 인스턴스 수에 영향을 줄 수 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -14,7 +14,7 @@
"description": "",
"guid": "a67a6739-c1af-48d6-a3d1-001fb5105139",
"service": "App Service Web Apps",
- "text": "잠재적 오류 예측: 잠재적 오류에 대한 완화 전략을 계획합니다. 다음 표에서는 고장 모드 분석의 예를 보여 줍니다.",
+ "text": "잠재적 오류 예측: 잠재적 오류에 대한 완화 전략을 계획합니다. 다음 표에서는 오류 모드 분석의 예를 보여 줍니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -22,7 +22,7 @@
"description": "",
"guid": "b47d664a-75c8-4739-80d8-6cf9f60abb56",
"service": "App Service Web Apps",
- "text": "Build redundancy: 응용 프로그램 및 지원 인프라에서 중복성을 구축합니다. 가용 영역 간에 인스턴스를 분산하여 내결함성을 개선합니다. 한 영역에 장애가 발생하면 트래픽이 다른 영역으로 라우팅됩니다. 여러 지역에 응용 프로그램을 배포하여 전체 지역에서 중단이 발생하더라도 앱을 계속 사용할 수 있도록 합니다.",
+ "text": "Build redundancy: 응용 프로그램 및 지원 인프라에서 중복성을 구축합니다. 여러 가용 영역에 인스턴스를 분산하여 내결함성을 개선합니다. 한 영역에 장애가 발생하면 트래픽이 다른 영역으로 라우팅됩니다. 여러 지역에 응용 프로그램을 배포하여 전체 지역에서 중단이 발생하더라도 앱을 계속 사용할 수 있도록 합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -30,7 +30,7 @@
"description": "",
"guid": "6b8fa1ed-cfa0-4435-9146-b3d1a8edb432",
"service": "App Service Web Apps",
- "text": "신뢰할 수 있는 확장 전략 수립: 응용 프로그램에 예기치 않은 부하가 발생하면 응용 프로그램을 신뢰할 수 없게 만들 수 있습니다. 워크로드 특성에 따라 올바른 확장 방법을 고려합니다. 경우에 따라 부하를 처리하기 위해 확장할 수 있습니다. 그러나 부하가 계속 증가하면 새 인스턴스로 확장합니다. 수동 접근 방식보다 자동 크기 조정을 선호합니다. 성능 저하를 방지하기 위해 크기 조정 작업 중에 항상 추가 용량의 버퍼를 유지 관리합니다.",
+ "text": "신뢰할 수 있는 확장 전략 수립: 응용 프로그램에 예기치 않은 부하가 발생하면 응용 프로그램을 신뢰할 수 없게 만들 수 있습니다. 워크로드 특성에 따라 올바른 크기 조정 방법을 고려합니다. 경우에 따라 부하를 처리하기 위해 확장할 수 있습니다. 그러나 부하가 계속 증가하면 새 인스턴스로 확장합니다. 수동 접근 방식보다 자동 크기 조정을 선호합니다. 성능 저하를 방지하기 위해 크기 조정 작업 중에는 항상 추가 용량의 버퍼를 유지 관리합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -38,7 +38,7 @@
"description": "",
"guid": "ac7f205b-9117-4b49-8f22-9f31528dfdbd",
"service": "App Service Web Apps",
- "text": "복구 가능성 계획: 중복성은 비즈니스 연속성에 매우 중요합니다. 한 인스턴스에 연결할 수 없는 경우 다른 인스턴스로 장애 조치합니다. App Service의 자동 복구 기능(예: 인스턴스 자동 복구)을 살펴봅니다.",
+ "text": "복구 가능성 계획: 중복성은 비즈니스 연속성에 매우 중요합니다. 한 인스턴스에 연결할 수 없는 경우 다른 인스턴스로 장애 조치합니다. App Service의 자동 복구 기능(예: 인스턴스 자동 복구)을 살펴보세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -75,7 +75,7 @@
"waf": "신뢰도"
},
{
- "description": "들어오는 요청은 ARR 선호도를 사용하지 않도록 설정할 때 사용 가능한 모든 노드에 균등하게 분산됩니다. 균등하게 분산된 요청은 트래픽이 단일 노드를 압도하는 것을 방지합니다. 노드를 사용할 수 없는 경우 요청을 다른 정상 노드로 원활하게 리디렉션할 수 있습니다. App Service 인스턴스가 상태 비저장으로 유지되도록 세션 선호도를 피합니다. 상태 비저장 App Service는 복잡성을 줄이고 노드 간에 일관된 동작을 보장합니다. App Service가 수평으로 크기를 조정할 인스턴스를 추가하거나 제거할 수 있도록 고정 세션을 제거합니다.",
+ "description": "들어오는 요청은 ARR 선호도를 사용하지 않도록 설정할 때 사용 가능한 모든 노드에 균등하게 분산됩니다. 요청이 균등하게 분산되면 트래픽이 단일 노드에 과부하되는 것을 방지할 수 있습니다. 노드를 사용할 수 없는 경우 요청을 다른 정상 노드로 원활하게 리디렉션할 수 있습니다. App Service 인스턴스가 상태 비저장 상태로 유지되도록 세션 선호도를 방지합니다. 상태 비저장 App Service는 복잡성을 줄이고 노드 간에 일관된 동작을 보장합니다. App Service가 인스턴스를 추가하거나 제거하여 수평으로 확장할 수 있도록 고정 세션을 제거합니다.",
"guid": "3551bbd4-1f44-4bca-b25c-53e16f79cafe",
"service": "App Service Web Apps",
"text": "(앱 서비스) ARR(애플리케이션 요청 라우팅) 선호도 기능을 사용하지 않도록 설정하는 것이 좋습니다. ARR 선호도는 사용자를 이전 요청을 처리한 노드로 리디렉션하는 고정 세션을 만듭니다.",
@@ -118,7 +118,7 @@
"description": "",
"guid": "469151fd-f51c-43ab-84f7-5d6c01e99fba",
"service": "App Service Web Apps",
- "text": "격리 경계를 통해 위반을 방지하기 위한 세분화 생성: ID 세분화를 적용합니다. 예를 들어 RBAC(역할 기반 액세스 제어)를 구현하여 역할에 따라 특정 권한을 할당합니다. 최소 권한 원칙에 따라 필요한 경우에만 액세스 권한을 제한합니다. 또한 네트워크 수준에서 세그멘테이션을 생성합니다. 격리를 위해 Azure 가상 네트워크에 App Service 앱을 삽입하고 NSG(네트워크 보안 그룹)를 정의하여 트래픽을 필터링합니다.",
+ "text": "격리 경계를 통해 세분화를 만들어 위반 방지: ID 세분화를 적용합니다. 예를 들어 RBAC(역할 기반 액세스 제어)를 구현하여 역할에 따라 특정 권한을 할당합니다. 최소 권한 원칙에 따라 필요한 경우에만 액세스 권한을 제한합니다. 또한 네트워크 수준에서 세그멘테이션을 생성합니다. 격리를 위해 Azure 가상 네트워크에 App Service 앱을 삽입하고 NSG(네트워크 보안 그룹)를 정의하여 트래픽을 필터링합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -134,7 +134,7 @@
"description": "",
"guid": "0ff3e194-df50-4856-b798-7487e5fc4d34",
"service": "App Service Web Apps",
- "text": "응용 프로그램과의 네트워크 트래픽 제어: 응용 프로그램 끝점을 공용 인터넷에 노출하지 마세요. 대신, 전용 서브넷에 배치된 웹앱에 프라이빗 엔드포인트를 추가합니다. 해당 프라이빗 엔드포인트와 통신하는 역방향 프록시를 사용하여 애플리케이션을 전면에 배치합니다. 이를 위해 Application Gateway 또는 Azure Front Door를 사용하는 것이 좋습니다.",
+ "text": "응용 프로그램에서 들어오고 나가는 네트워크 트래픽 제어: 응용 프로그램 끝점을 공용 인터넷에 노출하지 마세요. 대신 전용 서브넷에 배치된 웹앱에 프라이빗 엔드포인트를 추가합니다. 해당 프라이빗 엔드포인트와 통신하는 역방향 프록시를 사용하여 응용 프로그램을 전면에 배치합니다. 이를 위해 Application Gateway 또는 Azure Front Door를 사용하는 것이 좋습니다.",
"type": "checklist",
"waf": "안전"
},
@@ -142,7 +142,7 @@
"description": "",
"guid": "a6fcbd07-0da4-4386-902d-6708c5a5cc23",
"service": "App Service Web Apps",
- "text": "데이터 암호화: 엔드 투 엔드 TLS(전송 계층 보안)를 통해 전송 중인 데이터를 보호합니다. 미사용 데이터의 전체 암호화를 위해 고객 관리형 키를 사용합니다. 자세한 내용은 고객 관리형 키를 사용한 미사용 데이터 암호화를 참조하세요.",
+ "text": "데이터 암호화: 엔드 투 엔드 TLS(전송 계층 보안)를 통해 전송 중인 데이터를 보호합니다. 미사용 데이터의 전체 암호화를 위해 고객 관리형 키를 사용합니다. 자세한 내용은 고객 관리형 키를 사용한 미사용 암호화를 참조하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -166,7 +166,7 @@
"description": "",
"guid": "ae9e2e30-a31e-4459-ae31-fbcb8307016e",
"service": "App Service Web Apps",
- "text": "응용 프로그램에 리소스 로그 사용: 응용 프로그램에 대한 리소스 로그를 사용하도록 설정하여 보안 인시던트 후속 조사 중에 중요한 데이터를 제공하는 포괄적인 활동 추적을 만듭니다.",
+ "text": "응용 프로그램에 대한 리소스 로그 사용: 응용 프로그램에 대한 리소스 로그를 사용하도록 설정하여 보안 인시던트 후속 조사 중에 중요한 데이터를 제공하는 포괄적인 활동 추적을 만듭니다.",
"type": "checklist",
"waf": "안전"
},
@@ -187,7 +187,7 @@
"waf": "안전"
},
{
- "description": "이 기능을 사용하면 애플리케이션 코드에서 인증 라이브러리를 사용할 필요가 없으므로 복잡성이 줄어듭니다. 요청이 애플리케이션에 도달할 때 사용자는 이미 인증된 상태입니다.",
+ "description": "이 기능을 사용하면 애플리케이션 코드에서 인증 라이브러리를 사용할 필요가 없으므로 복잡성이 줄어듭니다. 요청이 애플리케이션에 도달할 때 사용자는 이미 인증되었습니다.",
"guid": "0e19e111-ccad-457f-94b5-ee2deebc553c",
"service": "App Service Web Apps",
"text": "(App Service) App Service 기본 제공 인증이 애플리케이션에 액세스하는 사용자를 인증하는 데 적합한 메커니즘인지 여부를 평가합니다. App Service 기본 제공 인증은 Microsoft Entra ID와 통합됩니다. 이 기능은 여러 로그인 공급자에서 토큰 유효성 검사 및 사용자 ID 관리를 처리하고 OpenID Connect를 지원합니다. 이 기능을 사용하면 세분화된 수준의 권한 부여가 없으며 인증을 테스트할 메커니즘이 없습니다.",
@@ -195,7 +195,7 @@
"waf": "안전"
},
{
- "description": "Azure 가상 네트워크 사용의 보안 이점을 누리세요. 예를 들어 응용 프로그램은 네트워크 내의 리소스에 안전하게 액세스할 수 있습니다. 애플리케이션을 보호하는 데 도움이 되는 프라이빗 엔드포인트를 추가합니다. 프라이빗 엔드포인트는 공용 네트워크에 대한 직접 노출을 제한하고 역방향 프록시를 통해 제어된 액세스를 허용합니다.",
+ "description": "Azure 가상 네트워크 사용의 보안 이점을 누리세요. 예를 들어, 애플리케이션은 네트워크 내의 리소스에 안전하게 액세스할 수 있습니다. 애플리케이션을 보호하는 데 도움이 되는 프라이빗 엔드포인트를 추가합니다. 프라이빗 엔드포인트는 공용 네트워크에 대한 직접 노출을 제한하고 역방향 프록시를 통해 제어된 액세스를 허용합니다.",
"guid": "1835b31e-37b4-431a-b783-eb28fec46518",
"service": "App Service Web Apps",
"text": "(앱 서비스) 가상 네트워크 통합을 위해 응용 프로그램을 구성합니다. App Service 앱에 프라이빗 엔드포인트를 사용합니다. 모든 공용 트래픽을 차단합니다. 가상 네트워크 통합을 통해 컨테이너 이미지 끌어오기를 라우팅합니다. 애플리케이션에서 나가는 모든 트래픽은 가상 네트워크를 통과합니다.",
@@ -203,7 +203,7 @@
"waf": "안전"
},
{
- "description": "기본 인증은 보안 배포 방법으로 권장되지 않습니다. Microsoft Entra ID는 OAuth 2.0 토큰 기반 인증을 사용하여 기본 인증과 관련된 제한 사항을 해결하는 다양한 이점과 향상된 기능을 제공합니다. 정책은 애플리케이션 리소스에 대한 액세스를 제한하고, 특정 도메인의 요청만 허용하며, 지역 간 요청을 보호합니다.",
+ "description": "기본 인증은 보안 배포 방법으로 권장되지 않습니다. Microsoft Entra ID는 OAuth 2.0 토큰 기반 인증을 사용하여 기본 인증과 관련된 제한 사항을 해결하는 많은 이점과 향상된 기능을 제공합니다. 정책은 애플리케이션 리소스에 대한 액세스를 제한하고, 특정 도메인의 요청만 허용하고, 리전 간 요청을 보호합니다.",
"guid": "07adcdee-eecc-43c4-9cf8-40e06efa96cc",
"service": "App Service Web Apps",
"text": "(앱 서비스) 강화를 구현하려면 다음을 수행합니다. - Microsoft Entra ID 기반 인증을 위해 사용자 이름과 암호를 사용하는 기본 인증을 사용하지 않도록 설정합니다. - 인바운드 포트가 열리지 않도록 원격 디버깅을 끕니다. - CORS 정책을 활성화하여 들어오는 요청을 강화합니다. - FTP와 같은 프로토콜을 비활성화합니다.",
@@ -219,7 +219,7 @@
"waf": "안전"
},
{
- "description": "App Service 계획에서 실행되는 리소스에 대한 실시간 보호를 받으세요. 위협으로부터 보호하고 전반적인 보안 태세를 강화합니다.",
+ "description": "App Service 계획에서 실행되는 리소스에 대한 실시간 보호를 가져옵니다. 위협으로부터 보호하고 전반적인 보안 태세를 강화합니다.",
"guid": "6cd4ee41-8ebd-4a7e-9da4-793705575ea0",
"service": "App Service Web Apps",
"text": "(App Service 계획) App Service에 대해 클라우드용 Microsoft Defender를 사용하도록 설정합니다.",
@@ -262,7 +262,7 @@
"description": "",
"guid": "9d33583d-156b-4a49-b361-1eae39f5d6df",
"service": "App Service Web Apps",
- "text": "밀도와 격리 간의 장단점 고려: App Service 계획을 사용하여 동일한 컴퓨팅에서 여러 애플리케이션을 호스트할 수 있으며, 이를 통해 공유 환경에서 비용을 절감할 수 있습니다. 자세한 내용은 트레이드오프를 참조하십시오.",
+ "text": "밀도와 격리 간의 장단점 고려: App Service 계획을 사용하여 동일한 컴퓨팅에서 여러 애플리케이션을 호스트할 수 있으며, 이는 공유 환경에서 비용을 절감합니다. 자세한 내용은 Tradeoffs를 참조하십시오.",
"type": "checklist",
"waf": "비용"
},
@@ -270,7 +270,7 @@
"description": "",
"guid": "19d66260-5bfe-466e-89b0-f2573223acf9",
"service": "App Service Web Apps",
- "text": "크기 조정 전략이 비용에 미치는 영향 평가: 자동 크기 조정을 구현할 때 확장 및 축소를 적절하게 설계, 테스트 및 구성해야 합니다. 자동 크기 조정에 대한 정확한 최대 및 최소 제한을 설정합니다.",
+ "text": "크기 조정 전략이 비용에 미치는 영향 평가: autoscaling을 구현할 때 확장 및 축소를 적절하게 설계, 테스트 및 구성해야 합니다. 자동 크기 조정에 대한 정확한 최대 및 최소 제한을 설정합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -342,7 +342,7 @@
"description": "",
"guid": "3aa6c22d-807b-4efd-9ebe-b290c995d0b3",
"service": "App Service Web Apps",
- "text": "릴리스 관리: 배포 슬롯을 사용하여 릴리스를 효과적으로 관리합니다. 응용 프로그램을 슬롯에 배포하고, 테스트를 수행하고, 해당 기능의 유효성을 검사할 수 있습니다. 확인 후 앱을 프로덕션으로 원활하게 이동할 수 있습니다. 이 프로세스는 슬롯이 프로덕션 인스턴스와 동일한 가상 머신(VM) 환경에서 실행되기 때문에 추가 비용이 발생하지 않습니다.",
+ "text": "릴리스 관리: 배포 슬롯을 사용하여 릴리스를 효과적으로 관리합니다. 응용 프로그램을 슬롯에 배포하고, 테스트를 수행하고, 해당 기능의 유효성을 검사할 수 있습니다. 확인 후 앱을 프로덕션으로 원활하게 이동할 수 있습니다. 이 프로세스는 슬롯이 프로덕션 인스턴스와 동일한 VM(가상 머신) 환경에서 실행되기 때문에 추가 비용이 발생하지 않습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -350,7 +350,7 @@
"description": "",
"guid": "751098a9-7103-4250-bd52-f48a5fbe8b73",
"service": "App Service Web Apps",
- "text": "자동화된 테스트 실행: 웹앱의 릴리스를 홍보하기 전에 성능, 기능 및 다른 구성 요소와의 통합을 철저하게 테스트합니다. 성능 테스트에 널리 사용되는 도구인 Apache JMeter와 통합되는 Azure Load Testing을 사용합니다. 기능 테스트를 위한 Phantom과 같은 다른 유형의 테스트를 위한 자동화 도구를 살펴보세요.",
+ "text": "자동화된 테스트 실행: 웹앱 릴리스를 홍보하기 전에 성능, 기능 및 다른 구성 요소와의 통합을 철저하게 테스트합니다. 성능 테스트에 널리 사용되는 도구인 Apache JMeter와 통합되는 Azure Load Testing을 사용합니다. 기능 테스트를 위한 Phantom과 같은 다른 유형의 테스트를 위한 자동화 도구를 살펴보세요.",
"type": "checklist",
"waf": "작업"
},
@@ -358,7 +358,7 @@
"description": "",
"guid": "0de22a93-9404-4512-b374-6c753628943e",
"service": "App Service Web Apps",
- "text": "변경할 수 없는 단위 배포: 배포 스탬프 패턴을 구현하여 App Service를 변경할 수 없는 스탬프로 구분합니다. App Service는 기본적으로 변경할 수 없는 컨테이너 사용을 지원합니다. App Service 웹앱에 대한 사용자 지정 컨테이너를 고려합니다.",
+ "text": "변경할 수 없는 단위 배포: 배포 스탬프 패턴을 구현하여 App Service를 변경할 수 없는 스탬프로 구분합니다. App Service는 기본적으로 변경할 수 없는 컨테이너의 사용을 지원합니다. App Service 웹앱에 대한 사용자 지정 컨테이너를 고려합니다.",
"type": "checklist",
"waf": "작업"
},
@@ -366,7 +366,7 @@
"description": "",
"guid": "3175ebdb-2846-4f48-b450-278df163c188",
"service": "App Service Web Apps",
- "text": "프로덕션 환경을 안전하게 유지: 프로덕션 및 사전 프로덕션 환경을 실행하기 위한 별도의 App Service 계획을 만듭니다. 안정성과 신뢰성을 보장하기 위해 프로덕션 환경에서 직접 변경하지 마세요. 별도의 인스턴스를 사용하면 프로덕션에 변경 사항을 승격하기 전에 개발 및 테스트의 유연성을 확보할 수 있습니다.",
+ "text": "프로덕션 환경을 안전하게 유지: 프로덕션 및 사전 프로덕션 환경을 실행하기 위한 별도의 App Service 계획을 만듭니다. 안정성과 신뢰성을 보장하기 위해 프로덕션 환경에서 직접 변경하지 마세요. 별도의 인스턴스를 사용하면 변경 사항을 프로덕션으로 승격하기 전에 개발 및 테스트에 유연성을 부여할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -390,12 +390,12 @@
"description": "진단 로그는 앱의 동작에 대한 중요한 인사이트를 제공합니다. 트래픽 패턴을 모니터링하고 이상 징후를 식별합니다.",
"guid": "91d861ad-a4ae-462e-8775-56cbecb31951",
"service": "App Service Web Apps",
- "text": "(앱 서비스) 응용 프로그램 및 인스턴스에 대한 진단 로그를 사용하도록 설정합니다. 잦은 로깅은 시스템 성능을 저하시키고, 스토리지 비용을 증가시키며, 로그에 안전하지 않은 액세스 권한이 있는 경우 위험을 초래할 수 있습니다. 다음 모범 사례를 따르십시오. - 적절한 수준의 정보를 기록합니다. - 보존 정책을 설정합니다. - 승인된 액세스 및 승인되지 않은 시도에 대한 감사 추적을 유지합니다. - 로그를 데이터로 처리하고 데이터 보호 제어를 적용합니다.",
+ "text": "(앱 서비스) 응용 프로그램 및 인스턴스에 대한 진단 로그를 사용하도록 설정합니다. 잦은 로깅은 시스템 성능을 저하시키고, 스토리지 비용을 증가시키며, 로그에 안전하지 않은 액세스 권한이 있는 경우 위험을 초래할 수 있습니다. 다음 모범 사례를 따르십시오. - 적절한 수준의 정보를 기록합니다. - 보존 정책을 설정합니다. - 승인된 액세스 및 무단 시도에 대한 감사 추적을 유지합니다. - 로그를 데이터로 처리하고 데이터 보호 제어를 적용합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "App Service는 인증서 조달, 인증서 확인, 인증서 갱신 및 Key Vault에서 인증서 가져오기와 같은 프로세스를 자동으로 처리합니다. 또는 Key Vault에 인증서를 업로드하고 App Service 리소스 공급자에게 액세스할 수 있는 권한을 부여합니다.",
+ "description": "App Service는 인증서 조달, 인증서 확인, 인증서 갱신 및 Key Vault에서 인증서 가져오기와 같은 프로세스를 자동으로 처리합니다. 또는 인증서를 Key Vault에 업로드하고 App Service 리소스 공급자에게 액세스할 수 있는 권한을 부여합니다.",
"guid": "70e24ecc-5113-4d7d-8a79-8ac24fe1f838",
"service": "App Service Web Apps",
"text": "(앱 서비스) App Service 관리형 인증서를 활용하여 인증 관리를 Azure로 오프로드합니다.",
@@ -403,10 +403,10 @@
"waf": "작업"
},
{
- "description": "다운타임과 오류를 방지합니다. 스왑 후 문제를 감지한 경우 마지막으로 알려진 양호한 상태로 빠르게 되돌립니다.",
+ "description": "다운타임과 오류를 방지합니다. 스왑 후 문제를 감지하면 마지막으로 알려진 양호한 상태로 빠르게 되돌립니다.",
"guid": "7a592a00-a940-4d2e-a919-56ad3237092e",
"service": "App Service Web Apps",
- "text": "(App Service 계획) 프로덕션 슬롯으로 교체하기 전에 스테이징 슬롯에서 앱 변경 사항의 유효성을 검사합니다.",
+ "text": "(App Service 계획) 프로덕션 슬롯으로 바꾸기 전에 스테이징 슬롯에서 앱 변경 사항의 유효성을 검사합니다.",
"type": "recommendation",
"waf": "작업"
},
@@ -438,7 +438,7 @@
"description": "",
"guid": "97fdfb16-a73b-497a-853a-fe608cfc1750",
"service": "App Service Web Apps",
- "text": "크기 조정 전략 최적화: 가능한 경우 애플리케이션 부하가 변경될 때 인스턴스 수를 수동으로 조정하는 대신 자동 크기 조정을 사용합니다. 자동 크기 조정을 통해 App Service는 미리 정의된 규칙 또는 트리거에 따라 서버 용량을 조정합니다. 적절한 성능 테스트를 수행하고 올바른 트리거에 대한 올바른 규칙을 설정해야 합니다.",
+ "text": "크기 조정 전략 최적화: 가능하면 애플리케이션 로드가 변경될 때 인스턴스 수를 수동으로 조정하는 대신 자동 크기 조정을 사용합니다. 자동 크기 조정을 통해 App Service는 미리 정의된 규칙 또는 트리거에 따라 서버 용량을 조정합니다. 적절한 성능 테스트를 수행하고 올바른 트리거에 대한 올바른 규칙을 설정해야 합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -446,7 +446,7 @@
"description": "",
"guid": "45d7e1a5-2b7e-4b6b-8925-bf0b760a9d7e",
"service": "App Service Web Apps",
- "text": "캐싱 사용: 자주 변경되지 않고 액세스 비용이 많이 드는 리소스에서 정보를 검색하면 성능에 영향을 줍니다. 조인 및 여러 조회를 포함한 복잡한 쿼리는 런타임에 기여합니다. 처리 시간과 대기 시간을 최소화하기 위해 캐싱을 수행합니다. 쿼리 결과를 캐시하여 데이터베이스 또는 백엔드에 대한 반복적인 왕복을 방지하고 후속 요청에 대한 처리 시간을 줄일 수 있습니다.",
+ "text": "캐싱 사용: 자주 변경되지 않고 액세스 비용이 많이 드는 리소스에서 정보를 검색하면 성능에 영향을 줍니다. 조인 및 여러 조회를 포함한 복잡한 쿼리는 런타임에 기여합니다. 처리 시간과 대기 시간을 최소화하기 위해 캐싱을 수행합니다. 쿼리 결과를 캐시하여 데이터베이스 또는 백엔드에 대한 반복적인 왕복을 방지하고 후속 요청에 대한 처리 시간을 줄입니다.",
"type": "checklist",
"waf": "공연"
},
@@ -459,7 +459,7 @@
"waf": "공연"
},
{
- "description": "응용 프로그램은 Always On이 활성화된 상태에서 언로드되지 않습니다.",
+ "description": "응용 프로그램은 Always On을 사용하도록 설정된 상태로 언로드되지 않습니다.",
"guid": "2c97ff90-e7cd-4888-a0c9-c21ea287071c",
"service": "App Service Web Apps",
"text": "애플리케이션이 단일 App Service 계획을 공유하는 경우 Always On 설정을 사용하도록 설정합니다. App Service 앱은 리소스를 절약하기 위해 유휴 상태일 때 자동으로 언로드됩니다. 다음 요청은 콜드 스타트를 트리거하여 요청 시간 초과를 유발할 수 있습니다.",
@@ -470,495 +470,343 @@
"description": "HTTP/2는 연결을 완전히 다중화하고, 연결을 재사용하여 오버헤드를 줄이고, 헤더를 압축하여 데이터 전송을 최소화하기 때문에 HTTP/1.1보다 HTTP/2를 선택합니다.",
"guid": "d735fb9e-9e87-415c-93d0-4918b5cf104e",
"service": "App Service Web Apps",
- "text": "프로토콜 효율성을 개선하기 위해 애플리케이션에 HTTP/2를 사용하는 것이 좋습니다.",
+ "text": "프로토콜 효율성을 향상시키기 위해 애플리케이션에 HTTP/2를 사용하는 것이 좋습니다.",
"type": "recommendation",
"waf": "공연"
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "Azure Application Gateway",
- "text": "사용 가능한 경우 영역 인식 구성으로 인스턴스를 배포합니다.",
+ "text": "워크로드에 특별히 Application Gateway v1이 필요한 경우가 아니면 새 배포에서 Application Gateway v2를 사용합니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "Azure Application Gateway",
- "text": "가상 네트워크 내에서 WAF(Web Application Firewall)와 함께 Application Gateway를 사용하여 인터넷에서 인바운드 'HTTP/S' 트래픽을 보호합니다.",
+ "text": "설계에 중복성을 구축합니다. Application Gateway 인스턴스를 가용성 영역에 분산하여 내결함성을 개선하고 중복성을 구축합니다. 한 영역에 장애가 발생하면 트래픽이 다른 영역으로 이동합니다. 자세한 내용은 가용성 영역 및 지역 사용에 대한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "Azure Application Gateway",
- "text": "새 배포에서는 Azure Application Gateway v1을 사용해야 하는 강력한 이유가 없는 한 Azure Application Gateway v2를 사용합니다.",
+ "text": "Application Gateway에 액세스하거나 추가로 변경하기 전에 규칙 업데이트 및 기타 구성 변경에 대한 추가 시간을 계획합니다. 예를 들어 기존 연결을 드레이닝해야 하기 때문에 백 엔드 풀에서 서버를 제거하는 데 추가 시간이 필요할 수 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "Azure Application Gateway",
- "text": "규칙 업데이트 계획",
+ "text": "상태 엔드포인트 모니터링 패턴을 구현합니다. 응용 프로그램은 응용 프로그램이 요청을 처리하는 데 필요한 중요한 서비스 및 종속성의 상태를 집계하는 상태 엔드포인트를 노출해야 합니다. Application Gateway 상태 프로브는 엔드포인트를 사용하여 백 엔드 풀에 있는 서버의 상태를 검색합니다. 자세한 내용은 상태 엔드포인트 모니터링 패턴을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "Azure Application Gateway",
- "text": "상태 프로브를 사용하여 백 엔드 사용 불가 감지Use health probes to detect backend unavailability",
+ "text": "간격 및 임계값 설정이 상태 프로브에 미치는 영향을 평가합니다. 상태 프로브는 설정된 간격으로 구성된 엔드포인트에 요청을 보냅니다. 그리고 백 엔드는 비정상으로 표시되기 전에 제한된 수의 실패한 요청을 허용합니다. 이러한 설정은 충돌할 수 있으며, 이로 인해 장단점이 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "Azure Application Gateway",
- "text": "간격 및 임계값 설정이 상태 프로브에 미치는 영향을 검토합니다.",
+ "text": "상태 엔드포인트를 통해 다운스트림 종속성을 확인합니다. 오류를 격리하기 위해 각 백엔드에는 고유한 종속성이 있을 수 있습니다. 예를 들어 Application Gateway 뒤에서 호스트하는 애플리케이션에는 여러 백 엔드가 있을 수 있으며 각 백 엔드는 다른 데이터베이스 또는 복제본에 연결됩니다. 이러한 종속성이 실패하면 애플리케이션이 작동할 수 있지만 유효한 결과를 반환하지 않을 수 있습니다. 이러한 이유로 상태 엔드포인트는 이상적으로 모든 종속성의 유효성을 검사해야 합니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
"description": "",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "Azure Application Gateway",
- "text": "상태 엔드포인트를 통해 다운스트림 종속성 확인Verify downstream dependencies through health endpoints",
+ "text": "안정성에 영향을 줄 수 있는 Application Gateway 제한 사항 및 알려진 문제를 고려합니다. Application Gateway FAQ를 검토하여 디자인별 동작, 생성 중인 수정 사항, 플랫폼 제한 사항 및 가능한 해결 방법 또는 완화 전략에 대한 중요한 정보를 확인합니다. Application Gateway 전용 서브넷에서 UDR을 사용하지 마세요.",
"type": "checklist",
"waf": "신뢰도"
},
{
- "description": "Application Gateway에 액세스하거나 추가로 변경하기 전에 업데이트를 위한 충분한 시간을 계획합니다. 예를 들어 백 엔드 풀에서 서버를 제거하려면 기존 연결을 드레이닝해야 하기 때문에 시간이 걸릴 수 있습니다.",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "Azure Application Gateway",
- "text": "규칙 업데이트 계획",
- "type": "recommendation",
+ "text": "Application Gateway의 백 엔드 연결에 영향을 줄 수 있는 디자인에서 SNAT(Source Network Address Translation) 포트 제한을 고려합니다. 일부 요인은 Application Gateway가 SNAT 포트 제한에 도달하는 방법에 영향을 줍니다. 예를 들어 백 엔드가 공용 IP 주소인 경우 자체 SNAT 포트가 필요합니다. SNAT 포트 제한을 방지하려면 다음 옵션 중 하나를 수행할 수 있습니다.",
+ "type": "checklist",
"waf": "신뢰도"
},
{
- "description": "Application Gateway를 사용하여 여러 백 엔드 인스턴스를 통해 들어오는 트래픽의 부하를 분산하는 경우 상태 프로브를 사용하는 것이 좋습니다. 이렇게 하면 트래픽을 처리할 수 없는 백엔드로 트래픽이 라우팅되지 않습니다.",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "여러 인스턴스를 여러 영역에 분산하면 워크로드가 단일 영역에서 장애를 견딜 수 있습니다. 사용할 수 없는 영역이 있는 경우 트래픽이 자동으로 다른 영역의 정상 인스턴스로 전환되어 애플리케이션 안정성이 유지됩니다.",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "Azure Application Gateway",
- "text": "상태 프로브를 사용하여 백 엔드 사용 불가 감지Use health probes to detect backend unavailability",
+ "text": "영역 인식 구성에서 Application Gateway 인스턴스를 배포합니다. 모든 지역에서 이 기능을 제공하는 것은 아니므로 영역 중복에 대한 지역 지원을 확인합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "상태 프로브는 설정된 간격으로 구성된 엔드포인트로 요청을 보냅니다. 또한 백 엔드가 비정상으로 표시되기 전에 허용되는 실패한 요청의 임계값이 있습니다. 이러한 숫자는 절충안을 제시합니다.- 더 높은 간격을 설정하면 서비스에 더 많은 부하가 걸립니다. 각 Application Gateway 인스턴스는 자체 상태 프로브를 보내므로 30초마다 100개의 인스턴스는 30초당 100개의 요청을 의미합니다.- 간격을 낮게 설정하면 중단이 감지되기 전에 더 많은 시간이 남습니다.- 비정상 임계값을 낮게 설정하면 짧은 일시적인 오류로 인해 백 엔드가 중단될 수 있습니다. - 임계값을 높게 설정하면 백엔드를 회전에서 제외하는 데 시간이 더 오래 걸릴 수 있습니다.",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "상태 프로브는 트래픽이 트래픽을 처리할 수 있는 백 엔드로만 라우팅되도록 합니다. Application Gateway는 백 엔드 풀에 있는 모든 서버의 상태를 모니터링하고 비정상으로 간주되는 모든 서버로의 트래픽 전송을 자동으로 중지합니다.",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "Azure Application Gateway",
- "text": "간격 및 임계값 설정이 상태 프로브에 미치는 영향을 검토합니다.",
+ "text": "Application Gateway 상태 프로브를 사용하여 백 엔드 사용 불가를 검색합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "각 백엔드에 실패를 격리하기 위해 자체 종속성이 있다고 가정합니다. 예를 들어 Application Gateway 뒤에서 호스트되는 애플리케이션에는 각각 다른 데이터베이스(복제본)에 연결된 여러 백 엔드가 있을 수 있습니다. 이러한 종속성이 실패하면 애플리케이션이 작동할 수 있지만 유효한 결과를 반환하지 않을 수 있습니다. 이러한 이유로 상태 엔드포인트는 모든 종속성의 유효성을 검사하는 것이 좋습니다. 상태 엔드포인트에 대한 각 호출에 직접 종속성 호출이 있는 경우 해당 데이터베이스는 30초마다 1개가 아닌 100개의 쿼리를 수신합니다. 이를 방지하려면 상태 엔드포인트가 짧은 기간 동안 종속성의 상태를 캐시해야 합니다.",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "속도 제한을 사용하여 재시도 폭풍과 같은 문제를 방지합니다.",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "Azure Application Gateway",
- "text": "상태 엔드포인트를 통해 다운스트림 종속성 확인Verify downstream dependencies through health endpoints",
+ "text": "클라이언트가 애플리케이션에 너무 많은 트래픽을 보낼 수 없도록 Azure WAF에 대한 속도 제한 규칙을 구성합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "특정 시나리오에서는 Application Gateway에서 특별히 규칙을 구현해야 할 수 있습니다. 예를 들어 ModSec CRS 2.2.9, CRS 3.0 또는 CRS 3.1 규칙이 필요한 경우 이러한 규칙은 Application Gateway에서만 구현할 수 있습니다. 반대로, 속도 제한 및 지역 필터링은 AppGateway가 아닌 Azure Front Door에서만 사용할 수 있습니다.",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "Application Gateway 서브넷의 UDR로 인해 몇 가지 문제가 발생할 수 있습니다. 백 엔드 상태, 로그 및 메트릭을 볼 수 있도록 Application Gateway 서브넷에서 UDR을 사용하지 마세요.",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "Azure Application Gateway",
- "text": "Azure Front Door 및 Application Gateway를 사용하여 'HTTP/S' 애플리케이션을 보호하는 경우 Front Door에서 WAF 정책을 사용하고 Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "text": "백 엔드 상태 보고서가 제대로 작동하고 올바른 로그 및 메트릭을 생성하도록 Application Gateway에서 UDR을 사용하지 마세요. Application Gateway 서브넷에서 UDR을 사용해야 하는 경우 지원되는 UDR을 참조하세요.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "백 엔드와 일치하도록 IdleTimeout을 설정합니다. 이 설정은 백 엔드가 요청에 응답하는 데 4분 이상 걸리는 경우 Application Gateway와 클라이언트 간의 연결이 열린 상태로 유지되도록 합니다. 이 설정을 구성하지 않으면 연결이 닫히고 클라이언트에 백 엔드 응답이 표시되지 않습니다.",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "Azure Application Gateway",
- "text": "보안 강화를 위한 TLS 정책 설정",
- "type": "checklist",
- "waf": "안전"
+ "text": "백 엔드 애플리케이션의 수신기 및 트래픽 특성과 일치하도록 IdleTimeout 설정을 구성합니다. 기본값은 4분입니다. 최대 30분까지 구성할 수 있습니다. 자세한 내용은 로드 밸런서 TCP(Transmission Control Protocol) 재설정 및 유휴 시간 제한을 참조하세요.",
+ "type": "recommendation",
+ "waf": "신뢰도"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "Azure Application Gateway",
- "text": "TLS 종료에 AppGateway 사용",
+ "text": "Application Gateway에 대한 보안 기준을 검토합니다.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "Azure Application Gateway",
- "text": "Azure Key Vault를 사용하여 TLS 인증서 저장",
+ "text": "엣지에서 일반적인 위협을 차단합니다. WAF는 Application Gateway와 통합됩니다. 프런트 엔드에서 WAF 규칙을 사용하도록 설정하여 공격 소스에 가까운 네트워크 에지의 일반적인 악용 및 취약성으로부터 애플리케이션을 보호합니다. 자세한 내용은 Application Gateway의 WAF를 참조하세요.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "Azure Application Gateway",
- "text": "백엔드 트래픽을 다시 암호화할 때 백엔드 서버 인증서에 루트 및 중간 CA(인증 기관)가 모두 포함되어 있는지 확인합니다",
+ "text": "컨트롤 플레인에 대해 권한이 부여된 액세스만 허용합니다. Application Gateway RBAC(역할 기반 액세스 제어)를 사용하여 필요한 ID에 대한 액세스만 제한합니다.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "Azure Application Gateway",
- "text": "백 엔드 풀 리소스에 적절한 DNS 서버를 사용합니다",
+ "text": "전송 중인 데이터를 보호합니다. 엔드투엔드 TLS(전송 계층 보안), TLS 종료 및 엔드투엔드 TLS 암호화를 사용하도록 설정합니다. 백엔드 트래픽을 다시 암호화할 때 백엔드 서버 인증서에 루트 및 중간 CA(인증 기관)가 모두 포함되어 있는지 확인합니다.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "Azure Application Gateway",
- "text": "Application Gateway에 대한 모든 NSG 제한 사항 준수",
+ "text": "애플리케이션 비밀을 보호합니다. Azure Key Vault를 사용하여 TLS 인증서를 저장하여 보안을 강화하고 인증서 갱신 및 회전 프로세스를 더 쉽게 수행할 수 있습니다.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷에서 UDR을 사용하지 마세요.",
+ "text": "공격 노출 영역을 줄이고 구성을 강화합니다. 필요하지 않은 기본 구성을 제거하고 Application Gateway 구성을 강화하여 보안 제어를 강화합니다. Application Gateway에 대한 모든 NSG(네트워크 보안 그룹) 제한 사항을 준수합니다.",
"type": "checklist",
"waf": "안전"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "Azure Application Gateway",
- "text": "WAF를 사용하도록 설정할 때 Application Gateway 용량 변경에 유의하세요.",
+ "text": "비정상적인 활동을 모니터링합니다. 정기적으로 로그를 검토하여 공격 및 거짓 긍정을 확인합니다. Application Gateway에서 Microsoft Sentinel과 같은 조직의 중앙 집중식 SIEM(보안 정보 및 이벤트 관리)으로 WAF 로그를 보내 위협 패턴을 감지하고 워크로드 디자인에 예방 조치를 통합합니다.",
"type": "checklist",
"waf": "안전"
},
{
- "description": "추가 보안을 위해 TLS 정책을 설정합니다. 항상 사용 가능한 최신 TLS 정책 버전을 사용하고 있는지 확인합니다. 이렇게 하면 TLS 1.2 및 더 강력한 암호가 적용됩니다.",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "Azure Application Gateway",
- "text": "보안 강화를 위한 TLS 정책 설정",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "TLS 종료에 Application Gateway를 사용하면 다음과 같은 이점이 있습니다.- 다른 백 엔드로 이동하는 요청이 각 백 엔드에 다시 인증해야 하기 때문에 성능이 향상됩니다.- TLS 처리를 수행할 필요가 없으므로 백 엔드 서버의 활용도가 향상됩니다.- 요청 콘텐츠에 액세스하여 지능형 라우팅.- 인증서를 Application Gateway에만 설치하면 되므로 인증서 관리가 더 쉽습니다.",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
- "service": "Azure Application Gateway",
- "text": "TLS 종료에 AppGateway 사용",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "Application Gateway는 Key Vault와 통합할 수 있습니다. 이를 통해 보안이 강화되고, 역할과 책임이 더 쉽게 분리되고, 관리형 인증서가 지원되고, 인증서 갱신 및 순환 프로세스가 더 쉬워집니다.",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
- "service": "Azure Application Gateway",
- "text": "Azure Key Vault를 사용하여 TLS 인증서 저장",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "백엔드 서버의 TLS 인증서는 잘 알려진 CA에서 발급해야 합니다. 인증서가 신뢰할 수 있는 CA에서 발급되지 않은 경우 Application Gateway는 신뢰할 수 있는 CA 인증서를 찾을 때까지 인증서가 신뢰할 수 있는 CA에서 발급되었는지 확인합니다. 그런 다음에만 보안 연결이 설정됩니다. 그렇지 않으면 Application Gateway는 백 엔드를 비정상으로 표시합니다.",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
- "service": "Azure Application Gateway",
- "text": "백엔드 트래픽을 다시 암호화할 때 백엔드 서버 인증서에 루트 및 중간 CA(인증 기관)가 모두 포함되어 있는지 확인합니다",
- "type": "recommendation",
- "waf": "안전"
- },
- {
- "description": "백 엔드 풀에 확인 가능한 FQDN이 포함된 경우 DNS 확인은 프라이빗 DNS 영역 또는 사용자 지정 DNS 서버(VNet에 구성된 경우)를 기반으로 하거나 기본 Azure 제공 DNS를 사용합니다.",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "최신 TLS 정책을 사용하여 TLS 1.2 및 더 강력한 암호의 사용을 적용합니다. TLS 정책에는 TLS 프로토콜 버전 및 암호 그룹에 대한 제어와 TLS 핸드셰이크에서 암호를 사용하는 순서가 포함됩니다.",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "Azure Application Gateway",
- "text": "백 엔드 풀 리소스에 적절한 DNS 서버를 사용합니다",
+ "text": "보안 강화를 위해 TLS 정책을 설정합니다. 최신 TLS 정책 버전을 사용해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "NSG는 Application Gateway 서브넷에서 지원되지만 몇 가지 제한 사항이 있습니다. 예를 들어, 특정 포트 범위와의 일부 통신은 금지됩니다. 이러한 제한 사항의 의미를 이해해야 합니다. 자세한 내용은 네트워크 보안 그룹을 참조하세요.",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "description": "다른 백 엔드로 이동하는 요청은 각 백 엔드에 다시 인증할 필요가 없기 때문에 성능이 향상됩니다. 게이트웨이는 요청 콘텐츠에 액세스하고 지능적인 라우팅 결정을 내릴 수 있습니다. Application Gateway에 인증서만 설치하면 인증서 관리가 간소화됩니다.",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "Azure Application Gateway",
- "text": "Application Gateway에 대한 모든 NSG 제한 사항 준수",
+ "text": "TLS 종료에 Application Gateway를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "Application Gateway 서브넷에서 UDR(사용자 정의 경로)을 사용하면 몇 가지 문제가 발생할 수 있습니다. 백 엔드의 상태는 알 수 없음일 수 있습니다. Application Gateway 로그 및 메트릭이 생성되지 않을 수 있습니다. 백 엔드 상태, 로그 및 메트릭을 볼 수 있도록 Application Gateway 서브넷에서 UDR을 사용하지 않는 것이 좋습니다. 조직에서 Application Gateway 서브넷에서 UDR을 사용해야 하는 경우 지원되는 시나리오를 검토해야 합니다. 자세한 내용은 지원되는 사용자 정의 경로를 참조하세요.",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
+ "description": "이 접근 방식은 더 강력한 보안, 더 쉬운 역할 및 책임 분리, 관리형 인증서에 대한 지원, 더 쉬운 인증서 갱신 및 순환 프로세스를 제공합니다.",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷에서 UDR을 사용하지 마세요.",
+ "text": "Application Gateway를 Key Vault와 통합하여 TLS 인증서를 저장합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "WAF를 사용하도록 설정하면 Application Gateway에서 모든 요청을 버퍼링해야 하며, 완전히 도착할 때까지 요청이 핵심 규칙 집합의 규칙 위반과 일치하는지 확인한 다음, 패킷을 백 엔드 인스턴스로 전달해야 합니다. 대용량 파일(30MB+ 크기)이 업로드되는 경우 상당한 대기 시간이 발생할 수 있습니다. Application Gateway 용량 요구 사항은 WAF와 다르기 때문에 적절한 테스트 및 유효성 검사 없이 Application Gateway에서 WAF를 사용하도록 설정하지 않는 것이 좋습니다.",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "description": "Application Gateway 서브넷은 NSG를 지원하지만 몇 가지 제한 사항이 있습니다. 예를 들어, 특정 포트 범위와의 일부 통신은 금지됩니다. 이러한 제한 사항의 의미를 이해해야 합니다.",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "Azure Application Gateway",
- "text": "WAF를 사용하도록 설정할 때 Application Gateway 용량 변경에 유의하세요.",
+ "text": "Application Gateway에 대한 모든 NSG 제한 사항을 준수합니다.",
"type": "recommendation",
"waf": "안전"
},
{
"description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 가격 책정을 숙지합니다.",
- "type": "checklist",
- "waf": "비용"
- },
- {
- "description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "Azure Application Gateway",
- "text": "활용도가 낮은 리소스 검토",
+ "text": "Application Gateway 및 WAF 가격 책정을 숙지하세요. 워크로드 용량 수요를 충족하고 리소스 낭비 없이 예상 성능을 제공할 수 있는 적절한 크기의 옵션을 선택합니다. 비용을 추정하려면 가격 계산기를 사용합니다.",
"type": "checklist",
"waf": "비용"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "Azure Application Gateway",
- "text": "사용 중이 아닌 Application Gateway 인스턴스 중지",
+ "text": "사용되지 않는 Application Gateway 인스턴스를 제거하고 사용률이 낮은 인스턴스를 최적화합니다. 불필요한 비용을 방지하려면 빈 백 엔드 풀이 있는 Application Gateway 인스턴스를 식별하고 삭제합니다. Application Gateway 인스턴스를 사용하지 않을 때 중지합니다.",
"type": "checklist",
"waf": "비용"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "Azure Application Gateway",
- "text": "축소 및 확장 정책이 있습니다.",
+ "text": "Application Gateway 인스턴스의 크기 조정 비용을 최적화합니다. 크기 조정 전략을 최적화하고 wokload의 요구 사항을 줄이려면 조정 비용 최적화를 위한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "비용"
},
{
"description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "Azure Application Gateway",
- "text": "다양한 매개 변수에서 소비 메트릭을 검토합니다.",
+ "text": "Application Gateway 사용량 메트릭을 모니터링하고 비용에 미치는 영향을 이해합니다. Azure는 추적된 메트릭에 따라 Application Gateway의 요금제 인스턴스에 대한 요금을 청구합니다. 다양한 메트릭 및 용량 단위를 평가하고 비용 동인을 결정합니다. 자세한 내용은 Microsoft Cost Management를 참조하세요.",
"type": "checklist",
"waf": "비용"
},
{
- "description": "Application Gateway 가격 책정에 대한 자세한 내용은 Azure Application Gateway 및 Web Application Firewall의 가격 이해를 참조하세요. 가격 계산기를 활용할 수도 있습니다. 용량 수요를 충족하고 리소스 낭비 없이 예상 성능을 제공할 수 있도록 옵션의 크기가 적절하게 조정되었는지 확인합니다.",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 가격 책정을 숙지합니다.",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "빈 백 엔드 풀이 있는 Application Gateway 인스턴스를 식별하고 삭제하여 불필요한 비용을 방지합니다.",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "Azure Application Gateway",
- "text": "활용도가 낮은 리소스 검토",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "Application Gateway가 중지된 상태일 때는 요금이 청구되지 않습니다. Application Gateway 인스턴스를 지속적으로 실행하면 불필요한 비용이 발생할 수 있습니다. 사용 패턴을 평가하고 필요하지 않을 때 인스턴스를 중지합니다. 예를 들어 개발/테스트 환경에서 업무 시간 이후의 사용량은 낮을 것으로 예상됩니다. 인스턴스를 중지하고 시작하는 방법에 대한 자세한 내용은 다음 문서를 참조하세요.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "Azure Application Gateway",
- "text": "사용하지 않을 때 Application Gateway 인스턴스 중지Stop Application Gateway instances when not in use",
- "type": "recommendation",
- "waf": "비용"
- },
- {
- "description": "확장 정책은 들어오는 트래픽과 급증을 처리할 수 있는 충분한 인스턴스가 있는지 확인합니다. 또한 수요가 감소할 때 인스턴스 수를 줄이는 축소 정책이 있어야 합니다. 인스턴스 크기 선택을 고려합니다. 크기는 비용에 큰 영향을 미칠 수 있습니다. 몇 가지 고려 사항은 Application Gateway 인스턴스 수 예측에 설명되어 있습니다. 자세한 내용은 Azure Application Gateway v2란?을 참조하세요.",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "description": "중지된 Application Gateway 인스턴스에는 비용이 발생하지 않습니다. 지속적으로 실행되는 Application Gateway 인스턴스는 불필요한 비용을 발생시킬 수 있습니다. 사용 패턴을 평가하고 필요하지 않을 때 인스턴스를 중지합니다. 예를 들어 개발/테스트 환경에서 업무 시간 이후 사용량이 낮을 것으로 예상됩니다.",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "Azure Application Gateway",
- "text": "축소 및 확장 정책이 있습니다.",
+ "text": "Application Gateway 인스턴스를 사용하지 않을 때 중지합니다. 자세한 내용은 Stop-AzApplicationGateway 및 Start-AzApplicationGateway를 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "Azure에서 추적한 메트릭을 기반으로 Application Gateway의 계량된 인스턴스를 기준으로 요금이 청구됩니다. 다양한 메트릭과 용량 단위를 평가하고 비용 동인을 결정합니다. 자세한 내용은 Microsoft Cost Management 및 청구를 참조하세요. 다음 메트릭은 Application Gateway의 핵심입니다. 이 정보는 프로비저닝된 인스턴스 수가 들어오는 트래픽의 양과 일치하는지 확인하는 데 사용할 수 있습니다.- 예상 청구 용량 단위 - 고정 청구 가능 용량 단위 - 현재 용량 단위자세한 내용은 Application Gateway 메트릭을 참조하세요. 대역폭 비용을 고려해야 합니다.",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "이러한 지표를 사용하여 프로비저닝된 인스턴스 수가 들어오는 트래픽의 양과 일치하는지 확인하고 할당된 리소스를 완전히 활용하는지 확인합니다.",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "Azure Application Gateway",
- "text": "다양한 매개 변수에서 소비 메트릭을 검토합니다.",
+ "text": "다음과 같은 주요 비용 동인 Application Gateway 메트릭을 모니터링합니다. - 예상 청구된 용량 단위. - 고정 청구 가능 용량 단위. - 현재 용량 단위입니다. 대역폭 비용을 고려해야 합니다.",
"type": "recommendation",
"waf": "비용"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "용량 메트릭 모니터링",
- "type": "checklist",
- "waf": "작업"
- },
- {
- "description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 및 WAF(Web Application Firewall)에서 진단 사용Enable diagnostics on Application Gateway and WAF(Web Application Firewall)",
- "type": "checklist",
- "waf": "작업"
- },
- {
- "description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
- "service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights 사용",
- "type": "checklist",
- "waf": "작업"
- },
- {
- "description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
- "service": "Azure Application Gateway",
- "text": "백 엔드 애플리케이션과 시간 제한 설정 일치Match timeout settings with the backend application",
- "type": "checklist",
- "waf": "작업"
- },
- {
- "description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "Azure Application Gateway",
- "text": "Azure Advisor를 사용하여 Key Vault 구성 문제 모니터링",
+ "text": "Application Gateway 및 WAF에서 진단을 사용하도록 설정합니다. 로그 및 메트릭을 수집하여 워크로드의 상태를 모니터링하고, 워크로드 성능 및 안정성의 추세를 식별하고, 문제를 해결할 수 있습니다. 전체 모니터링 방법을 설계하려면 모니터링 시스템 설계 및 생성에 대한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "작업"
},
{
"description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "Azure Application Gateway",
- "text": "SNAT 포트 제한 구성 및 모니터링",
+ "text": "Azure Monitor Network Insights를 사용하여 Application Gateway를 비롯한 네트워크 리소스의 상태 및 메트릭을 포괄적으로 볼 수 있습니다. 중앙 집중식 모니터링을 사용하여 문제를 신속하게 식별 및 해결하고, 성능을 최적화하고, 애플리케이션의 안정성을 보장할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
{
"description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "Azure Application Gateway",
- "text": "디자인에서 SNAT 포트 제한 사항 고려",
+ "text": "Azure Advisor에서 Application Gateway 권장 사항을 모니터링합니다. Application Gateway 인스턴스에 대한 새롭고 중요한 권장 사항이 있을 때 팀에 알리도록 경고를 구성합니다. Advisor는 범주, 영향 수준 및 권장 사항 유형과 같은 속성을 기반으로 권장 사항을 생성합니다.",
"type": "checklist",
"waf": "작업"
},
{
- "description": "이러한 메트릭을 프로비전된 Application Gateway 용량의 사용률 지표로 사용합니다. 용량에 대한 경고를 설정하는 것이 좋습니다. 자세한 내용은 Application Gateway 높은 트래픽 지원을 참조하세요.",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "용량 메트릭 모니터링",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "Application Gateway 또는 백 엔드에서 문제를 나타낼 수 있는 다른 메트릭이 있습니다. - 비정상 호스트 수- 응답 상태(차원 4xx 및 5xx)- 백 엔드 응답 상태(차원 4xx 및 5xx)- 백 엔드 마지막 바이트 응답 시간- Application Gateway 총 시간자세한 내용은 Application Gateway에 대한 메트릭을 참조하세요.",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "Azure Application Gateway",
- "text": "메트릭 사용 문제 해결",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "진단 로그를 사용하면 방화벽 로그, 성능 로그 및 액세스 로그를 볼 수 있습니다. 이러한 로그를 사용하여 Application Gateway 인스턴스와 관련된 문제를 관리하고 해결합니다. 자세한 내용은 Application Gateway에 대한 백 엔드 상태 및 진단 로그를 참조하세요.",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 및 WAF(Web Application Firewall)에서 진단 사용Enable diagnostics on Application Gateway and WAF(Web Application Firewall)",
- "type": "recommendation",
- "waf": "작업"
- },
- {
- "description": "Azure Monitor Network Insights는 Application Gateway를 포함한 네트워크 리소스의 상태 및 메트릭에 대한 포괄적인 보기를 제공합니다. Application Gateway에 대한 추가 세부 정보 및 지원되는 기능은 Azure Monitor 네트워크 인사이트를 참조하세요.",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "description": "사용량이 증가하는 시점을 알 수 있도록 메트릭이 임계값을 초과할 때 경고를 설정합니다. 이 접근 방식을 사용하면 워크로드에 필요한 변경 사항을 구현할 수 있는 충분한 시간을 확보하고 성능 저하 또는 중단을 방지할 수 있습니다.",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "Azure Application Gateway",
- "text": "Azure Monitor Network Insights 사용",
+ "text": "CPU 사용량 및 컴퓨팅 단위 사용량과 같은 용량 메트릭이 권장 임계값을 초과할 때 팀에 알리도록 경고를 구성합니다. 용량 메트릭을 기반으로 포괄적인 경고 집합을 구성하려면 Application Gateway 높은 트래픽 지원을 참조하세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "백 엔드 애플리케이션의 리스너 및 트래픽 특성과 일치하도록 IdleTimeout 설정을 구성했는지 확인합니다. 기본값은 4분으로 설정되며 최대 30분으로 구성할 수 있습니다. 자세한 내용은 Load Balancer TCP 재설정 및 유휴 시간 제한을 참조하세요.워크로드 고려 사항은 안정성을 위한 애플리케이션 상태 모니터링을 참조하세요.",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "경고를 사용하면 팀이 적시에 문제에 대응하고 문제 해결을 용이하게 할 수 있습니다.",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "Azure Application Gateway",
- "text": "백 엔드 애플리케이션과 시간 제한 설정 일치Match timeout settings with the backend application",
+ "text": "Application Gateway 또는 백 엔드에서 문제를 나타내는 메트릭에 대해 팀에 알리도록 경고를 구성합니다. - 비정상 호스트 수 - 응답 상태(예: 4xx 및 5xx 오류) - 백 엔드 응답 상태(예: 4xx 및 5xx 오류) - 백 엔드 마지막 바이트 응답 시간 - Application Gateway 총 시간자세한 내용은 Application Gateway에 대한 메트릭을 참조하세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "Application Gateway는 4시간 간격으로 연결된 Key Vault에서 갱신된 인증서 버전을 확인합니다. 잘못된 Key Vault 구성으로 인해 액세스할 수 없는 경우 해당 오류를 기록하고 해당 Advisor 권장 사항을 푸시합니다. 제어 또는 데이터 플레인 관련 문제를 방지하기 위해 최신 상태를 유지하고 이러한 문제를 즉시 해결하도록 Advisor 경고를 구성해야 합니다. 자세한 내용은 키 자격 증명 모음 오류 조사 및 해결을 참조하세요. 이 특정 사례에 대한 경고를 설정하려면 Application Gateway에 대한 Azure Key Vault 문제 해결로 권장 사항 유형을 사용합니다.",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "description": "로그를 사용하여 Application Gateway 인스턴스 및 워크로드와 관련된 문제를 감지, 조사 및 해결할 수 있습니다.",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "Azure Application Gateway",
- "text": "Azure Advisor를 사용하여 Key Vault 구성 문제 모니터링",
+ "text": "Application Gateway 및 WAF에서 진단 로그를 사용하도록 설정하여 방화벽 로그, 성능 로그 및 액세스 로그를 수집합니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "SNAT 포트 제한은 Application Gateway의 백 엔드 연결에 중요합니다. Application Gateway가 SNAT 포트 제한에 도달하는 방법에 영향을 주는 별도의 요소가 있습니다. 예를 들어 백 엔드가 공용 IP 주소인 경우 자체 SNAT 포트가 필요합니다. SNAT 포트 제한을 피하기 위해 Application Gateway당 인스턴스 수를 늘리거나, 백 엔드를 스케일 아웃하여 더 많은 IP 주소를 갖도록 하거나, 백 엔드를 동일한 가상 네트워크로 이동하고 백 엔드에 개인 IP 주소를 사용할 수 있습니다. SNAT 포트 제한에 도달하면 Application Gateway의 RPS(초당 요청 수)가 영향을 받습니다. 예를 들어 Application Gateway가 SNAT 포트 제한에 도달하면 백 엔드에 대한 새 연결을 열 수 없으며 요청이 실패합니다.",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "Advisor 경고를 사용하여 최신 상태를 유지하고 문제를 즉시 해결합니다. 컨트롤 플레인 또는 데이터 플레인 관련 문제를 방지합니다. Application Gateway는 4시간마다 연결된 Key Vault 인스턴스에서 갱신된 인증서 버전을 확인합니다. 잘못된 Key Vault 구성으로 인해 인증서 버전에 액세스할 수 없는 경우 해당 오류를 기록하고 해당 Advisor 권장 사항을 푸시합니다.",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "Azure Application Gateway",
- "text": "디자인에서 SNAT 포트 제한 사항 고려",
+ "text": "Advisor를 사용하여 Key Vault 구성 문제를 모니터링합니다. Application Gateway에 대한 Azure Key Vault 문제 해결이라는 권장 사항을 받을 때 팀에 알리도록 경고를 설정합니다.",
"type": "recommendation",
"waf": "작업"
},
{
"description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
- "service": "Azure Application Gateway",
- "text": "Application Gateway 인스턴스 수 예상",
- "type": "checklist",
- "waf": "공연"
- },
- {
- "description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "최대 인스턴스 수를 정의합니다",
- "type": "checklist",
- "waf": "공연"
- },
- {
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "최소 인스턴스 수를 정의합니다",
- "type": "checklist",
- "waf": "공연"
- },
- {
- "description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷 크기 정의",
+ "text": "워크로드 요구 사항을 지원하기 위해 Application Gateway에 대한 용량 요구 사항을 예측합니다. Application Gateway v2의 자동 크기 조정 기능을 활용하세요. 최소 및 최대 인스턴스 수에 적합한 값을 설정합니다. Application Gateway에 필요한 전용 서브넷의 크기를 적절하게 조정합니다. 자세한 내용은 용량 계획에 대한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "공연"
},
{
"description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "Azure Application Gateway",
- "text": "Application Gateway V2 기능을 활용하여 자동 크기 조정 및 성능 향상",
+ "text": "자동 크기 조정 및 성능 이점을 위한 기능을 활용하세요. v2 SKU는 트래픽이 증가함에 따라 Application Gateway를 스케일 업하는 자동 크기 조정을 제공합니다. v1 SKU에 비해 v2 SKU에는 워크로드의 성능을 향상시키는 기능이 있습니다. 예를 들어 v2 SKU는 더 나은 TLS 오프로드 성능, 더 빠른 배포 및 업데이트 시간, 영역 중복 지원을 제공합니다. 자세한 내용은 Application Gateway v2 및 WAF v2 크기 조정을 참조하세요.",
"type": "checklist",
"waf": "공연"
},
{
- "description": "Application Gateway v2 SKU의 경우 추가 인스턴스 집합이 트래픽을 처리할 준비가 되기까지 자동 크기 조정에 약간의 시간(약 6-7분)이 걸립니다. 이 기간 동안 트래픽이 잠시 급증하는 경우 일시적인 대기 시간 또는 트래픽 손실이 예상됩니다. 최소 인스턴스 수를 최적의 수준으로 설정하는 것이 좋습니다. 평균 인스턴스 수를 예측하고 Application Gateway 자동 크기 조정 추세를 확인한 후 애플리케이션 패턴에 따라 최소 인스턴스 수를 정의합니다. 자세한 내용은 Application Gateway 높은 트래픽 지원을 참조하세요. 지난 1개월 동안의 현재 컴퓨팅 단위를 확인합니다. 이 메트릭은 게이트웨이의 CPU 사용률을 나타냅니다. 최소 인스턴스 수를 정의하려면 최대 사용량을 10으로 나눕니다. 예를 들어 지난 달의 평균 Current Compute 단위가 50인 경우 최소 인스턴스 수를 5로 설정합니다.",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "최소 인스턴스 수를 정의합니다",
- "type": "recommendation",
- "waf": "공연"
- },
- {
- "description": "최대 자동 크기 조정 인스턴스 수로 125를 사용하는 것이 좋습니다. Application Gateway가 있는 서브넷에 스케일 업 인스턴스 집합을 지원할 수 있는 충분한 사용 가능한 IP 주소가 있는지 확인합니다. 최대 인스턴스 수를 125로 설정하면 사용된 용량에 대해서만 요금이 청구되므로 비용에는 영향을 주지 않습니다.",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
+ "description": "Application Gateway v2의 경우 추가 인스턴스 집합이 트래픽을 처리할 준비가 되기까지 약 6-7분 정도 걸립니다. 이 시간 동안 Application Gateway의 트래픽이 짧게 급증하는 경우 일시적인 대기 시간 또는 트래픽 손실이 예상됩니다.",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "Azure Application Gateway",
- "text": "최대 인스턴스 수를 정의합니다",
+ "text": "최소 인스턴스 수를 예상 인스턴스 수, 실제 Application Gateway 자동 크기 조정 추세 및 애플리케이션 패턴에 따라 최적의 수준으로 설정합니다. 지난 달의 현재 컴퓨팅 단위를 확인합니다. 이 메트릭은 게이트웨이의 CPU 사용량을 나타냅니다. 최소 인스턴스 수를 정의하려면 최대 사용량을 10으로 나눕니다. 예를 들어 지난 달의 평균 현재 컴퓨팅 단위가 50인 경우 최소 인스턴스 수를 5로 설정합니다.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "Application Gateway에는 가상 네트워크 내의 전용 서브넷이 필요합니다. 서브넷에는 배포된 Application Gateway 리소스의 여러 인스턴스가 있을 수 있습니다. 해당 서브넷, v1 또는 v2 SKU에 다른 Application Gateway 리소스를 배포할 수도 있습니다. 서브넷 크기를 정의하기 위한 몇 가지 고려 사항은 다음과 같습니다.- Application Gateway는 인스턴스당 하나의 개인 IP 주소를 사용하고, 개인 프런트 엔드 IP가 구성된 경우 다른 개인 IP 주소를 사용합니다.- Azure는 내부 사용을 위해 각 서브넷에서 5개의 IP 주소를 예약합니다.- Application Gateway(표준 또는 WAF SKU)는 최대 32개의 인스턴스를 지원할 수 있습니다. 인스턴스 IP 주소 32개 + 프라이빗 프런트 엔드 IP 1개 + Azure 예약 5개를 사용하는 경우 최소 서브넷 크기는 /26이 권장됩니다. Standard_v2 또는 WAF_v2 SKU는 최대 125개의 인스턴스를 지원할 수 있으므로 동일한 계산을 사용하여 서브넷 크기 /24를 사용하는 것이 좋습니다.- 동일한 서브넷에 추가 Application Gateway 리소스를 배포하려는 경우 표준 및 표준 v2 모두의 최대 인스턴스 수에 필요한 추가 IP 주소를 고려합니다.",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "Application Gateway는 애플리케이션에 대한 증가된 트래픽을 처리하기 위해 필요에 따라 확장할 수 있습니다. 이 설정은 사용된 용량에 대해서만 비용을 지불하기 때문에 비용을 증가시키지 않습니다.",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "Azure Application Gateway",
- "text": "Application Gateway 서브넷 크기 정의",
+ "text": "최대 자동 크기 조정 인스턴스 수를 가능한 최대값(125개 인스턴스)으로 설정합니다. Application Gateway 전용 서브넷에 증가된 인스턴스 집합을 지원할 수 있는 충분한 사용 가능한 IP 주소가 있는지 확인합니다.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "v2 SKU는 트래픽이 증가함에 따라 Application Gateway를 확장할 수 있도록 자동 크기 조정을 제공합니다. v1 SKU와 비교할 때 v2에는 워크로드의 성능을 향상시키는 기능이 있습니다. 예를 들어 TLS 오프로드 성능 향상, 배포 및 업데이트 시간 단축, 영역 중복성 등이 있습니다. 자동 크기 조정 기능에 대한 자세한 내용은 Application Gateway v2 및 WAF v2 크기 조정을 참조하세요. v1 SKU Application gateway를 실행하는 경우 Application gateway v2 SKU로 마이그레이션하는 것이 좋습니다. 자세한 내용은 Azure Application Gateway 및 Web Application Firewall v1에서 v2로 마이그레이션을 참조하세요.",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
+ "description": "/24 서브넷을 사용하여 Application Gateway v2 배포에 필요한 모든 IP 주소에 대한 지원을 제공합니다. Application Gateway는 개인 프런트 엔드 IP를 구성하는 경우 각 인스턴스에 대해 하나의 개인 IP 주소와 다른 개인 IP 주소를 사용합니다. Standard_v2 또는 WAF_v2 SKU는 최대 125개의 인스턴스를 지원할 수 있습니다. Azure는 내부 사용을 위해 각 서브넷에서 5개의 IP 주소를 예약합니다.",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "Azure Application Gateway",
- "text": "자동 크기 조정 및 성능 이점을 위한 기능 활용",
+ "text": "Application Gateway 전용 서브넷의 크기를 적절하게 조정합니다. Application Gateway v2 배포에는 /24 서브넷을 사용하는 것이 좋습니다. 동일한 서브넷에 다른 Application Gateway 리소스를 배포하려는 경우 최대 인스턴스 수에 필요한 추가 IP 주소를 고려합니다. 서브넷 크기 조정에 대한 자세한 고려 사항은 Application Gateway 인프라 구성을 참조하세요.",
"type": "recommendation",
"waf": "공연"
},
@@ -966,7 +814,7 @@
"description": "",
"guid": "d68b4fc0-fd9c-499a-9fd4-2c572735bd36",
"service": "Azure Blob Storage",
- "text": "오류 모드 분석 사용: 가상 네트워크, Azure Key Vault 또는 Azure Content Delivery Network 또는 Azure Front Door 엔드포인트의 가용성과 같은 내부 종속성을 고려하여 실패 지점을 최소화합니다. 워크로드에서 Blob Storage에 액세스하는 데 필요한 자격 증명이 Key Vault에서 누락되거나 워크로드가 제거된 콘텐츠 배달 네트워크를 기반으로 엔드포인트를 사용하는 경우 오류가 발생할 수 있습니다. 이러한 경우 워크로드는 대체 엔드포인트를 사용하여 연결해야 할 수 있습니다. 고장 모드 분석에 대한 일반적인 내용은 고장 모드 분석을 수행하기 위한 권장 사항을 참조하십시오.",
+ "text": "오류 모드 분석 사용: 가상 네트워크, Azure Key Vault 또는 Azure Content Delivery Network 또는 Azure Front Door 엔드포인트의 가용성과 같은 내부 종속성을 고려하여 실패 지점을 최소화합니다. 워크로드에서 Blob Storage에 액세스하는 데 필요한 자격 증명이 Key Vault에서 누락되거나 워크로드가 제거된 콘텐츠 배달 네트워크를 기반으로 하는 엔드포인트를 사용하는 경우 오류가 발생할 수 있습니다. 이러한 경우 워크로드는 대체 엔드포인트를 사용하여 연결해야 할 수 있습니다. 고장 모드 분석에 대한 일반적인 내용은 고장 모드 분석을 수행하기 위한 권장 사항을 참조하십시오.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -974,7 +822,7 @@
"description": "",
"guid": "817f9103-607a-4e3d-ba94-1a3adffaff8f",
"service": "Azure Blob Storage",
- "text": "안정성 및 복구 목표 정의: Azure SLA(서비스 수준 계약)를 검토합니다. 스토리지 계정에 대한 SLO(서비스 수준 목표)를 파생합니다. 예를 들어, SLO는 선택한 이중화 구성의 영향을 받을 수 있습니다. 지역 중단의 영향, 데이터 손실 가능성 및 중단 후 액세스를 복원하는 데 필요한 시간을 고려합니다. 또한 고장 모드 분석의 일부로 식별한 내부 종속성의 가용성을 고려합니다.",
+ "text": "안정성 및 복구 대상 정의: Azure SLA(서비스 수준 계약)를 검토합니다. 스토리지 계정에 대한 SLO(서비스 수준 목표)를 파생합니다. 예를 들어, SLO는 선택한 이중화 구성의 영향을 받을 수 있습니다. 지역 중단의 영향, 데이터 손실 가능성 및 중단 후 액세스를 복원하는 데 필요한 시간을 고려합니다. 또한 고장 모드 분석의 일부로 식별한 내부 종속성의 가용성을 고려합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -990,7 +838,7 @@
"description": "",
"guid": "e71dbbd7-5e50-4ade-b5e5-4b9e59d10706",
"service": "Azure Blob Storage",
- "text": "응용 프로그램 설계: 어떤 이유로든 주 지역을 사용할 수 없게 되는 경우 보조 지역에서 데이터를 읽는 것으로 원활하게 전환하도록 응용 프로그램을 설계합니다. 이는 GRS(지역 중복 스토리지) 및 GZRS(지역 영역 중복 스토리지) 구성에만 적용됩니다. 가동 중단을 처리하도록 애플리케이션을 설계하면 최종 사용자의 가동 중지 시간을 줄일 수 있습니다.",
+ "text": "응용 프로그램 설계: 어떤 이유로든 주 지역을 사용할 수 없게 되는 경우 보조 지역에서 데이터를 읽도록 원활하게 전환하도록 응용 프로그램을 설계합니다. 이는 GRS(지역 중복 스토리지) 및 GZRS(지역 영역 중복 스토리지) 구성에만 적용됩니다. 가동 중단을 처리하도록 애플리케이션을 설계하면 최종 사용자의 가동 중지 시간을 줄일 수 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1006,7 +854,7 @@
"description": "",
"guid": "3a9677e5-9506-4aaa-bac6-48b5002070c1",
"service": "Azure Blob Storage",
- "text": "복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업 또는 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치(failover)에 소요되는 시간과 비용에 대비합니다. 자세한 내용은 재해 복구 전략 설계를 위한 권장 사항을 참조하세요.",
+ "text": "복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업 또는 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치에 소요되는 시간 및 비용에 대비합니다. 자세한 내용은 재해 복구 전략 설계를 위한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1014,12 +862,12 @@
"description": "",
"guid": "ffdb383d-6a9a-4ebb-b902-12320390dd84",
"service": "Azure Blob Storage",
- "text": "잠재적인 가용성 문제 모니터링: Azure Service Health 대시보드를 구독하여 잠재적인 가용성 문제를 모니터링합니다. Azure Monitor 및 진단 로그의 스토리지 메트릭을 사용하여 경고를 조사합니다.",
+ "text": "잠재적 가용성 문제 모니터링: Azure Service Health 대시보드를 구독하여 잠재적인 가용성 문제를 모니터링합니다. Azure Monitor 및 진단 로그의 스토리지 메트릭을 사용하여 경고를 조사합니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
- "description": "이중화는 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 서로 다른 가용성 영역에 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
+ "description": "중복성은 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 서로 다른 가용성 영역에 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
"guid": "e426149f-841f-4865-878e-311cfe914db9",
"service": "Azure Blob Storage",
"text": "중복을 위해 계정을 구성합니다. 최대 가용성 및 내구성을 위해 ZRS(영역 중복 스토리지) 또는 GZRS를 사용하여 계정을 구성합니다.",
@@ -1038,7 +886,7 @@
"description": "일시 삭제 옵션을 사용하면 스토리지 계정에서 삭제된 컨테이너 및 Blob을 복구할 수 있습니다. 버전 관리 옵션은 Blob에 대한 변경 내용을 자동으로 추적합니다. 이 옵션을 사용하면 Blob을 이전 상태로 복원할 수 있습니다. 특정 시점 복원 옵션을 사용하면 실수로 Blob이 삭제되거나 손상되는 것을 방지하고 블록 Blob 데이터를 이전 상태로 복원할 수 있습니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
"guid": "6ba14c6a-6f37-46a3-a2a8-e38373925d6f",
"service": "Azure Blob Storage",
- "text": "백업 및 복구 전략의 일환으로 컨테이너 일시 삭제, Blob 일시 삭제, 버전 관리 및 특정 시점 복원 옵션을 사용하도록 설정합니다.",
+ "text": "백업 및 복구 전략의 일부로 컨테이너 일시 삭제, Blob 일시 삭제, 버전 관리 및 특정 시점 복원 옵션을 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -1054,7 +902,7 @@
"description": "",
"guid": "54dc05f5-631d-41ac-8ad7-40a451e48efd",
"service": "Azure Blob Storage",
- "text": "네트워크 컨트롤을 사용하여 수신 및 송신 트래픽 제한: 스토리지 계정에 대한 모든 공용 트래픽을 사용하지 않도록 설정합니다. 계정 네트워크 컨트롤을 사용하여 사용자 및 응용 프로그램에 필요한 최소 수준의 액세스 권한을 부여합니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
+ "text": "네트워크 컨트롤을 사용하여 수신 및 송신 트래픽 제한: 스토리지 계정에 대한 모든 공용 트래픽을 사용하지 않도록 설정합니다. 계정 네트워크 컨트롤을 사용하여 사용자 및 애플리케이션에 필요한 최소 수준의 액세스 권한을 부여합니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -1078,7 +926,7 @@
"description": "",
"guid": "c2d96110-7950-4f81-8c41-34e1fa015631",
"service": "Azure Blob Storage",
- "text": "중요한 정보 보호: 계정 키 및 공유 액세스 서명 토큰과 같은 중요한 정보를 보호합니다. 이러한 형태의 권한 부여는 일반적으로 권장되지 않지만 안전하게 교체, 만료 및 저장해야 합니다.",
+ "text": "중요한 정보 보호: 계정 키 및 공유 액세스 서명 토큰과 같은 중요한 정보를 보호합니다. 이러한 형태의 권한 부여는 일반적으로 권장되지 않지만 안전하게 회전, 만료 및 저장해야 합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -1102,7 +950,7 @@
"description": "",
"guid": "80a10cbe-93f3-410a-b7ad-d7b5234add61",
"service": "Azure Blob Storage",
- "text": "위협 검색: Microsoft Defender for Storage를 사용하여 위협을 감지할 수 있습니다. 보안 경고는 활동에서 이상이 발생할 때 트리거됩니다. 경고는 의심스러운 활동에 대한 세부 정보와 위협을 조사하고 수정하는 방법에 대한 권장 사항이 포함된 이메일을 통해 구독 관리자에게 알립니다.",
+ "text": "위협 검색: Microsoft Defender for Storage를 사용하여 위협을 감지할 수 있습니다. 보안 경고는 활동의 변칙이 발생할 때 트리거됩니다. 경고는 의심스러운 활동에 대한 세부 정보와 위협을 조사하고 수정하는 방법에 대한 권장 사항이 포함된 이메일을 통해 구독 관리자에게 알립니다.",
"type": "checklist",
"waf": "안전"
},
@@ -1123,10 +971,10 @@
"waf": "안전"
},
{
- "description": "제로 액세스부터 시작한 다음 클라이언트 및 서비스에 필요한 가장 낮은 수준의 액세스 권한을 점진적으로 부여하여 공격자에게 불필요한 틈을 만들 위험을 최소화합니다.",
+ "description": "제로 액세스로 시작한 다음 클라이언트 및 서비스에 필요한 가장 낮은 수준의 액세스 권한을 점진적으로 부여하여 공격자에게 불필요한 구멍을 만들 위험을 최소화합니다.",
"guid": "1b8c4090-6b15-45e0-8833-ee5285ebd444",
"service": "Azure Blob Storage",
- "text": "스토리지 계정의 퍼블릭 엔드포인트에 대한 트래픽을 사용하지 않도록 설정합니다. Azure에서 실행되는 클라이언트에 대한 프라이빗 엔드포인트를 만듭니다. Azure 외부의 클라이언트 및 서비스가 스토리지 계정에 직접 액세스해야 하는 경우에만 퍼블릭 엔드포인트를 사용하도록 설정합니다. 특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다.",
+ "text": "스토리지 계정의 공용 엔드포인트에 대한 트래픽을 사용하지 않도록 설정합니다. Azure에서 실행되는 클라이언트에 대한 프라이빗 엔드포인트를 만듭니다. Azure 외부의 클라이언트 및 서비스가 스토리지 계정에 직접 액세스해야 하는 경우에만 퍼블릭 엔드포인트를 사용하도록 설정합니다. 특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -1155,10 +1003,10 @@
"waf": "안전"
},
{
- "description": "모범 사례는 공유 액세스 서명 토큰이 유출되는 것을 방지하고 누출이 발생할 경우 신속하게 복구하는 데 도움이 될 수 있습니다.",
+ "description": "모범 사례는 공유 액세스 서명 토큰이 유출되는 것을 방지하고 누수가 발생할 경우 신속하게 복구하는 데 도움이 될 수 있습니다.",
"guid": "e2163930-a35e-415f-bea3-a019e5c2a5c7",
"service": "Azure Blob Storage",
- "text": "공유 액세스 서명 토큰을 사용하지 않는 것이 좋습니다. Blob Storage 리소스에 대한 액세스를 보호하기 위해 공유 액세스 서명 토큰이 필요한지 여부를 평가합니다. 공유 액세스 서명을 만들어야 하는 경우 공유 액세스 서명 모범 사례 목록을 검토하고 배포하기 전에 검토하세요.",
+ "text": "공유 액세스 서명 토큰을 사용하지 않는 것이 좋습니다. Blob Storage 리소스에 대한 액세스를 보호하기 위해 공유 액세스 서명 토큰이 필요한지 여부를 평가합니다. 공유 액세스 서명을 만들어야 하는 경우 공유 액세스 서명을 만들고 배포하기 전에 이 공유 액세스 서명 모범 사례 목록을 검토하세요.",
"type": "recommendation",
"waf": "안전"
},
@@ -1182,7 +1030,7 @@
"description": "",
"guid": "6f7ce98b-ec2c-4535-9e6a-11c077c9bd3f",
"service": "Azure Blob Storage",
- "text": "청구서를 계산하는 데 사용되는 미터 식별: 미터는 계정에 저장된 데이터의 양(데이터 용량)과 데이터를 쓰고 읽기 위해 수행되는 작업의 수 및 유형을 추적하는 데 사용됩니다. Blob 인덱스 태그, Blob 인벤토리, 변경 피드 지원, 암호화 범위 및 SSH SFTP(파일 전송 프로토콜) 지원과 같은 선택적 기능의 사용과 관련된 미터도 있습니다. 자세한 내용은 Blob Storage에 대한 요금이 청구되는 방식을 참조하세요.",
+ "text": "청구서를 계산하는 데 사용되는 미터 식별: 미터는 계정에 저장된 데이터의 양(데이터 용량)과 데이터를 쓰고 읽기 위해 수행되는 작업의 수 및 유형을 추적하는 데 사용됩니다. Blob 인덱스 태그, Blob 인벤토리, 변경 피드 지원, 암호화 범위 및 SSH SFTP(파일 전송 프로토콜) 지원과 같은 선택적 기능 사용과 관련된 미터도 있습니다. 자세한 내용은 Blob Storage에 대한 요금이 청구되는 방법을 참조하세요.",
"type": "checklist",
"waf": "비용"
},
@@ -1190,7 +1038,7 @@
"description": "",
"guid": "0c2e2825-34c7-4ad5-ad21-a270b1b402c0",
"service": "Azure Blob Storage",
- "text": "각 미터의 가격 이해: 적절한 가격 책정 페이지를 사용하고 해당 페이지에서 적절한 설정을 적용해야 합니다. 자세한 내용은 각 미터의 단가 찾기를 참조하세요. 각 가격과 관련된 작업 수를 고려합니다. 예를 들어 쓰기 및 읽기 작업과 관련된 가격은 10,000개 작업에 적용됩니다. 개별 작업의 가격을 확인하려면 나열된 가격을 10,000으로 나눕니다.",
+ "text": "각 측정기의 가격 이해: 적절한 가격 책정 페이지를 사용하고 해당 페이지에서 적절한 설정을 적용해야 합니다. 자세한 내용은 각 미터의 단가 찾기를 참조하세요. 각 가격과 관련된 작업 수를 고려합니다. 예를 들어 쓰기 및 읽기 작업과 관련된 가격은 10,000개 작업에 적용됩니다. 개별 작업의 가격을 확인하려면 나열된 가격을 10,000으로 나눕니다.",
"type": "checklist",
"waf": "비용"
},
@@ -1230,7 +1078,7 @@
"description": "",
"guid": "fbf53f6f-f5af-47ef-8e28-e471bf173884",
"service": "Azure Blob Storage",
- "text": "가장 비용 효율적인 액세스 등급에 직접 데이터 업로드: 예를 들어 계정의 기본 액세스 등급 설정이 핫이지만 보관 목적으로 파일을 업로드하는 경우 쿨 등급을 보관 파일로 지정하거나 업로드 작업의 일부로 콜드 등급을 지정합니다. Blob을 업로드한 후 수명 주기 관리 정책을 사용하여 마지막으로 액세스한 시간과 같은 사용량 메트릭을 기반으로 Blob을 가장 비용 효율적인 계층으로 이동합니다. 가장 최적의 계층을 미리 선택하면 비용을 절감할 수 있습니다. 이미 업로드한 블록 Blob의 계층을 변경하는 경우 Blob을 처음 업로드할 때 초기 계층에 대한 쓰기 비용을 지불한 다음, 원하는 계층에 대한 쓰기 비용을 지불합니다.",
+ "text": "가장 비용 효율적인 액세스 계층에 직접 데이터 업로드: 예를 들어 계정의 기본 액세스 계층 설정이 핫이지만 보관 목적으로 파일을 업로드하는 경우 쿨 등급을 보관 파일로 지정하거나 업로드 작업의 일부로 콜드 등급을 지정합니다. Blob을 업로드한 후 수명 주기 관리 정책을 사용하여 마지막으로 액세스한 시간과 같은 사용량 메트릭에 따라 Blob을 가장 비용 효율적인 계층으로 이동합니다. 가장 최적의 계층을 미리 선택하면 비용을 절감할 수 있습니다. 이미 업로드한 블록 Blob의 계층을 변경하는 경우 Blob을 처음 업로드할 때 초기 계층에 대한 쓰기 비용을 지불한 다음 원하는 계층에 대한 쓰기 비용을 지불합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -1270,15 +1118,15 @@
"description": "",
"guid": "94b3fa52-a17f-44ec-b4ba-9801c2764632",
"service": "Azure Blob Storage",
- "text": "사용량 모니터링: 사용 패턴을 지속적으로 모니터링하고 사용되지 않거나 활용도가 낮은 계정 및 컨테이너를 감지합니다. Storage 인사이트를 사용하여 사용량이 없거나 적은 계정을 식별합니다. Blob 인벤토리 보고서를 사용하도록 설정하고 Azure Databricks 또는 Azure Synapse Analytics 및 Power BI와 같은 도구를 사용하여 비용 데이터를 분석합니다. 수많은 로그 파일, Blob 버전 또는 일시 삭제된 Blob을 수집하고 있음을 나타낼 수 있는 예기치 않은 용량 증가에 주의하세요. 만료되는 객체를 보다 비용 효율적인 액세스 계층으로 전환하기 위한 전략을 개발합니다. 객체가 만료되거나 객체를 더 저렴한 액세스 계층으로 이동하기 위한 계획을 세웁니다.",
+ "text": "사용량 모니터링: 사용 패턴을 지속적으로 모니터링하고 사용되지 않거나 활용도가 낮은 계정 및 컨테이너를 감지합니다. Storage 인사이트를 사용하여 사용량이 없거나 적은 계정을 식별합니다. Blob 인벤토리 보고서를 사용하도록 설정하고 Azure Databricks 또는 Azure Synapse Analytics 및 Power BI와 같은 도구를 사용하여 비용 데이터를 분석합니다. 수많은 로그 파일, Blob 버전 또는 일시 삭제된 Blob을 수집하고 있음을 나타낼 수 있는 예기치 않은 용량 증가에 주의하세요. 객체를 만료하거나 보다 비용 효율적인 액세스 계층으로 전환하기 위한 전략을 개발합니다. 객체가 만료되거나 객체를 보다 저렴한 액세스 계층으로 이동하기 위한 계획이 있습니다.",
"type": "checklist",
"waf": "비용"
},
{
- "description": "쿨 계층은 데이터 전송 비용이 더 높습니다. 더 적은 수의 큰 파일을 보유함으로써 데이터를 전송하는 데 필요한 작업 수를 줄일 수 있습니다.",
+ "description": "쿨 계층은 데이터 전송 비용이 더 높습니다. 더 적은 수의 큰 파일을 보유하면 데이터를 전송하는 데 필요한 작업 수를 줄일 수 있습니다.",
"guid": "7eb7a0d4-912b-4d5c-af98-31200e20cc63",
"service": "Azure Blob Storage",
- "text": "쿨 계층으로 이동하기 전에 작은 파일을 더 큰 파일로 압축합니다. TAR 또는 ZIP과 같은 파일 형식을 사용할 수 있습니다.",
+ "text": "쿨 계층으로 이동하기 전에 작은 파일을 큰 파일로 압축합니다. TAR 또는 ZIP과 같은 파일 형식을 사용할 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -1286,7 +1134,7 @@
"description": "보관 계층에서 우선 순위가 높은 리하이드레이션으로 인해 정상보다 높은 청구가 발생할 수 있습니다.",
"guid": "8d3e7da9-3091-4daf-8a07-37116d9e3f7e",
"service": "Azure Blob Storage",
- "text": "보관 스토리지에서 Blob을 리하이드레이션할 때 표준 우선 순위 리하이드레이션을 사용합니다. 우선 순위가 높은 리하이드레이션은 긴급 데이터 복원 상황에만 사용합니다. 자세한 내용은 보관된 Blob을 온라인 계층으로 리하이드레이션을 참조하세요.",
+ "text": "보관 스토리지에서 Blob을 리하이드레이션할 때 표준 우선 순위 리하이드레이션을 사용합니다. 응급 데이터 복원 상황에만 우선 순위가 높은 리하이드레이션을 사용합니다. 자세한 내용은 보관된 Blob을 온라인 계층으로 리하이드레이션을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -1294,7 +1142,7 @@
"description": "나중에 분석하기 위해 스토리지 계정에 리소스 로그를 저장하는 것이 더 저렴한 옵션일 수 있습니다. 수명 주기 관리 정책을 사용하여 스토리지 계정의 로그 보존을 관리하면 시간이 지남에 따라 많은 수의 로그 파일이 쌓이는 것을 방지할 수 있으며, 이로 인해 불필요한 용량 요금이 발생할 수 있습니다.",
"guid": "f29291b5-d170-453b-bdbb-379f229fdc5b",
"service": "Azure Blob Storage",
- "text": "적절한 로그 저장 위치를 선택하고 로그 보존 기간을 관리하여 리소스 로그 사용 비용을 줄입니다. 가끔씩만 로그를 쿼리하려는 경우(예: 규정 준수 감사를 위한 로그 쿼리) 리소스 로그를 Azure Monitor 로그 작업 영역으로 보내는 대신 스토리지 계정으로 보내는 것이 좋습니다. Azure Synapse Analytics와 같은 서버리스 쿼리 솔루션을 사용하여 로그를 분석할 수 있습니다. 자세한 내용은 자주 발생하지 않는 쿼리에 대한 비용 최적화를 참조하세요. 수명 주기 관리 정책을 사용하여 로그를 삭제하거나 보관합니다.",
+ "text": "적절한 로그 저장 위치를 선택하고 로그 보존 기간을 관리하여 리소스 로그 사용 비용을 줄입니다. 가끔씩만 로그를 쿼리하려는 경우(예: 규정 준수 감사를 위해 로그를 쿼리하는 경우) 리소스 로그를 Azure Monitor 로그 작업 영역으로 보내는 대신 스토리지 계정으로 보내는 것이 좋습니다. Azure Synapse Analytics와 같은 서버리스 쿼리 솔루션을 사용하여 로그를 분석할 수 있습니다. 자세한 내용은 자주 발생하지 않는 쿼리에 대한 비용 최적화를 참조하세요. 수명 주기 관리 정책을 사용하여 로그를 삭제하거나 보관합니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -1318,7 +1166,7 @@
"description": "Blob을 덮어쓸 때마다 새 스냅샷이 만들어집니다. 용량 요금 증가의 원인은 이러한 스냅샷의 생성이 로그에 표시되지 않기 때문에 액세스하기 어려울 수 있습니다. 용량 요금을 줄이려면 자주 덮어쓰는 데이터를 일시 삭제를 사용하지 않도록 설정된 별도의 스토리지 계정에 저장합니다. 보존 기간은 일시 삭제된 Blob이 쌓여 용량 비용에 추가되는 것을 방지합니다.",
"guid": "7041f493-74f4-42e8-bbd2-15602763dc40",
"service": "Azure Blob Storage",
- "text": "일시 삭제를 사용하도록 설정하는 경우 자주 덮어쓰는 Blob을 일시 삭제를 사용하도록 설정하지 않은 계정에 배치합니다. 보존 기간을 설정합니다. 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다.",
+ "text": "일시 삭제를 사용하도록 설정하는 경우 자주 덮어쓰는 Blob을 일시 삭제를 사용하도록 설정되지 않은 계정에 배치합니다. 보존 기간을 설정합니다. 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -1342,7 +1190,7 @@
"description": "",
"guid": "ab85e732-c3b0-47d2-ae0c-fa0ccf3ee4d1",
"service": "Azure Blob Storage",
- "text": "유지 관리 및 응급 복구 계획 생성: 데이터 보호 기능, 백업 및 복원 작업, 장애 조치 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치(failover)에 소요되는 시간과 비용에 대비합니다.",
+ "text": "유지 관리 및 응급 복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업, 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치에 소요되는 시간 및 비용에 대비합니다.",
"type": "checklist",
"waf": "작업"
},
@@ -1350,7 +1198,7 @@
"description": "",
"guid": "bdd60136-85dd-45cc-ac07-37d69124d9ab",
"service": "Azure Blob Storage",
- "text": "스토리지 계정의 상태 모니터링: 스토리지 인사이트 대시보드를 만들어 가용성, 성능 및 복원력 메트릭을 모니터링합니다. 고객이 알아차리기 전에 시스템의 문제를 식별하고 해결할 수 있도록 경고를 설정합니다. 진단 설정을 사용하여 리소스 로그를 Azure Monitor 로그 작업 영역으로 라우팅합니다. 그런 다음 로그를 쿼리하여 경고를 더 자세히 조사할 수 있습니다.",
+ "text": "스토리지 계정의 상태 모니터링: 스토리지 인사이트 대시보드를 만들어 가용성, 성능 및 복원력 메트릭을 모니터링합니다. 고객이 알아차리기 전에 시스템의 문제를 식별하고 해결할 수 있도록 경고를 설정합니다. 진단 설정을 사용하여 리소스 로그를 Azure Monitor 로그 작업 영역으로 라우팅합니다. 그런 다음 로그를 쿼리하여 경고를 보다 심층적으로 조사할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -1358,7 +1206,7 @@
"description": "",
"guid": "b842f2e7-9ac7-4d2e-9c9a-a3fb2ddc2441",
"service": "Azure Blob Storage",
- "text": "Blob 인벤토리 보고서 사용: Blob 인벤토리 보고서를 사용하도록 설정하여 스토리지 계정 콘텐츠의 보존, 법적 보존 또는 암호화 상태를 검토할 수 있습니다. 또한 Blob 인벤토리 보고서를 사용하여 총 데이터 크기, 사용 기간, 계층 분포 또는 데이터의 기타 특성을 이해할 수 있습니다. Azure Databricks 또는 Azure Synapse Analytics 및 Power BI와 같은 도구를 사용하여 재고 데이터를 더 잘 시각화하고 이해 관계자를 위한 보고서를 만듭니다.",
+ "text": "Blob 인벤토리 보고서 사용: Blob 인벤토리 보고서를 사용하도록 설정하여 스토리지 계정 콘텐츠의 보존, 법적 보존 또는 암호화 상태를 검토할 수 있습니다. Blob 인벤토리 보고서를 사용하여 총 데이터 크기, 사용 기간, 계층 분포 또는 기타 데이터 특성을 이해할 수도 있습니다. Azure Databricks 또는 Azure Synapse Analytics 및 Power BI와 같은 도구를 사용하여 인벤토리 데이터를 더 잘 시각화하고 이해 관계자를 위한 보고서를 만듭니다.",
"type": "checklist",
"waf": "작업"
},
@@ -1366,7 +1214,7 @@
"description": "",
"guid": "b54e930b-e9fe-4b7b-adc2-b0f0d0b0f05c",
"service": "Azure Blob Storage",
- "text": "Blob을 삭제하거나 비용 효율적인 액세스 계층으로 이동하는 정책 설정: 초기 조건 집합을 사용하여 수명 주기 관리 정책을 만듭니다. 정책 실행은 사용자가 정의한 조건에 따라 Blob의 액세스 계층을 자동으로 삭제하거나 설정합니다. 모니터 메트릭 및 Blob 인벤토리 보고서를 사용하여 컨테이너 사용을 주기적으로 분석하여 비용 효율성을 최적화하기 위한 조건을 구체화할 수 있습니다.",
+ "text": "Blob을 삭제하거나 비용 효율적인 액세스 계층으로 이동하는 정책 설정: 초기 조건 집합을 사용하여 수명 주기 관리 정책을 만듭니다. 정책 실행은 정의한 조건에 따라 Blob의 액세스 계층을 자동으로 삭제하거나 설정합니다. 모니터 메트릭 및 Blob 인벤토리 보고서를 사용하여 컨테이너 사용을 주기적으로 분석하여 비용 효율성을 최적화하기 위해 조건을 구체화할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -1379,7 +1227,7 @@
"waf": "작업"
},
{
- "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드와 보고서를 쉽게 만들 수 있습니다.",
+ "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드 및 보고서를 쉽게 만들 수 있습니다.",
"guid": "9475eb5c-afb9-446a-bcb1-85ecc26112a9",
"service": "Azure Blob Storage",
"text": "Storage 인사이트를 사용하여 스토리지 계정의 상태와 성능을 추적합니다. Storage 인사이트는 모든 스토리지 계정에 대한 오류, 성능, 가용성 및 용량에 대한 통합 보기를 제공합니다.",
@@ -1390,7 +1238,7 @@
"description": "",
"guid": "61755535-55a0-4064-8537-e9cdf07e1baa",
"service": "Azure Blob Storage",
- "text": "크기 조정 계획: 스토리지 계정에 대한 크기 조정 목표를 이해합니다.",
+ "text": "크기 조정 계획: 스토리지 계정의 크기 조정 목표를 이해합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -1398,7 +1246,7 @@
"description": "",
"guid": "bd64ef47-64e7-4c7e-b19f-ccfd451083e0",
"service": "Azure Blob Storage",
- "text": "최적의 스토리지 계정 유형 선택: 워크로드에 높은 트랜잭션 속도, 더 작은 개체 및 일관되게 낮은 트랜잭션 대기 시간이 필요한 경우 프리미엄 블록 Blob 스토리지 계정을 사용하는 것이 좋습니다. 대부분의 경우 표준 범용 v2 계정이 가장 적합합니다.",
+ "text": "최적의 스토리지 계정 유형 선택: 워크로드에 높은 트랜잭션 속도, 더 작은 개체 및 일관되게 낮은 트랜잭션 대기 시간이 필요한 경우 프리미엄 블록 Blob Storage 계정을 사용하는 것이 좋습니다. 대부분의 경우 표준 범용 v2 계정이 가장 적합합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -1406,7 +1254,7 @@
"description": "",
"guid": "b21b6a75-b065-43f1-8298-5778460e2ba0",
"service": "Azure Blob Storage",
- "text": "클라이언트와 서버 간의 이동 거리 줄이기: 연결 클라이언트에 가장 가까운 지역(이상적으로는 동일한 지역)에 데이터를 배치합니다. 개체 복제 또는 콘텐츠 배달 네트워크를 사용하여 멀리 떨어진 지역에 있는 클라이언트에 대해 최적화합니다. 기본 네트워크 구성은 최상의 성능을 제공합니다. 보안을 강화하기 위해서만 네트워크 설정을 수정하십시오. 일반적으로 네트워크 설정은 이동 거리를 줄이지 않으며 성능을 향상시키지 않습니다.",
+ "text": "클라이언트와 서버 간의 이동 거리 줄이기: 연결 클라이언트에 가장 가까운 지역(이상적으로는 동일한 지역)에 데이터를 배치합니다. 개체 복제 또는 콘텐츠 배달 네트워크를 사용하여 멀리 떨어진 지역의 클라이언트에 대해 최적화합니다. 기본 네트워크 구성은 최상의 성능을 제공합니다. 보안을 강화하기 위해서만 네트워크 설정을 수정하십시오. 일반적으로 네트워크 설정은 이동 거리를 줄이지 않으며 성능을 향상시키지 않습니다.",
"type": "checklist",
"waf": "공연"
},
@@ -1414,7 +1262,7 @@
"description": "",
"guid": "ef4063df-4ac9-4e8b-9391-cf99ea520f3a",
"service": "Azure Blob Storage",
- "text": "효율적인 명명 체계 선택: Blob 파티션 키(계정, 컨테이너, 가상 디렉터리 또는 Blob 이름)의 시작 부분에 가장 가까운 해시 태그 접두사를 사용하여 나열, 나열, 쿼리 및 읽기 작업의 대기 시간을 줄입니다. 이 체계는 대부분 플랫 네임스페이스가 있는 계정에 이점을 제공합니다.",
+ "text": "효율적인 명명 체계 선택: Blob 파티션 키(계정, 컨테이너, 가상 디렉터리 또는 Blob 이름)의 시작 부분에 가장 가까운 해시 태그 접두사를 사용하여 나열, 나열, 쿼리 및 읽기 작업의 대기 시간을 줄입니다. 이 체계는 주로 플랫 네임스페이스가 있는 계정에 이점을 제공합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -1438,12 +1286,12 @@
"description": "",
"guid": "0b2ed074-7dcb-460a-8455-144171d2fe8f",
"service": "Azure Blob Storage",
- "text": "성능 데이터 수집: 스토리지 계정을 모니터링하여 제한으로 인해 발생하는 성능 병목 현상을 식별합니다. 자세한 내용은 Monitor Storage insights를 사용하여 스토리지 서비스 모니터링을 참조하세요. 메트릭과 로그를 모두 사용합니다. 메트릭은 제한 오류와 같은 숫자를 제공합니다. 로그는 활동을 설명합니다. 제한 메트릭이 표시되면 로그를 사용하여 제한 오류를 수신하는 클라이언트를 식별할 수 있습니다. 자세한 내용은 데이터 플레인 작업 감사를 참조하세요.",
+ "text": "성능 데이터 수집: 스토리지 계정을 모니터링하여 제한으로 인해 발생하는 성능 병목 현상을 식별합니다. 자세한 내용은 Monitor Storage insights를 사용하여 스토리지 서비스 모니터링을 참조하세요. 메트릭과 로그를 모두 사용합니다. 메트릭은 제한 오류와 같은 숫자를 제공합니다. 로그는 활동을 설명합니다. 제한 메트릭이 표시되면 로그를 사용하여 제한 오류를 받는 클라이언트를 식별할 수 있습니다. 자세한 내용은 데이터 플레인 작업 감사를 참조하세요.",
"type": "checklist",
"waf": "공연"
},
{
- "description": "스토리지 계정과 VM, 서비스 및 온-프레미스 클라이언트 간의 물리적 거리를 줄이면 성능이 향상되고 네트워크 대기 시간이 줄어들 수 있습니다. 물리적 거리를 줄이면 단일 지역 내의 대역폭 사용량이 무료이기 때문에 Azure에서 호스트되는 애플리케이션의 비용도 절감됩니다.",
+ "description": "스토리지 계정과 VM, 서비스 및 온-프레미스 클라이언트 간의 물리적 거리를 줄이면 성능이 향상되고 네트워크 대기 시간이 줄어들 수 있습니다. 물리적 거리를 줄이면 단일 지역 내의 대역폭 사용량이 무료이기 때문에 Azure에서 호스팅되는 애플리케이션의 비용도 절감됩니다.",
"guid": "1a37ef87-aa18-44a6-9877-6665fb1dc486",
"service": "Azure Blob Storage",
"text": "종속 리소스가 배치된 동일한 지역에 저장소 계정을 프로비전합니다. 모바일 디바이스 앱 또는 온-프레미스 엔터프라이즈 서비스와 같이 Azure에서 호스트되지 않는 애플리케이션의 경우 해당 클라이언트에 더 가까운 지역에서 스토리지 계정을 찾습니다. 자세한 내용은 Azure 지역을 참조하세요. 다른 지역의 클라이언트에 동일한 데이터가 필요하지 않은 경우 각 지역에서 별도의 계정을 만듭니다. 다른 지역의 클라이언트에 일부 데이터만 필요한 경우 개체 복제 정책을 사용하여 관련 개체를 다른 지역의 스토리지 계정에 비동기적으로 복사하는 것이 좋습니다.",
@@ -1451,7 +1299,7 @@
"waf": "공연"
},
{
- "description": "콘텐츠는 전 세계 수백 개의 글로벌 및 로컬 접속 지점과 함께 Microsoft 글로벌 에지 네트워크를 사용하기 때문에 클라이언트에게 더 빠르게 배달됩니다.",
+ "description": "콘텐츠는 전 세계 수백 개의 글로벌 및 로컬 접속 지점이 있는 Microsoft 글로벌 에지 네트워크를 사용하기 때문에 클라이언트에게 더 빠르게 제공됩니다.",
"guid": "7ee0dea0-804f-457c-9660-1fe756011d25",
"service": "Azure Blob Storage",
"text": "웹 클라이언트(스트리밍 비디오, 오디오 또는 정적 웹 사이트 콘텐츠)에서 광범위하게 사용하려면 Azure Front Door를 통해 콘텐츠 배달 네트워크를 사용하는 것이 좋습니다.",
@@ -1462,7 +1310,7 @@
"description": "파티션 키의 시작 부분에 가장 가까운 해시 코드 또는 초 값을 사용하면 Blob을 나열, 쿼리 및 읽는 데 필요한 시간이 줄어듭니다.",
"guid": "36fc9ddc-5d24-4ecc-a67e-3fd7bc0c4373",
"service": "Azure Blob Storage",
- "text": "Blob의 파티션 키에 가능한 한 빨리 해시 문자 시퀀스(예: 3자리 숫자)를 추가합니다. 파티션 키는 계정 이름, 컨테이너 이름, 가상 디렉터리 이름 및 Blob 이름입니다. 이름에 타임스탬프를 사용하려는 경우 해당 스탬프의 시작 부분에 초 값을 추가하는 것이 좋습니다. 자세한 내용은 Partitioning을 참조하십시오.",
+ "text": "가능한 한 빨리 Blob의 파티션 키에 해시 문자 시퀀스(예: 3자리 숫자)를 추가합니다. 파티션 키는 계정 이름, 컨테이너 이름, 가상 디렉터리 이름 및 Blob 이름입니다. 이름에 타임스탬프를 사용할 계획이라면 해당 스탬프의 시작 부분에 초 값을 추가하는 것이 좋습니다. 자세한 내용은 Partitioning을 참조하십시오.",
"type": "recommendation",
"waf": "공연"
},
@@ -1510,7 +1358,7 @@
"description": "",
"guid": "64ad6a67-7f17-4d55-a365-0ec8716fb135",
"service": "Azure Expressroute",
- "text": "다른 지역에서 ExpressRoute 가상 네트워크 게이트웨이를 구성합니다.",
+ "text": "다른 지역에서 ExpressRoute Virtual Network 게이트웨이를 구성합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1531,7 +1379,7 @@
"waf": "신뢰도"
},
{
- "description": "초기 계획 단계에서 ExpressRoute 회로를 구성할지 아니면 ExpressRoute Direct 연결을 구성할지 결정하려고 합니다. ExpressRoute 회로를 사용하면 연결 공급자의 도움을 받아 Azure에 대한 프라이빗 전용 연결을 사용할 수 있습니다. ExpressRoute Direct를 사용하면 피어링 위치의 Microsoft 네트워크로 온-프레미스 네트워크를 직접 확장할 수 있습니다. 또한 비즈니스 요구 사항에 대한 대역폭 요구 사항 및 SKU 유형 요구 사항을 식별해야 합니다.",
+ "description": "초기 계획 단계에서 ExpressRoute 회로를 구성할지 또는 ExpressRoute Direct 연결을 구성할지 결정하려고 합니다. ExpressRoute 회로를 사용하면 연결 공급자의 도움을 받아 Azure에 대한 프라이빗 전용 연결을 사용할 수 있습니다. ExpressRoute Direct를 사용하면 피어링 위치의 Microsoft 네트워크로 온-프레미스 네트워크를 직접 확장할 수 있습니다. 또한 비즈니스 요구 사항에 대한 대역폭 요구 사항 및 SKU 유형 요구 사항을 식별해야 합니다.",
"guid": "09e0dd1a-b1f7-46c3-8df1-48e841f53dca",
"service": "Azure Expressroute",
"text": "ExpressRoute 회로 또는 ExpressRoute Direct 계획",
@@ -1539,7 +1387,7 @@
"waf": "신뢰도"
},
{
- "description": "재해 복구를 계획하려면 둘 이상의 피어링 위치에서 ExpressRoute 회로를 설정합니다. 동일한 메트로 또는 다른 메트로의 피어링 위치에 회로를 만들고 각 회로를 통한 다양한 경로에 대해 다른 서비스 공급자와 협력하도록 선택할 수 있습니다. 자세한 내용은 재해 복구를 위한 설계 및 고가용성을 위한 설계를 참조하세요.",
+ "description": "재해 복구를 계획하려면 둘 이상의 피어링 위치에서 ExpressRoute 회로를 설정합니다. 동일한 메트로 또는 다른 메트로의 피어링 위치에 회로를 만들고 각 회로를 통한 다양한 경로에 대해 다른 서비스 공급자와 협력하도록 선택할 수 있습니다. 자세한 내용은 재해 복구를 위한 디자인 및 고가용성을 위한 디자인을 참조하세요.",
"guid": "257031a8-f034-436c-9f54-e82aab53c559",
"service": "Azure Expressroute",
"text": "지역 중복 회로 계획Plan for geo-redundant circuits",
@@ -1547,7 +1395,7 @@
"waf": "신뢰도"
},
{
- "description": "이 모드는 Expressroute 연결의 고가용성을 제공합니다. 또한 연결에 링크 오류가 있는 경우 더 빠른 장애 조치(failover)를 위해 BFD를 구성하는 것이 좋습니다.",
+ "description": "이 모드는 Expressroute 연결의 고가용성을 제공합니다. 또한 연결에 링크 장애가 있는 경우 더 빠른 장애 조치(failover)를 위해 BFD를 구성하는 것이 좋습니다.",
"guid": "068037d8-673f-4e86-bc9d-bf83fbe61d12",
"service": "Azure Expressroute",
"text": "액티브-액티브 연결 계획",
@@ -1555,7 +1403,7 @@
"waf": "신뢰도"
},
{
- "description": "복원력을 높이기 위해 가용성 영역 인식 Virtual Network Gateway를 만들고 복원력, 재해 복구 및 고가용성을 위해 여러 지역의 Virtual Network 게이트웨이를 계획합니다.",
+ "description": "복원력을 높이기 위해 가용성 영역 인식 Virtual Network Gateway를 만들고 복원력, 재해 복구 및 고가용성을 위해 다른 지역의 Virtual Network Gateway를 계획합니다.",
"guid": "21f65e89-ffe2-489f-89f2-16cbc2e257d9",
"service": "Azure Expressroute",
"text": "가상 네트워크 게이트웨이 계획",
@@ -1571,7 +1419,7 @@
"waf": "신뢰도"
},
{
- "description": "ExpressRoute는 서비스 상태를 사용하여 계획된 유지 관리 및 계획되지 않은 유지 관리에 대해 알립니다. 서비스 상태를 구성하면 ExpressRoute 회로에 대한 변경 내용에 대해 알려줍니다.",
+ "description": "ExpressRoute는 서비스 상태를 사용하여 계획된 유지 관리 및 계획되지 않은 유지 관리에 대해 알립니다. 서비스 상태를 구성하면 ExpressRoute 회로에 대한 변경 내용에 대해 알림을 받습니다.",
"guid": "c84ca8b2-74f8-4d25-8fc3-5b30c9969b5f",
"service": "Azure Expressroute",
"text": "서비스 상태 사용",
@@ -1622,7 +1470,7 @@
"description": "활동 로그는 ExpressRoute 리소스에 대한 구독 수준에서 수행된 작업에 대한 인사이트를 제공합니다. 활동 로그를 사용하면 컨트롤 플레인에서 작업이 수행된 사람과 시간을 확인할 수 있습니다. 데이터 보존 기간은 90일이며 Log Analytics, Event Hubs 또는 보관용 스토리지 계정에 저장해야 합니다.",
"guid": "9631d7ef-657c-4b07-9c75-96b2dcc5c5d2",
"service": "Azure Expressroute",
- "text": "로그를 보관으로 보내도록 활동 로그 구성",
+ "text": "로그를 보관하도록 활동 로그 구성",
"type": "recommendation",
"waf": "안전"
},
@@ -1643,7 +1491,7 @@
"waf": "안전"
},
{
- "description": "미디어 액세스 제어 보안은 데이터 링크 계층의 지점 간 보안입니다. ExpressRoute Direct는 이더넷 링크에서 일반적으로 보안되지 않는 ARP, DHCP, LACP와 같은 프로토콜에 대한 보안 위협을 방지하기 위해 MACSec 구성을 지원합니다. MACSec을 구성하는 방법에 대한 자세한 내용은 ExpressRoute Direct 포트에 대한 MACSec을 참조하세요.",
+ "description": "Media Access Control 보안은 데이터 링크 계층의 지점 간 보안입니다. ExpressRoute Direct는 이더넷 링크에서 일반적으로 보안되지 않는 ARP, DHCP, LACP와 같은 프로토콜에 대한 보안 위협을 방지하기 위해 MACSec 구성을 지원합니다. MACSec을 구성하는 방법에 대한 자세한 내용은 ExpressRoute Direct 포트에 대한 MACSec을 참조하세요.",
"guid": "d495a140-702d-4e08-bb86-7ceac8141df2",
"service": "Azure Expressroute",
"text": "ExpressRoute Direct 리소스에 대한 MACSec 구성",
@@ -1702,12 +1550,12 @@
"description": "ExpressRoute 가격 책정에 대한 자세한 내용은 Azure ExpressRoute의 가격 책정 이해를 참조하세요. 가격 계산기를 사용할 수도 있습니다. 용량 수요를 충족하고 리소스 낭비 없이 예상 성능을 제공할 수 있도록 옵션의 크기가 적절하게 조정되었는지 확인합니다.",
"guid": "f230ac81-7590-4300-9b9f-95d784e60ab2",
"service": "Azure Expressroute",
- "text": "ExpressRoute 가격 책정 숙지",
+ "text": "ExpressRoute 가격 책정에 대해 숙지하기",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "ExpressRoute 사용량에 대한 요금이 청구되는 방식은 세 가지 SKU 유형에 따라 다릅니다. 현지 SKU를 사용하면 무제한 데이터 요금제가 자동으로 청구됩니다. 표준 및 프리미엄 SKU를 사용하면 데이터 요금제 또는 무제한 요금제 중에서 선택할 수 있습니다. 모든 수신 데이터는 Global Reach 추가 기능을 사용하는 경우를 제외하고 무료입니다. 비용과 예산을 가장 잘 최적화하려면 워크로드에 가장 적합한 SKU 유형 및 데이터 요금제를 이해하는 것이 중요합니다. ExpressRoute 회로 크기 조정에 대한 자세한 내용은 ExpressRoute 회로 대역폭 업그레이드를 참조하세요.",
+ "description": "ExpressRoute 사용량에 대한 요금이 청구되는 방식은 세 가지 SKU 유형에 따라 다릅니다. 현지 SKU를 사용하면 무제한 데이터 요금제가 자동으로 청구됩니다. 표준 및 프리미엄 SKU를 사용하면 데이터 요금제 또는 무제한 요금제 중에서 선택할 수 있습니다. 모든 수신 데이터는 Global Reach 추가 기능을 사용하는 경우를 제외하고는 무료입니다. 비용과 예산을 가장 잘 최적화하려면 워크로드에 가장 적합한 SKU 유형 및 데이터 요금제를 이해하는 것이 중요합니다. ExpressRoute 회로 크기 조정에 대한 자세한 내용은 ExpressRoute 회로 대역폭 업그레이드를 참조하세요.",
"guid": "3d8a5d49-af34-431f-b47f-ee8cf05479b5",
"service": "Azure Expressroute",
"text": "필요한 SKU 및 대역폭 확인",
@@ -1715,7 +1563,7 @@
"waf": "비용"
},
{
- "description": "ExpressRoute 가상 네트워크 게이트웨이는 개인 피어링을 통해 가상 네트워크로 트래픽을 전달하는 데 사용됩니다. 선호하는 Virtual Network Gateway SKU의 성능 및 크기 조정 요구 사항을 검토합니다. 온-프레미스에서 Azure 워크로드로 적절한 게이트웨이 SKU를 선택합니다.",
+ "description": "ExpressRoute 가상 네트워크 게이트웨이는 개인 피어링을 통해 가상 네트워크로 트래픽을 전달하는 데 사용됩니다. 선호하는 Virtual Network Gateway SKU의 성능 및 크기 조정 요구 사항을 검토합니다. 온-프레미스에서 Azure로 워크로드에서 적절한 게이트웨이 SKU를 선택합니다.",
"guid": "82224292-a5a6-4b85-9b2f-b617117c4285",
"service": "Azure Expressroute",
"text": "ExpressRoute 가상 네트워크 게이트웨이 크기 확인",
@@ -1734,7 +1582,7 @@
"description": "ExpressRoute 회로는 만들어지는 순간부터 요금이 청구됩니다. 불필요한 비용을 줄이려면 서비스 공급자를 통해 회로의 프로비전을 해제하고 구독에서 ExpressRoute 회로를 삭제합니다. ExpressRoute 회로를 제거하는 방법에 대한 단계는 ExpressRoute 회로 프로비전 해제를 참조하세요.",
"guid": "131104a1-a17f-4b6b-9384-0b636a5d5265",
"service": "Azure Expressroute",
- "text": "더 이상 사용되지 않는 ExpressRoute 회로를 프로비전 해제하고 삭제합니다.",
+ "text": "더 이상 사용되지 않는 ExpressRoute 회로의 프로비전을 해제하고 삭제합니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -1779,7 +1627,7 @@
"waf": "작업"
},
{
- "description": "Service Health 알림을 설정하여 구독의 모든 ExpressRoute 회로에 계획된 유지 관리 및 예정된 유지 관리가 발생할 때 경고합니다. 또한 Service Health는 계획되지 않은 유지 관리가 발생하는 경우 RCA와 함께 과거 유지 관리를 표시합니다.",
+ "description": "Service Health 알림을 설정하여 계획된 유지 관리 및 예정된 유지 관리가 구독의 모든 ExpressRoute 회로에 발생할 때 경고합니다. 또한 Service Health는 계획되지 않은 유지 관리가 발생하는 경우 RCA와 함께 과거 유지 관리를 표시합니다.",
"guid": "5ff3a7b5-974a-466d-ab01-ad90c143969d",
"service": "Azure Expressroute",
"text": "서비스 상태 구성",
@@ -1787,7 +1635,7 @@
"waf": "작업"
},
{
- "description": "Network Insights를 사용하는 ExpressRoute Insights를 사용하면 ExpressRoute 회로, 게이트웨이, 연결 메트릭 및 상태 대시보드를 검토하고 분석할 수 있습니다. 또한 ExpressRoute Insights는 피어링 구성 요소의 세부 정보를 모두 한 곳에서 볼 수 있는 ExpressRoute 연결의 토폴로지 보기를 제공합니다. 사용 가능한 메트릭:- 가용성- 처리량- 게이트웨이 메트릭",
+ "description": "네트워크 인사이트를 사용하는 ExpressRoute Insights를 사용하면 ExpressRoute 회로, 게이트웨이, 연결 메트릭 및 상태 대시보드를 검토하고 분석할 수 있습니다. 또한 ExpressRoute Insights는 피어링 구성 요소의 세부 정보를 모두 한 곳에서 볼 수 있는 ExpressRoute 연결의 토폴로지 보기를 제공합니다. 사용 가능한 메트릭:- 가용성- 처리량- 게이트웨이 메트릭",
"guid": "210546e8-29e3-40d9-869f-6236fddaadd0",
"service": "Azure Expressroute",
"text": "Network Insights로 메트릭 검토",
@@ -1843,7 +1691,7 @@
"waf": "공연"
},
{
- "description": "Azure Connectivity Toolkit를 사용하여 ExpressRoute 회로에서 성능을 테스트하여 네트워크 연결의 대역폭, 용량 및 대기 시간을 파악합니다.",
+ "description": "Azure Connectivity Toolkit을 사용하여 ExpressRoute 회로에서 성능을 테스트하여 네트워크 연결의 대역폭 용량 및 대기 시간을 파악합니다.",
"guid": "256753af-fb4b-49b2-a965-4b65265ee8dd",
"service": "Azure Expressroute",
"text": "ExpressRoute 게이트웨이 성능을 테스트하여 작업 부하 요구 사항을 충족합니다.",
@@ -1851,7 +1699,7 @@
"waf": "공연"
},
{
- "description": "온-프레미스와 Azure 환경 간의 처리량 성능 향상을 위해 더 높은 게이트웨이 SKU로 업그레이드합니다.",
+ "description": "온-프레미스와 Azure 환경 간의 처리량 성능을 향상시키기 위해 더 높은 게이트웨이 SKU로 업그레이드합니다.",
"guid": "9bc85bda-be71-4df0-924c-2604ef7f05fa",
"service": "Azure Expressroute",
"text": "ExpressRoute 게이트웨이의 크기를 늘립니다.",
@@ -1867,15 +1715,15 @@
"waf": "공연"
},
{
- "description": "Ultra 성능 또는 ErGW3AZ 가상 네트워크 게이트웨이를 사용하는 경우 FastPath를 사용하도록 설정하여 온-프레미스 네트워크와 Azure 가상 네트워크 간의 데이터 경로 성능을 향상시킬 수 있습니다.",
+ "description": "울트라 성능 또는 ErGW3AZ 가상 네트워크 게이트웨이를 사용하는 경우 FastPath를 사용하도록 설정하여 온-프레미스 네트워크와 Azure 가상 네트워크 간의 데이터 경로 성능을 향상시킬 수 있습니다.",
"guid": "01566559-f881-409b-b04e-7d79a71f18e4",
"service": "Azure Expressroute",
- "text": "처리량을 높이기 위해 ExpressRoute FastPath 사용",
+ "text": "처리량 증가를 위해 ExpressRoute FastPath 사용",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "특정 임계값에 도달할 때 사전에 알리도록 ExpressRoute 메트릭을 기반으로 경고를 설정합니다. 이러한 메트릭은 ExpressRoute 회로에서 발생하는 중단 및 유지 관리와 같이 ExpressRoute 연결에서 발생할 수 있는 변칙을 이해하는 데 유용합니다.",
+ "description": "특정 임계값이 충족될 때 사전에 알리도록 ExpressRoute 메트릭을 기반으로 경고를 설정합니다. 이러한 메트릭은 ExpressRoute 회로에서 발생하는 중단 및 유지 관리와 같이 ExpressRoute 연결에서 발생할 수 있는 변칙을 이해하는 데 유용합니다.",
"guid": "6440df71-d371-4190-920f-01c1815446db",
"service": "Azure Expressroute",
"text": "ExpressRoute 회로 및 게이트웨이 메트릭 모니터링",
@@ -1894,7 +1742,7 @@
"description": "",
"guid": "bedde06b-f58a-43ab-b6cc-76e41503e72a",
"service": "Azure Files",
- "text": "안정성 및 복구 목표 정의: Azure SLA(서비스 수준 계약)를 검토합니다. 스토리지 계정에 대한 SLO(서비스 수준 목표)를 파생합니다. 예를 들어, 선택한 이중화 구성은 SLO에 영향을 줄 수 있습니다. 지역 중단의 영향, 데이터 손실 가능성 및 중단 후 액세스를 복원하는 데 필요한 시간을 고려합니다. 또한 고장 모드 분석의 일부로 식별한 내부 종속성의 가용성을 고려합니다.",
+ "text": "안정성 및 복구 대상 정의: Azure SLA(서비스 수준 계약)를 검토합니다. 스토리지 계정에 대한 SLO(서비스 수준 목표)를 파생합니다. 예를 들어, 선택한 이중화 구성은 SLO에 영향을 줄 수 있습니다. 지역 중단의 영향, 데이터 손실 가능성 및 중단 후 액세스를 복원하는 데 필요한 시간을 고려합니다. 또한 고장 모드 분석의 일부로 식별한 내부 종속성의 가용성을 고려합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1910,7 +1758,7 @@
"description": "",
"guid": "61e937b4-1989-496a-af6f-5df76d352ed8",
"service": "Azure Files",
- "text": "응용 프로그램 설계: 주 지역을 사용할 수 없는 경우 보조 지역에서 데이터를 읽을 수 있도록 원활하게 이동하도록 응용 프로그램을 설계합니다. 이 디자인 고려 사항은 GRS(지역 중복 스토리지) 및 GZRS(지역 영역 중복 스토리지) 구성에만 적용됩니다. 중단을 적절하게 처리하도록 응용 프로그램을 설계하여 고객의 가동 중지 시간을 줄입니다.",
+ "text": "응용 프로그램 설계: 주 지역을 사용할 수 없는 경우 보조 지역에서 데이터를 읽을 수 있도록 원활하게 이동하도록 응용 프로그램을 디자인합니다. 이 디자인 고려 사항은 GRS(지역 중복 스토리지) 및 GZRS(지역 영역 중복 스토리지) 구성에만 적용됩니다. 중단을 적절하게 처리하도록 응용 프로그램을 설계하여 고객의 가동 중지 시간을 줄입니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1918,7 +1766,7 @@
"description": "",
"guid": "cb1c49d6-9cdb-48f6-a3f8-c35c2037fc92",
"service": "Azure Files",
- "text": "복구 목표를 달성하는 데 도움이 되는 기능 살펴보기: 손상되었거나 편집되었거나 삭제된 파일을 복구할 수 있도록 파일을 복원 가능하게 만듭니다.",
+ "text": "복구 목표를 달성하는 데 도움이 되는 기능 살펴보기: 손상되었거나 편집되거나 삭제된 파일을 복구할 수 있도록 파일을 복원 가능하게 만듭니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1926,7 +1774,7 @@
"description": "",
"guid": "3a9677e5-9506-4aaa-bac6-48b5002070c1",
"service": "Azure Files",
- "text": "복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업 또는 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치(failover)에 소요되는 시간과 비용에 대비합니다. 자세한 내용은 재해 복구 전략 설계를 위한 권장 사항을 참조하세요.",
+ "text": "복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업 또는 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치에 소요되는 시간 및 비용에 대비합니다. 자세한 내용은 재해 복구 전략 설계를 위한 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -1934,15 +1782,15 @@
"description": "",
"guid": "8b151d5d-630d-438e-b7ad-aa487d6c5561",
"service": "Azure Files",
- "text": "잠재적인 가용성 문제 모니터링: Azure Service Health 대시보드를 구독하여 잠재적인 가용성 문제를 모니터링합니다. Azure Monitor에서 스토리지 메트릭 및 진단 로그를 사용하여 경고를 조사합니다.",
+ "text": "잠재적 가용성 문제 모니터링: Azure Service Health 대시보드를 구독하여 잠재적인 가용성 문제를 모니터링합니다. Azure Monitor에서 스토리지 메트릭 및 진단 로그를 사용하여 경고를 조사합니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
- "description": "이중화는 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 다양한 가용성 영역에서 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
+ "description": "중복성은 예기치 않은 오류로부터 데이터를 보호합니다. ZRS 및 GZRS 구성 옵션은 다양한 가용성 영역에서 복제되며 애플리케이션이 중단 중에도 데이터를 계속 읽을 수 있도록 합니다. 자세한 내용은 중단 시나리오별 내구성 및 가용성 및 내구성 및 가용성 매개 변수를 참조하세요.",
"guid": "5596d241-a342-4c47-b8db-29f7a519bf36",
"service": "Azure Files",
- "text": "중복성을 위해 저장소 계정을 구성합니다. 가용성과 내구성을 최대화하려면 ZRS(영역 중복 스토리지), GRS 또는 GZRS를 사용하여 계정을 구성합니다. 제한된 Azure 지역은 표준 및 프리미엄 파일 공유에 대해 ZRS를 지원합니다. 표준 SMB 계정만 GRS 및 GZRS를 지원합니다. 프리미엄 SMB 공유 및 NFS 공유는 GRS 및 GZRS를 지원하지 않습니다. Azure Files는 RA-GRS(읽기 액세스 지역 중복 스토리지) 또는 RA-GZRS(읽기 액세스 지역 영역 중복 스토리지)를 지원하지 않습니다. RA-GRS 또는 RA-GZRS를 사용하도록 스토리지 계정을 구성하는 경우 파일 공유가 GRS 또는 GZRS로 구성되고 청구됩니다.",
+ "text": "중복성을 위해 저장소 계정을 구성합니다. 최대 가용성 및 내구성을 위해 ZRS(영역 중복 스토리지), GRS 또는 GZRS를 사용하여 계정을 구성합니다. 제한된 Azure 지역은 표준 및 프리미엄 파일 공유에 대해 ZRS를 지원합니다. 표준 SMB 계정만 GRS 및 GZRS를 지원합니다. 프리미엄 SMB 공유 및 NFS 공유는 GRS 및 GZRS를 지원하지 않습니다. Azure Files는 RA-GRS(읽기 액세스 지역 중복 스토리지) 또는 RA-GZRS(읽기 액세스 지역 영역 중복 스토리지)를 지원하지 않습니다. RA-GRS 또는 RA-GZRS를 사용하도록 스토리지 계정을 구성하는 경우 파일 공유가 GRS 또는 GZRS로 구성되고 청구됩니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -1955,10 +1803,10 @@
"waf": "신뢰도"
},
{
- "description": "일시 삭제는 파일 공유 수준에서 작동하여 실수로 삭제되지 않도록 Azure 파일 공유를 보호합니다. 특정 시점 복원은 파일 공유를 이전 상태로 복원할 수 있으므로 실수로 인한 삭제 또는 손상을 방지합니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
+ "description": "일시 삭제는 파일 공유 수준에서 작동하여 실수로 삭제되지 않도록 Azure 파일 공유를 보호합니다. 특정 시점 복원은 파일 공유를 이전 상태로 복원할 수 있으므로 실수로 삭제되거나 손상되는 것을 방지합니다. 자세한 내용은 데이터 보호 개요를 참조하세요.",
"guid": "8bcb6fde-bf94-4f36-8eae-347e5d4f0dea",
"service": "Azure Files",
- "text": "백업 및 복구 전략의 일환으로 일시 삭제를 사용하도록 설정하고 특정 시점 복원을 위해 스냅샷을 사용합니다. Azure Backup을 사용하여 SMB 파일 공유를 백업할 수 있습니다. Azure 파일 동기화를 사용하여 온-프레미스 SMB 파일 공유를 Azure 파일 공유에 백업할 수도 있습니다. 또한 Azure Backup을 사용하면 Azure Files의 자격 증명 모음 백업(미리 보기)을 수행하여 악의적인 행위자 또는 악의적인 관리자로 인한 랜섬웨어 공격 또는 원본 데이터 손실로부터 데이터를 보호할 수 있습니다. Azure Backup은 자격 증명 모음 백업을 사용하여 Recovery Services 자격 증명 모음에 데이터를 복사하고 저장합니다. 이렇게 하면 최대 99년 동안 보존할 수 있는 데이터의 오프사이트 복사본이 만들어집니다. Azure Backup은 백업 정책에 정의된 일정 및 보존에 따라 복구 지점을 만들고 관리합니다. 더 알아보세요.",
+ "text": "백업 및 복구 전략의 일환으로 일시 삭제를 사용하도록 설정하고 특정 시점 복원을 위해 스냅샷을 사용합니다. Azure Backup을 사용하여 SMB 파일 공유를 백업할 수 있습니다. Azure 파일 동기화를 사용하여 온-프레미스 SMB 파일 공유를 Azure 파일 공유에 백업할 수도 있습니다. 또한 Azure Backup을 사용하면 Azure Files의 자격 증명 모음 백업(미리 보기)을 수행하여 악의적인 행위자 또는 악의적인 관리자로 인한 랜섬웨어 공격 또는 원본 데이터 손실로부터 데이터를 보호할 수 있습니다. 자격 증명 모음 백업을 사용하여 Azure Backup은 Recovery Services 자격 증명 모음에 데이터를 복사하고 저장합니다. 이렇게 하면 최대 99년 동안 보존할 수 있는 데이터의 오프사이트 복사본이 만들어집니다. Azure Backup은 백업 정책에 정의된 일정 및 보존에 따라 복구 지점을 만들고 관리합니다. 더 알아보세요.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -1974,7 +1822,7 @@
"description": "",
"guid": "6121894c-398e-479f-b386-309e7cf3caa0",
"service": "Azure Files",
- "text": "네트워크 컨트롤을 사용하여 수신 및 송신 트래픽을 제한하는 것이 좋습니다: ID 기반 인증을 사용하여 파일 공유에 대한 액세스 권한을 부여하는 경우와 같은 특정 조건에서 스토리지 계정을 공용 인터넷에 노출하는 것이 편할 수 있습니다. 그러나 네트워크 컨트롤을 사용하여 사용자 및 애플리케이션에 필요한 최소 수준의 액세스 권한을 부여하는 것이 좋습니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
+ "text": "네트워크 컨트롤을 사용하여 수신 및 송신 트래픽 제한 고려: ID 기반 인증을 사용하여 파일 공유에 대한 액세스 권한을 부여하는 경우와 같은 특정 조건에서 스토리지 계정을 공용 인터넷에 노출하는 것이 편할 수 있습니다. 그러나 네트워크 컨트롤을 사용하여 사용자 및 애플리케이션에 필요한 최소 수준의 액세스 권한을 부여하는 것이 좋습니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -1982,7 +1830,7 @@
"description": "",
"guid": "8395a636-8c19-4b22-a175-2a0f0d83f44f",
"service": "Azure Files",
- "text": "공격 표면 감소: 전송 중 암호화를 사용하고 비보안(HTTP) 연결을 통한 액세스를 방지하여 공격 노출 영역을 줄입니다. 클라이언트가 최신 버전의 TLS(전송 계층 보안) 프로토콜을 사용하여 데이터를 보내고 받도록 요구합니다.",
+ "text": "공격 표면 줄이기: 전송 중 암호화를 사용하고 비보안(HTTP) 연결을 통한 액세스를 방지하여 공격 노출 영역을 줄입니다. 클라이언트가 최신 버전의 TLS(전송 계층 보안) 프로토콜을 사용하여 데이터를 보내고 받도록 요구합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -1990,7 +1838,7 @@
"description": "",
"guid": "62e5154f-98cb-4dc2-8e62-dd5c546d6a6d",
"service": "Azure Files",
- "text": "스토리지 계정 키 사용 최소화: ID 기반 인증은 스토리지 계정 키를 사용하는 것보다 뛰어난 보안을 제공합니다. 그러나 파일 소유권을 가져오는 기능을 포함하여 파일 공유에 대한 전체 관리 제어 권한을 얻으려면 스토리지 계정 키를 사용해야 합니다. 보안 주체에게 작업을 수행하는 데 필요한 권한만 부여합니다.",
+ "text": "저장소 계정 키 사용 최소화: ID 기반 인증은 저장소 계정 키를 사용하는 것보다 뛰어난 보안을 제공합니다. 그러나 파일의 소유권을 가져오는 기능을 포함하여 파일 공유에 대한 전체 관리 제어 권한을 얻으려면 스토리지 계정 키를 사용해야 합니다. 보안 주체에게 작업을 수행하는 데 필요한 권한만 부여합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -2006,7 +1854,7 @@
"description": "",
"guid": "1edd34b4-610b-483a-83a0-d8bcb5915558",
"service": "Azure Files",
- "text": "위협 검색: Microsoft Defender for Storage를 사용하여 SMB 또는 FileREST 프로토콜을 통해 Azure 파일 공유에 액세스하거나 악용하려는 잠재적으로 유해한 시도를 감지할 수 있습니다. 구독 관리자는 의심스러운 활동에 대한 세부 정보와 위협을 조사하고 수정하는 방법에 대한 권장 사항이 포함된 이메일 알림을 받습니다. 스토리지용 Defender는 Azure 파일 공유에 대한 바이러스 백신 기능을 지원하지 않습니다. 스토리지용 Defender를 사용하는 경우 트랜잭션이 많은 파일 공유에는 상당한 비용이 발생하므로 특정 스토리지 계정에 대해 스토리지용 Defender를 옵트아웃하는 것이 좋습니다.",
+ "text": "위협 검색: 스토리지용 Microsoft Defender를 사용하여 SMB 또는 FileREST 프로토콜을 통해 Azure 파일 공유에 액세스하거나 악용하려는 잠재적으로 유해한 시도를 감지할 수 있습니다. 구독 관리자는 의심스러운 활동에 대한 세부 정보와 위협을 조사하고 수정하는 방법에 대한 권장 사항이 포함된 이메일 알림을 받습니다. 스토리지용 Defender는 Azure 파일 공유에 대한 바이러스 백신 기능을 지원하지 않습니다. 스토리지용 Defender를 사용하는 경우 트랜잭션이 많은 파일 공유에는 상당한 비용이 발생하므로 특정 스토리지 계정에 대해 스토리지용 Defender를 옵트아웃하는 것이 좋습니다.",
"type": "checklist",
"waf": "안전"
},
@@ -2022,7 +1870,7 @@
"description": "SMB 3.x는 인터넷 안전 프로토콜이지만 조직 또는 ISP 정책을 변경할 수 없는 경우가 있습니다. VPN 게이트웨이 또는 ExpressRoute 연결을 대체 옵션으로 사용할 수 있습니다.",
"guid": "14cda8e5-c05a-4c69-9352-2f7b39b5d423",
"service": "Azure Files",
- "text": "TCP 포트 445 아웃바운드를 열거나 Azure 외부의 클라이언트에 대해 VPN 게이트웨이 또는 Azure ExpressRoute 연결을 설정하여 파일 공유에 액세스합니다.",
+ "text": "TCP 포트 445 아웃바운드를 열거나 Azure 외부의 클라이언트가 파일 공유에 액세스할 수 있도록 VPN 게이트웨이 또는 Azure ExpressRoute 연결을 설정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2030,12 +1878,12 @@
"description": "SMB 1은 오래되고 비효율적이며 안전하지 않은 프로토콜입니다. 보안 태세를 강화하기 위해 클라이언트에서 사용하지 않도록 설정합니다.",
"guid": "e2ef284e-804b-4592-866f-5d577069b823",
"service": "Azure Files",
- "text": "포트 445를 여는 경우 Windows 및 Linux 클라이언트에서 SMBv1을 사용하지 않도록 설정해야 합니다. Azure Files는 SMB 1을 지원하지 않지만 클라이언트에서 사용하지 않도록 설정해야 합니다.",
+ "text": "포트 445를 여는 경우 Windows 및 Linux 클라이언트에서 SMBv1을 비활성화해야 합니다. Azure Files는 SMB 1을 지원하지 않지만 클라이언트에서 사용하지 않도록 설정해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험 노출이 제거됩니다.",
+ "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험에 노출되지 않습니다.",
"guid": "19d4b509-167c-4144-9705-9d65c48ec279",
"service": "Azure Files",
"text": "스토리지 계정에 대한 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다. Azure 외부에 있는 SMB 클라이언트 및 서비스가 스토리지 계정에 액세스해야 하는 경우에만 공용 네트워크 액세스를 사용하도록 설정합니다. 공용 네트워크 액세스를 사용하지 않도록 설정하는 경우 스토리지 계정에 대한 프라이빗 엔드포인트를 만듭니다. 프라이빗 엔드포인트에 대한 표준 데이터 처리 요금이 적용됩니다. 프라이빗 엔드포인트는 퍼블릭 엔드포인트에 대한 연결을 차단하지 않습니다. 앞에서 설명한 대로 공용 네트워크 액세스를 사용하지 않도록 설정해야 합니다. 파일 공유에 고정 IP 주소가 필요하지 않고 프라이빗 엔드포인트 비용을 피하려면 대신 특정 가상 네트워크 및 IP 주소에 대한 퍼블릭 엔드포인트 액세스를 제한할 수 있습니다.",
@@ -2046,7 +1894,7 @@
"description": "공격자에게 틈을 만들 위험을 최소화합니다.",
"guid": "105c5f3d-dfc6-459b-93f0-c5046972f1ba",
"service": "Azure Files",
- "text": "특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다. 제로 액세스부터 시작한 다음, 클라이언트 및 서비스에 필요한 최소한의 액세스를 체계적이고 점진적으로 제공합니다.",
+ "text": "특정 가상 네트워크에 대한 액세스를 제한하는 방화벽 규칙을 사용하도록 설정합니다. 제로 액세스부터 시작한 다음, 클라이언트 및 서비스에 필요한 최소한의 액세스 권한을 체계적이고 점진적으로 제공합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2070,7 +1918,7 @@
"description": "이 설정은 스토리지 계정에 대한 모든 요청이 보안 연결(HTTPS)을 통해 수행되도록 합니다. HTTP를 통한 모든 요청은 실패합니다.",
"guid": "4fbd14ad-9bf1-491f-b621-35f086b48ccd",
"service": "Azure Files",
- "text": "대부분의 경우 모든 스토리지 계정에서 보안 전송 필요 옵션을 사용하도록 설정하여 SMB 파일 공유에 대한 전송 중 암호화를 사용하도록 설정해야 합니다. 아주 오래된 클라이언트가 공유에 액세스할 수 있도록 허용해야 하는 경우 이 옵션을 활성화하지 마세요. 보안 전송을 비활성화하는 경우 네트워크 컨트롤을 사용하여 트래픽을 제한해야 합니다.",
+ "text": "대부분의 경우 모든 스토리지 계정에서 보안 전송 필요 옵션을 사용하도록 설정하여 SMB 파일 공유에 대해 전송 중 암호화를 사용하도록 설정해야 합니다. 매우 오래된 클라이언트가 공유에 액세스할 수 있도록 허용해야 하는 경우 이 옵션을 활성화하지 마세요. 보안 전송을 비활성화하는 경우 네트워크 제어를 사용하여 트래픽을 제한해야 합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2086,7 +1934,7 @@
"description": "Windows 10과 함께 릴리스된 SMB 3.1.1에는 중요한 보안 및 성능 업데이트가 포함되어 있습니다. AES-256-GCM은 보다 안전한 채널 암호화를 제공합니다.",
"guid": "010a5a8d-db30-4c97-975e-db80658bdb4d",
"service": "Azure Files",
- "text": "지원되는 가장 최근의 SMB 프로토콜 버전(현재 3.1.1.)만 사용하고 SMB 채널 암호화에는 AES-256-GCM만 사용합니다. Azure Files는 SMB 프로토콜을 전환하고 조직의 요구 사항에 따라 호환성을 높이거나 보안을 강화하는 데 사용할 수 있는 설정을 노출합니다. 기본적으로 모든 SMB 버전이 허용됩니다. 그러나 SMB 2.1은 전송 중 데이터 암호화를 지원하지 않으므로 보안 전송 필요를 사용하도록 설정하면 SMB 2.1이 허용되지 않습니다. 이러한 설정을 높은 수준의 보안으로 제한하면 일부 클라이언트가 파일 공유에 연결하지 못할 수 있습니다.",
+ "text": "지원되는 가장 최근의 SMB 프로토콜 버전(현재 3.1.1.)만 사용하고 SMB 채널 암호화에는 AES-256-GCM만 사용합니다. Azure Files는 SMB 프로토콜을 전환하고 조직의 요구 사항에 따라 호환성을 높이거나 보안을 강화하는 데 사용할 수 있는 설정을 노출합니다. 기본적으로 모든 SMB 버전이 허용됩니다. 그러나 SMB 2.1은 전송 중인 데이터의 암호화를 지원하지 않으므로 보안 전송 필요를 사용하도록 설정하면 SMB 2.1이 허용되지 않습니다. 이러한 설정을 높은 수준의 보안으로 제한하면 일부 클라이언트가 파일 공유에 연결하지 못할 수 있습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2094,7 +1942,7 @@
"description": "",
"guid": "04493486-a5be-4bb2-8940-cea321db8380",
"service": "Azure Files",
- "text": "스토리지에 대한 보안 기준 검토: 시작하려면 스토리지에 대한 보안 기준을 검토하세요.",
+ "text": "Storage에 대한 보안 기준 검토: 시작하려면 Storage에 대한 보안 기준을 검토하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -2102,7 +1950,7 @@
"description": "",
"guid": "85f4e9b5-aa91-4d96-ad22-9132f7412718",
"service": "Azure Files",
- "text": "조직의 보안 요구 사항 이해: NFS Azure 파일 공유는 NFSv4.1 프로토콜을 사용하는 Linux 클라이언트만 지원하며, 4.1 프로토콜 사양의 대부분의 기능을 지원합니다. Kerberos 인증, ACL(액세스 제어 목록) 및 전송 중 암호화와 같은 일부 보안 기능은 지원되지 않습니다.",
+ "text": "조직의 보안 요구 사항 이해: NFS Azure 파일 공유는 NFSv4.1 프로토콜을 사용하는 Linux 클라이언트만 지원하며 4.1 프로토콜 사양의 대부분의 기능을 지원합니다. Kerberos 인증, ACL(액세스 제어 목록) 및 전송 중 암호화와 같은 일부 보안 기능은 지원되지 않습니다.",
"type": "checklist",
"waf": "안전"
},
@@ -2110,7 +1958,7 @@
"description": "",
"guid": "7f1ac6f7-d832-4c71-adbd-ae31d36320a7",
"service": "Azure Files",
- "text": "네트워크 수준 보안 및 제어를 사용하여 수신 및 송신 트래픽 제한: NFS Azure 파일 공유에는 ID 기반 인증을 사용할 수 없으므로 네트워크 수준 보안 및 제어를 사용하여 사용자 및 애플리케이션에 필요한 최소 수준의 액세스 권한을 부여해야 합니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
+ "text": "네트워크 수준 보안 및 제어를 사용하여 수신 및 송신 트래픽 제한: ID 기반 인증은 NFS Azure 파일 공유에 사용할 수 없으므로 네트워크 수준 보안 및 제어를 사용하여 사용자 및 애플리케이션에 필요한 최소 수준의 액세스 권한을 부여해야 합니다. 자세한 내용은 스토리지 계정에 대한 네트워크 보안에 접근하는 방법을 참조하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -2126,12 +1974,12 @@
"description": "포트 2049를 열어 클라이언트가 NFS Azure 파일 공유와 통신할 수 있도록 합니다.",
"guid": "af6d0dd1-6add-4f9b-96b6-e65dba4242a4",
"service": "Azure Files",
- "text": "NFS 공유를 탑재하려는 클라이언트에서 포트 2049를 열어야 합니다.",
+ "text": "NFS 공유를 마운트하려는 클라이언트에서 포트 2049를 열어야 합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험 노출이 제거됩니다.",
+ "description": "네트워크 트래픽은 공용 인터넷 대신 Microsoft 백본 네트워크를 통해 이동하므로 공용 인터넷에서 위험에 노출되지 않습니다.",
"guid": "528b4915-a4d9-413d-9b79-e4078f5cd27d",
"service": "Azure Files",
"text": "NFS Azure 파일 공유는 제한된 네트워크를 통해서만 액세스할 수 있습니다. 따라서 스토리지 계정에 대한 프라이빗 엔드포인트를 만들거나 선택한 가상 네트워크 및 IP 주소에 대한 퍼블릭 엔드포인트 액세스를 제한해야 합니다. 프라이빗 엔드포인트를 만드는 것이 좋습니다. Azure Files는 NFS 프로토콜을 사용한 전송 중 암호화를 지원하지 않으므로 NFS 공유에 대한 네트워크 수준 보안을 구성해야 합니다. NFS Azure 파일 공유를 사용하려면 스토리지 계정에서 보안 전송 필요 설정을 사용하지 않도록 설정해야 합니다. 프라이빗 엔드포인트에는 표준 데이터 처리 요금이 적용됩니다. 파일 공유에 고정 IP 주소가 필요하지 않고 프라이빗 엔드포인트 비용을 피하려면 대신 퍼블릭 엔드포인트 액세스를 제한할 수 있습니다.",
@@ -2150,7 +1998,7 @@
"description": "",
"guid": "bc87a075-cc79-46be-a413-106c995f41ef",
"service": "Azure Files",
- "text": "워크로드에 프리미엄 파일 공유(Azure Premium SSD)의 성능이 필요한지 또는 Azure Standard HDD 스토리지가 충분한지 결정: 필요한 스토리지 유형에 따라 스토리지 계정 유형 및 청구 모델을 결정합니다. 많은 양의 IOPS(초당 입력/출력 작업), 매우 빠른 데이터 전송 속도 또는 매우 짧은 대기 시간이 필요한 경우 프리미엄 Azure 파일 공유를 선택해야 합니다. NFS Azure 파일 공유는 프리미엄 계층에서만 사용할 수 있습니다. NFS 및 SMB 파일 공유는 프리미엄 계층에서 동일한 가격입니다.",
+ "text": "워크로드에 프리미엄 파일 공유(Azure Premium SSD)의 성능이 필요한지 또는 Azure Standard HDD 스토리지가 충분한지 결정: 필요한 스토리지 유형에 따라 스토리지 계정 유형 및 청구 모델을 결정합니다. 많은 양의 IOPS(초당 입력/출력 작업 수), 매우 빠른 데이터 전송 속도 또는 매우 짧은 대기 시간이 필요한 경우 프리미엄 Azure 파일 공유를 선택해야 합니다. NFS Azure 파일 공유는 프리미엄 계층에서만 사용할 수 있습니다. NFS 및 SMB 파일 공유는 프리미엄 계층에서 동일한 가격입니다.",
"type": "checklist",
"waf": "비용"
},
@@ -2158,7 +2006,7 @@
"description": "",
"guid": "fc9a86d1-8dcf-4e82-87fa-81d736ab60f4",
"service": "Azure Files",
- "text": "파일 공유에 대한 스토리지 계정을 만들고 중복성 수준을 선택: 표준(GPv2) 또는 프리미엄(FileStorage) 계정을 선택합니다. 선택하는 중복 수준은 비용에 영향을 줍니다. 중복성이 높을수록 비용이 높아집니다. LRS(로컬 중복 스토리지)가 가장 저렴합니다. GRS는 표준 SMB 파일 공유에만 사용할 수 있습니다. 표준 파일 공유는 스토리지 계정 수준에서만 트랜잭션 정보를 표시하므로 전체 청구 가시성을 보장하기 위해 각 스토리지 계정에 하나의 파일 공유만 배포하는 것이 좋습니다.",
+ "text": "파일 공유에 대한 스토리지 계정을 만들고 중복 수준을 선택합니다. 표준(GPv2) 또는 프리미엄(FileStorage) 계정을 선택합니다. 선택하는 중복 수준은 비용에 영향을 줍니다. 중복성이 많을수록 비용이 높아집니다. LRS(로컬 중복 스토리지)가 가장 저렴합니다. GRS는 표준 SMB 파일 공유에만 사용할 수 있습니다. 표준 파일 공유는 스토리지 계정 수준에서만 트랜잭션 정보를 표시하므로 전체 청구 가시성을 보장하기 위해 각 스토리지 계정에 하나의 파일 공유만 배포하는 것이 좋습니다.",
"type": "checklist",
"waf": "비용"
},
@@ -2182,7 +2030,7 @@
"description": "",
"guid": "9dede643-062f-40d2-869e-10458f04859a",
"service": "Azure Files",
- "text": "가장 비용 효율적인 액세스 계층 선택: 표준 SMB Azure 파일 공유는 트랜잭션 최적화, 핫 및 쿨의 세 가지 액세스 계층을 제공합니다. 세 계층 모두 동일한 표준 스토리지 하드웨어에 저장됩니다. 이 세 계층의 주요 차이점은 쿨 계층에서 더 낮은 미사용 데이터 스토리지 가격과 더 쿨 계층에서 더 높은 트랜잭션 가격입니다. 자세한 내용은 표준 계층의 차이점을 참조하세요.",
+ "text": "가장 비용 효율적인 액세스 계층 선택: 표준 SMB Azure 파일 공유는 트랜잭션 최적화, 핫 및 쿨의 세 가지 액세스 계층을 제공합니다. 세 계층 모두 동일한 표준 스토리지 하드웨어에 저장됩니다. 이 세 가지 계층의 주요 차이점은 쿨 계층에서 더 낮은 미사용 데이터 스토리지 가격과 쿨 계층에서 더 높은 트랜잭션 가격입니다. 자세한 내용은 표준 계층의 차이점을 참조하세요.",
"type": "checklist",
"waf": "비용"
},
@@ -2214,7 +2062,7 @@
"description": "",
"guid": "a6bc4298-8317-4153-b281-2b83af53fd26",
"service": "Azure Files",
- "text": "사용량 모니터링: 사용량 패턴을 지속적으로 모니터링하여 사용되지 않거나 잘 사용되지 않는 스토리지 계정 및 파일 공유를 검색합니다. 많은 로그 파일 또는 일시 삭제된 파일을 수집하고 있음을 나타낼 수 있는 예기치 않은 용량 증가를 확인합니다. 파일을 삭제하거나 파일을 보다 비용 효율적인 액세스 계층으로 이동하기 위한 전략을 개발합니다.",
+ "text": "사용량 모니터링: 사용량 패턴을 지속적으로 모니터링하여 사용되지 않거나 잘 사용되지 않는 스토리지 계정 및 파일 공유를 감지합니다. 많은 로그 파일 또는 일시 삭제된 파일을 수집하고 있음을 나타낼 수 있는 예기치 않은 용량 증가를 확인합니다. 파일을 삭제하거나 보다 비용 효율적인 액세스 계층으로 파일을 이동하기 위한 전략을 개발합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -2230,15 +2078,15 @@
"description": "표준 파일 공유에 적합한 액세스 계층을 선택하면 비용을 크게 줄일 수 있습니다.",
"guid": "4ee4d06f-ae90-4ba1-b87e-608a8871e182",
"service": "Azure Files",
- "text": "워크로드를 마이그레이션한 후 표준 파일 공유를 사용하는 경우 파일 공유에 대해 가장 비용 효율적인 액세스 계층(핫, 쿨 또는 트랜잭션 최적화)을 신중하게 선택합니다. 며칠 또는 몇 주 동안 정기적으로 사용한 후 가격 계산기에 트랜잭션 수를 삽입하여 워크로드에 가장 적합한 계층을 파악할 수 있습니다. 대부분의 고객은 공유를 적극적으로 사용하더라도 쿨을 선택해야 합니다. 그러나 각 공유를 검사하고 스토리지 용량의 균형을 트랜잭션과 비교하여 계층을 결정해야 합니다. 트랜잭션 비용이 청구서의 상당 부분을 차지하는 경우 쿨 액세스 계층을 사용하여 절감된 금액이 이 비용을 상쇄하고 총 비용을 최소화하는 경우가 많습니다. 워크로드 패턴의 변경을 최적화하기 위해 필요한 경우에만 액세스 계층 간에 표준 파일 공유를 이동하는 것이 좋습니다. 이동할 때마다 트랜잭션이 발생합니다. 자세한 내용은 표준 계층 간 전환을 참조하세요.",
+ "text": "워크로드를 마이그레이션한 후 표준 파일 공유를 사용하는 경우 파일 공유에 대해 가장 비용 효율적인 액세스 계층(핫, 쿨 또는 트랜잭션 최적화)을 신중하게 선택합니다. 며칠 또는 몇 주 동안 정기적으로 사용한 후 가격 계산기에 트랜잭션 수를 삽입하여 워크로드에 가장 적합한 계층을 파악할 수 있습니다. 대부분의 고객은 공유를 적극적으로 사용하더라도 시원한 선택을 해야 합니다. 그러나 각 공유를 검사하고 스토리지 용량의 균형을 트랜잭션과 비교하여 계층을 결정해야 합니다. 트랜잭션 비용이 청구서의 상당 부분을 차지하는 경우 쿨 액세스 계층을 사용하여 절감된 금액으로 이 비용을 상쇄하고 총 전체 비용을 최소화하는 경우가 많습니다. 워크로드 패턴의 변경을 최적화하기 위해 필요한 경우에만 액세스 계층 간에 표준 파일 공유를 이동하는 것이 좋습니다. 이동할 때마다 트랜잭션이 발생합니다. 자세한 내용은 표준 계층 간 전환을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "성능을 유지하고 향후 성장 및 성능 요구 사항을 고려하는 데 도움이 되도록 프리미엄 파일 공유를 합리적인 금액으로 과도하게 프로비저닝합니다.",
+ "description": "성능을 유지하고 향후 성장 및 성능 요구 사항을 고려하는 데 도움이 되도록 합리적인 금액으로 프리미엄 파일 공유를 과도하게 프로비저닝합니다.",
"guid": "569b045f-3018-4487-be79-5ae7fe5f42f6",
"service": "Azure Files",
- "text": "프리미엄 공유를 사용하는 경우 워크로드에 충분한 용량과 성능을 프로비전해야 하지만 불필요한 비용이 발생할 정도는 아니어야 합니다. 2-3회 오버프로비저닝하는 것이 좋습니다. 프리미엄 파일 공유는 스토리지 및 IO(입력/출력) 성능 특성에 따라 동적으로 확장하거나 축소할 수 있습니다.",
+ "text": "프리미엄 공유를 사용하는 경우 워크로드에 대해 충분한 용량과 성능을 프로비전해야 하지만 불필요한 비용이 발생할 정도는 안 됩니다. 2-3회 오버프로비저닝하는 것이 좋습니다. 프리미엄 파일 공유는 스토리지 및 IO(입력/출력) 성능 특성에 따라 동적으로 확장하거나 축소할 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -2246,12 +2094,12 @@
"description": "3년 예약은 총 파일 스토리지 비용의 최대 36%까지 할인을 받을 수 있습니다. 예약은 성능에 영향을 주지 않습니다.",
"guid": "e4d7ee80-2657-4a1b-bf32-b16588f1511e",
"service": "Azure Files",
- "text": "예약 인스턴스라고도 하는 Azure Files 예약을 사용하여 스토리지 사용량을 미리 커밋하고 할인을 받으세요. 일관된 공간을 가진 프로덕션 워크로드 또는 개발/테스트 워크로드에 대한 예약을 사용합니다. 자세한 내용은 스토리지 예약을 사용하여 비용 최적화를 참조하세요. 예약에는 트랜잭션, 대역폭, 데이터 전송 및 메타데이터 스토리지 요금이 포함되지 않습니다.",
+ "text": "예약 인스턴스라고도 하는 Azure Files 예약을 사용하여 스토리지 사용량을 미리 커밋하고 할인을 받으세요. 프로덕션 워크로드 또는 개발/테스트 워크로드에 대한 예약을 일관된 공간으로 사용합니다. 자세한 내용은 스토리지 예약을 사용하여 비용 최적화를 참조하세요. 예약에는 트랜잭션, 대역폭, 데이터 전송 및 메타데이터 스토리지 요금이 포함되지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "차등 스냅샷은 동일한 데이터를 저장하는 데 여러 번 요금이 청구되지 않도록 합니다. 그러나 Azure Files 청구를 줄이기 위해 스냅샷 사용량을 계속 모니터링해야 합니다.",
+ "description": "차등 스냅샷은 동일한 데이터를 저장하는 데 여러 번 요금이 청구되지 않도록 합니다. 그러나 Azure Files 청구액을 줄이기 위해 스냅샷 사용량을 계속 모니터링해야 합니다.",
"guid": "90fbd856-01ee-41d2-a912-039edc971236",
"service": "Azure Files",
"text": "스냅샷 사용량을 모니터링합니다. 스냅샷에는 요금이 부과되지만 각 스냅샷의 차등 스토리지 사용량에 따라 요금이 청구됩니다. 각 스냅샷의 차이에 대해서만 비용을 지불하면 됩니다. 자세한 내용은 스냅샷을 참조하십시오. Azure 파일 동기화는 일반 사용의 일부로 공유 수준 및 파일 수준 스냅샷을 수행하므로 총 Azure Files 청구액이 증가할 수 있습니다.",
@@ -2262,7 +2110,7 @@
"description": "일시 삭제된 파일이 쌓이지 않고 용량 비용이 증가하지 않도록 보존 기간을 설정합니다. 구성된 보존 기간이 지나면 영구적으로 삭제된 데이터에 비용이 발생하지 않습니다.",
"guid": "d28f02bd-5de7-4d5b-bfbf-46ff161833b5",
"service": "Azure Files",
- "text": "일시 삭제 기능에 대한 보존 기간을 설정합니다(특히 처음 사용을 시작할 때). 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다. 표준 및 프리미엄 파일 공유를 일시 삭제하면 프로비저닝된 용량이 아닌 사용된 용량으로 청구됩니다. 또한 프리미엄 파일 공유는 일시 삭제 상태에 있는 동안 스냅샷 요금으로 청구됩니다. 표준 파일 공유는 일시 삭제 상태에 있는 동안 일반 요율로 청구됩니다.",
+ "text": "일시 삭제 기능에 대한 보존 기간을 설정합니다(특히 처음 사용하기 시작할 때). 기능이 청구서에 어떤 영향을 미치는지 더 잘 이해하기 위해 짧은 보존 기간부터 시작하는 것이 좋습니다. 최소 권장 보존 기간은 7일입니다. 표준 및 프리미엄 파일 공유를 일시 삭제하면 프로비저닝된 용량이 아닌 사용된 용량으로 청구됩니다. 또한 프리미엄 파일 공유는 일시 삭제 상태에 있는 동안 스냅샷 요금으로 청구됩니다. 표준 파일 공유는 일시 삭제 상태에 있는 동안 일반 요율로 청구됩니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -2270,7 +2118,7 @@
"description": "",
"guid": "ab85e732-c3b0-47d2-ae0c-fa0ccf3ee4d1",
"service": "Azure Files",
- "text": "유지 관리 및 응급 복구 계획 생성: 데이터 보호 기능, 백업 및 복원 작업, 장애 조치 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치(failover)에 소요되는 시간과 비용에 대비합니다.",
+ "text": "유지 관리 및 응급 복구 계획 만들기: 데이터 보호 기능, 백업 및 복원 작업, 장애 조치(failover) 절차를 고려합니다. 잠재적인 데이터 손실 및 데이터 불일치와 장애 조치에 소요되는 시간 및 비용에 대비합니다.",
"type": "checklist",
"waf": "작업"
},
@@ -2278,7 +2126,7 @@
"description": "",
"guid": "6fd27f65-59e7-41ee-8994-d93ef20dbd99",
"service": "Azure Files",
- "text": "스토리지 계정의 상태 모니터링: 스토리지 인사이트 대시보드를 만들어 가용성, 성능 및 복원력 메트릭을 모니터링합니다. 고객이 알아차리기 전에 시스템의 문제를 식별하고 해결할 수 있도록 경고를 설정합니다. 진단 설정을 사용하여 리소스 로그를 Azure Monitor 로그 작업 영역으로 라우팅합니다. 그런 다음 로그를 쿼리하여 경고를 더 자세히 조사할 수 있습니다.",
+ "text": "스토리지 계정의 상태 모니터링: 스토리지 인사이트 대시보드를 만들어 가용성, 성능 및 복원력 메트릭을 모니터링합니다. 고객이 알아차리기 전에 시스템의 문제를 식별하고 해결할 수 있도록 경고를 설정합니다. 진단 설정을 사용하여 리소스 로그를 Azure Monitor 로그 작업 영역으로 라우팅합니다. 그런 다음 로그를 쿼리하여 경고를 보다 심층적으로 조사할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -2299,7 +2147,7 @@
"waf": "작업"
},
{
- "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드와 보고서를 쉽게 만들 수 있습니다.",
+ "description": "각 계정의 상태와 운영을 추적할 수 있습니다. 이해 관계자가 스토리지 계정의 상태를 추적하는 데 사용할 수 있는 대시보드 및 보고서를 쉽게 만들 수 있습니다.",
"guid": "9475eb5c-afb9-446a-bcb1-85ecc26112a9",
"service": "Azure Files",
"text": "Storage 인사이트를 사용하여 스토리지 계정의 상태와 성능을 추적합니다. Storage 인사이트는 모든 스토리지 계정에 대한 오류, 성능, 가용성 및 용량에 대한 통합 보기를 제공합니다.",
@@ -2318,7 +2166,7 @@
"description": "",
"guid": "6c44da65-6a81-442d-87e7-dd1ecdbca0a5",
"service": "Azure Files",
- "text": "확장 계획: 스토리지 계정, Azure Files 및 Azure File Sync에 대한 확장성 및 성능 목표를 이해합니다.",
+ "text": "크기 조정 계획: 스토리지 계정, Azure Files 및 Azure File Sync에 대한 확장성 및 성능 목표를 이해합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -2326,7 +2174,7 @@
"description": "",
"guid": "d9878efd-6174-4cf7-b7f4-429d8e82e577",
"service": "Azure Files",
- "text": "예측 가능한 성능 달성을 위한 애플리케이션 및 사용 패턴 이해: 대기 시간 민감도, IOPS 및 처리량 요구 사항, 워크로드 기간 및 빈도, 워크로드 병렬화를 결정합니다. 다중 스레드 애플리케이션에 Azure Files를 사용하면 서비스의 성능 상한을 달성하는 데 도움이 됩니다. 대부분의 요청이 createfile, openfile, closefile, queryinfo 또는 querydirectory와 같은 메타데이터 중심인 경우 요청으로 인해 읽기 및 쓰기 작업보다 지연 시간이 짧습니다. 이 문제가 있는 경우 파일 공유를 동일한 스토리지 계정 내의 여러 파일 공유로 분리하는 것이 좋습니다.",
+ "text": "예측 가능한 성능 달성을 위한 애플리케이션 및 사용 패턴 이해: 대기 시간 민감도, IOPS 및 처리량 요구 사항, 작업 시간 및 빈도, 작업 부하 병렬화를 결정합니다. 다중 스레드 애플리케이션에 Azure Files를 사용하면 서비스의 성능 상한을 달성하는 데 도움이 됩니다. 대부분의 요청이 createfile, openfile, closefile, queryinfo 또는 querydirectory와 같은 메타데이터 중심인 경우 요청으로 인해 읽기 및 쓰기 작업보다 지연 시간이 짧습니다. 이 문제가 있는 경우 파일 공유를 동일한 스토리지 계정 내의 여러 파일 공유로 분리하는 것이 좋습니다.",
"type": "checklist",
"waf": "공연"
},
@@ -2371,7 +2219,7 @@
"waf": "공연"
},
{
- "description": "대규모로 성능을 높이고 NFS 파일 공유의 총 소유 비용을 줄입니다.",
+ "description": "규모에 맞게 성능을 높이고 NFS 파일 공유의 총 소유 비용을 절감합니다.",
"guid": "c06bc804-3315-43f1-96ca-70169c020494",
"service": "Azure Files",
"text": "Linux 클라이언트에서 NFS Azure 파일 공유와 함께 nconnect 클라이언트 쪽 탑재 옵션을 사용합니다. Nconnect를 사용하면 클라이언트와 NFSv4.1용 Azure Files 프리미엄 서비스 간에 더 많은 TCP 연결을 사용할 수 있습니다.",
@@ -2382,7 +2230,7 @@
"description": "최상의 클라이언트 환경을 제공하기 위해 제한을 피합니다.",
"guid": "494347eb-d007-45b5-b13c-9a28ee4f8e9a",
"service": "Azure Files",
- "text": "파일 공유 또는 스토리지 계정이 제한되어 대기 시간이 길거나 처리량이 낮거나 IOPS가 낮을 수 있는 상황이 발생하지 않는지 확인합니다. IOPS, 수신 또는 송신 제한에 도달하면 요청이 제한됩니다. 표준 스토리지 계정의 경우 계정 수준에서 제한이 발생합니다. 프리미엄 파일 공유의 경우 제한은 일반적으로 공유 수준에서 발생합니다.",
+ "text": "파일 공유 또는 스토리지 계정이 제한되어 대기 시간이 길거나 처리량이 낮거나 IOPS가 낮을 수 있는 경우가 아닌지 확인합니다. IOPS, 수신 또는 송신 제한에 도달하면 요청이 제한됩니다. 표준 스토리지 계정의 경우 계정 수준에서 제한이 발생합니다. 프리미엄 파일 공유의 경우 제한은 일반적으로 공유 수준에서 발생합니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -2398,7 +2246,7 @@
"description": "",
"guid": "de630a06-a4a8-4215-bb80-cc89dd3ced08",
"service": "Azure Firewall",
- "text": "더 높은 SLA(서비스 수준 계약)를 위해 여러 가용성 영역에 Azure Firewall을 배포합니다. Azure Firewall은 서비스를 단일 가용성 영역에 배포하는지 아니면 여러 영역에 배포하는지에 따라 다른 SLA를 제공합니다. 자세한 내용은 온라인 서비스에 대한 SLA를 참조하세요.",
+ "text": "더 높은 SLA(서비스 수준 계약)를 위해 여러 가용성 영역에 Azure Firewall을 배포합니다. Azure Firewall은 서비스를 단일 가용성 영역 또는 여러 영역에 배포하는지 여부에 따라 다양한 SLA를 제공합니다. 자세한 내용은 온라인 서비스에 대한 SLA를 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -2406,7 +2254,7 @@
"description": "",
"guid": "be394cd4-78f2-4737-8d8d-ec8f83193584",
"service": "Azure Firewall",
- "text": "다중 지역 환경의 각 지역에 Azure Firewall 인스턴스를 배포합니다. 기존 허브 및 스포크 아키텍처의 경우 다중 지역 고려 사항을 참조하세요. 보안 Azure Virtual WAN 허브의 경우 라우팅 의도 및 정책을 구성하여 허브 간 및 분기 간 통신을 보호합니다. 오류 방지 및 내결함성 워크로드의 경우 Azure Firewall 및 Azure Virtual Network의 인스턴스를 지역 리소스로 간주합니다.",
+ "text": "다중 지역 환경의 각 지역에 Azure Firewall 인스턴스를 배포합니다. 기존 허브 및 스포크 아키텍처는 다중 지역 고려 사항을 참조하세요. 보안 Azure Virtual WAN 허브의 경우 허브 간 및 분기 간 통신을 보호하도록 라우팅 의도 및 정책을 구성합니다. 오류 방지 및 내결함성 워크로드의 경우 Azure Firewall 및 Azure Virtual Network 인스턴스를 지역 리소스로 간주합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -2427,7 +2275,7 @@
"waf": "신뢰도"
},
{
- "description": "여러 가용성 영역에 Azure Firewall을 배포하여 특정 수준의 복원력을 유지합니다. 한 영역에서 중단이 발생하면 다른 영역에서 트래픽을 계속 처리합니다.",
+ "description": "여러 가용성 영역에 Azure Firewall을 배포하여 특정 수준의 복원력을 유지합니다. 한 영역에서 중단이 발생하면 다른 영역에서 계속 트래픽을 처리합니다.",
"guid": "13571efe-01ca-4dd1-8cc8-fe95125e3bf2",
"service": "Azure Firewall",
"text": "여러 가용성 영역에 Azure Firewall을 배포합니다.",
@@ -2446,15 +2294,15 @@
"description": "Azure 리소스를 인터넷에 직접 노출하지 않도록 강제 터널링을 사용합니다. 이 접근 방식은 공격 표면을 줄이고 외부 위협의 위험을 최소화합니다. 회사 정책 및 규정 준수 요구 사항을 보다 효과적으로 적용하려면 모든 인터넷 바인딩 트래픽을 온-프레미스 방화벽 또는 NVA를 통해 라우팅합니다.",
"guid": "7abca50a-05ca-41fc-8485-cd536ba9ec86",
"service": "Azure Firewall",
- "text": "모든 인터넷 바인딩 트래픽을 인터넷으로 직접 라우팅하는 대신 지정된 다음 홉으로 라우팅해야 하는 경우 강제 터널링 모드에서 Azure Firewall을 구성합니다. 이 권장 사항은 Virtual WAN에는 적용되지 않습니다.
Azure Firewall은 인터넷에 직접 연결되어 있어야 합니다. AzureFirewallSubnet이 Border Gateway Protocol을 통해 온-프레미스 네트워크에 대한 기본 경로를 학습하는 경우 강제 터널링 모드에서 Azure Firewall을 구성해야 합니다. 강제 터널링 기능을 사용하여 Azure Firewall 관리 서브넷에 대한 다른 /26 주소 공간을 추가할 수 있습니다. 서브넷 이름을 AzureFirewallManagementSubnet으로 지정합니다. 강제 터널링 모드에서 다시 구성할 수 없는 기존 Azure Firewall 인스턴스가 있는 경우 0.0.0.0/0 경로를 사용하여 UDR을 만듭니다. NextHopType 값을 Internet으로 설정합니다. 인터넷 연결을 유지하려면 UDR을 AzureFirewallSubnet과 연결합니다. 강제 터널링 모드에서 Azure Firewall을 구성할 때 완전한 프라이빗 데이터 평면을 배포하려면 공용 IP 주소를 없음으로 설정합니다. 그러나 관리 평면에는 여전히 관리 목적으로만 공용 IP가 필요합니다. 가상 및 온-프레미스 네트워크의 내부 트래픽은 해당 공용 IP를 사용하지 않습니다.",
+ "text": "모든 인터넷 바인딩 트래픽을 인터넷으로 직접 라우팅하는 대신 지정된 다음 홉으로 라우팅해야 하는 경우 강제 터널링 모드에서 Azure Firewall을 구성합니다. 이 권장 사항은 Virtual WAN에는 적용되지 않습니다.
Azure Firewall은 인터넷에 직접 연결되어 있어야 합니다. AzureFirewallSubnet이 Border Gateway Protocol을 통해 온-프레미스 네트워크에 대한 기본 경로를 학습하는 경우 강제 터널링 모드에서 Azure Firewall을 구성해야 합니다. 강제 터널링 기능을 사용하여 Azure Firewall 관리 서브넷에 대한 다른 /26 주소 공간을 추가할 수 있습니다. 서브넷 이름을 AzureFirewallManagementSubnet으로 지정합니다. 강제 터널링 모드에서 다시 구성할 수 없는 기존 Azure Firewall 인스턴스가 있는 경우 0.0.0.0/0 경로를 사용하여 UDR을 만듭니다. NextHopType 값을 Internet으로 설정합니다. 인터넷 연결을 유지하려면 UDR을 AzureFirewallSubnet과 연결합니다. 강제 터널링 모드에서 Azure Firewall을 구성할 때 완전 프라이빗 데이터 평면을 배포하려면 공용 IP 주소를 없음으로 설정합니다. 그러나 관리 플레인에는 관리 목적으로만 공용 IP가 필요합니다. 가상 및 온-프레미스 네트워크의 내부 트래픽은 해당 공용 IP를 사용하지 않습니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "세분화된 정책이 특정 지역의 요구 사항을 충족할 수 있도록 계층적 구조로 규칙을 구성합니다. 각 정책에는 특정 우선 순위, 작업 및 처리 순서가 있는 서로 다른 DNAT(Destination Network Address Translation), 네트워크 및 애플리케이션 규칙 집합이 포함될 수 있습니다.",
+ "description": "세분화된 정책이 특정 지역의 요구 사항을 충족할 수 있도록 계층 구조로 규칙을 구성합니다. 각 정책에는 특정 우선 순위, 작업 및 처리 순서가 있는 서로 다른 DNAT(Destination Network Address Translation), 네트워크 및 애플리케이션 규칙 집합이 포함될 수 있습니다.",
"guid": "0d9c6369-6b1b-49db-8198-68f2344273d8",
"service": "Azure Firewall",
- "text": "계층 구조에서 방화벽 정책에 대한 규칙을 만들어 중앙 기본 정책을 오버레이합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.
최소 권한 액세스 Zero Trust 원칙에 따라 규칙 만들기Create your rules based on the least-privilege access Zero Trust principle",
+ "text": "계층 구조에서 방화벽 정책에 대한 규칙을 만들어 중앙 기본 정책을 오버레이합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.
최소 권한 액세스 제로 트러스트 원칙에 따라 규칙 만들기Create your rules based on the least-privilege access Zero Trust principle",
"type": "recommendation",
"waf": "안전"
},
@@ -2462,12 +2310,12 @@
"description": "Azure Firewall의 보안 파트너 공급자가 인터넷 트래픽에 대한 고급 보호를 제공하는 동급 최고의 클라우드 보안 제품을 활용할 수 있도록 합니다. 이러한 제공업체는 전문화된 사용자 인식 필터링 및 포괄적인 위협 탐지 기능을 제공하여 전반적인 보안 태세를 강화합니다.",
"guid": "7bfae9e9-d97d-4d04-97a6-7eb31a73ed10",
"service": "Azure Firewall",
- "text": "아웃바운드 연결을 보호하기 위해 Firewall Manager 내에서 지원되는 보안 파트너 공급자를 구성합니다.
이 시나리오에서는 IPsec 터널을 사용하여 공급자의 인프라에 연결하기 때문에 허브에 S2S VPN 게이트웨이가 있는 Virtual WAN이 필요합니다. 관리형 보안 서비스 제공업체는 추가 라이선스 비용을 부과하고 IPsec 연결의 처리량을 제한할 수 있습니다. Zscaler Cloud Connector와 같은 대체 솔루션을 사용할 수도 있습니다.",
+ "text": "아웃바운드 연결을 보호하기 위해 Firewall Manager 내에서 지원되는 보안 파트너 공급자를 구성합니다.
이 시나리오에서는 IPsec 터널을 사용하여 공급자의 인프라에 연결하기 때문에 허브에 S2S VPN 게이트웨이가 있는 Virtual WAN이 필요합니다. 관리형 보안 서비스 제공업체는 추가 라이선스 비용을 부과하고 IPsec 연결에 대한 처리량을 제한할 수 있습니다. Zscaler Cloud Connector와 같은 대체 솔루션을 사용할 수도 있습니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "이 기능을 사용하면 가상 네트워크의 클라이언트가 DNS 서버로 Azure Firewall을 가리킬 수 있습니다. 이 기능은 직접 액세스 및 노출되지 않는 내부 DNS 인프라를 보호합니다.",
+ "description": "이 기능을 사용하면 가상 네트워크의 클라이언트가 DNS 서버로 Azure Firewall 가리킵니다. 이 기능은 직접 액세스 및 노출되지 않는 내부 DNS 인프라를 보호합니다.",
"guid": "68949fe5-365d-4c55-b909-d52c39d24b6d",
"service": "Azure Firewall",
"text": "Azure Firewall DNS 프록시 구성을 사용하도록 설정합니다.
또한 DNS 쿼리를 전달하는 데 사용자 지정 DNS를 사용하도록 Azure Firewall을 구성합니다.",
@@ -2478,7 +2326,7 @@
"description": "방화벽을 통해 트래픽을 전송하여 트래픽을 검사하고 악성 트래픽을 식별 및 차단할 수 있습니다.
웹 트래픽이 방화벽의 개인 IP 주소에 도달하여 UDR을 사용하지 않고 방화벽에서 직접 나가도록 Azure Firewall을 아웃바운드 트래픽에 대한 명시적 프록시로 사용합니다. 또한 이 기능을 사용하면 기존 네트워크 경로를 수정하지 않고도 여러 방화벽을 쉽게 사용할 수 있습니다.",
"guid": "7269ebdb-4f21-41f7-846b-b0f90145a8ca",
"service": "Azure Firewall",
- "text": "스포크-스포크, 스포크-인터넷 및 스포크-하이브리드 연결을 위한 기존 허브 및 스포크 아키텍처에서 Azure Firewall을 통해 트래픽을 강제 적용하도록 UDR을 구성합니다.
Virtual WAN에서 허브에 통합된 Azure Firewall 인스턴스를 통해 프라이빗 트래픽 또는 인터넷 트래픽을 리디렉션하도록 라우팅 의도 및 정책을 구성합니다.
UDR을 적용할 수 없고 웹 트래픽 리디렉션만 필요한 경우 아웃바운드 경로에서 Azure Firewall을 명시적 프록시로 사용합니다. Azure Firewall을 프록시로 구성할 때 웹 브라우저와 같은 전송 애플리케이션에서 프록시 설정을 구성할 수 있습니다.",
+ "text": "스포크 투 스포크, 스포크 투 스포크 및 스포크-하이브리드 연결을 위한 기존 허브 및 스포크 아키텍처에서 Azure Firewall을 통해 트래픽을 강제 적용하도록 UDR을 구성합니다.
Virtual WAN에서 허브에 통합된 Azure Firewall 인스턴스를 통해 프라이빗 트래픽 또는 인터넷 트래픽을 리디렉션하도록 라우팅 의도 및 정책을 구성합니다.
UDR을 적용할 수 없고 웹 트래픽 리디렉션만 필요한 경우 아웃바운드 경로에서 Azure Firewall을 명시적 프록시로 사용합니다. Azure Firewall을 프록시로 구성할 때 웹 브라우저와 같은 전송 애플리케이션에서 프록시 설정을 구성할 수 있습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2515,10 +2363,10 @@
"waf": "안전"
},
{
- "description": "Azure Firewall에서 IDPS 필터링을 사용하도록 설정하면 네트워크 트래픽에 대한 실시간 모니터링 및 분석을 제공하여 악의적인 활동을 감지하고 방지할 수 있습니다. 이 기능은 시그니처 기반 탐지를 사용하여 알려진 위협을 신속하게 식별하고 피해를 입히기 전에 차단합니다. 자세한 내용은 남용 감지를 참조하세요.",
+ "description": "Azure Firewall에서 IDPS 필터링 사용은 네트워크 트래픽에 대한 실시간 모니터링 및 분석을 제공하여 악의적인 활동을 감지하고 방지합니다. 이 기능은 시그니처 기반 탐지를 사용하여 알려진 위협을 신속하게 식별하고 피해를 입히기 전에 차단합니다. 자세한 내용은 남용 감지를 참조하세요.",
"guid": "053202f4-db7d-4b08-ad61-c5d0037b713a",
"service": "Azure Firewall",
- "text": "경고 또는 경고 및 거부 모드에서 IDPS를 활성화합니다. 이 기능이 성능에 미치는 영향을 고려합니다.",
+ "text": "경고 또는 경고 및 거부 모드에서 IDPS를 사용하도록 설정합니다. 이 기능이 성능에 미치는 영향을 고려합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2542,7 +2390,7 @@
"description": "",
"guid": "9220cde5-ecbc-4eb1-a5ac-65e56e2aa925",
"service": "Azure Firewall",
- "text": "배포할 Azure Firewall SKU를 선택합니다. 세 가지 Azure Firewall SKU(기본, 표준 및 프리미엄) 중에서 선택합니다. Azure Firewall 프리미엄을 사용하여 결제 처리와 같은 매우 중요한 애플리케이션을 보호합니다. 워크로드에 계층 3에서 계층 7 방화벽이 필요하고 최대 30Gbps의 최대 트래픽 기간을 처리하기 위해 자동 크기 조정이 필요한 경우 Azure Firewall 표준을 사용합니다. SMB를 사용하고 최대 250Mbps의 처리량이 필요한 경우 Azure Firewall Basic을 사용합니다. 표준 SKU와 프리미엄 SKU 간에 다운그레이드하거나 업그레이드할 수 있습니다. 자세한 내용은 올바른 Azure Firewall SKU 선택을 참조하세요.",
+ "text": "배포할 Azure Firewall SKU를 선택합니다. 세 가지 Azure Firewall SKU(기본, 표준 및 프리미엄) 중에서 선택합니다. Azure Firewall 프리미엄을 사용하여 결제 처리와 같은 매우 중요한 애플리케이션을 보호합니다. 워크로드에 계층 3에서 계층 7 방화벽이 필요하고 최대 30Gbps의 최대 트래픽 기간을 처리하기 위해 자동 크기 조정이 필요한 경우 Azure Firewall 표준을 사용합니다. SMB를 사용하고 최대 250Mbps의 처리량이 필요한 경우 Azure Firewall 기본을 사용합니다. 표준 SKU와 프리미엄 SKU 간에 다운그레이드하거나 업그레이드할 수 있습니다. 자세한 내용은 올바른 Azure Firewall SKU 선택을 참조하세요.",
"type": "checklist",
"waf": "비용"
},
@@ -2566,7 +2414,7 @@
"description": "",
"guid": "0976c680-8f44-46f9-ae4d-2349eaafd800",
"service": "Azure Firewall",
- "text": "방화벽을 통한 트래픽을 최적화합니다. Azure Firewall이 처리하는 트래픽을 정기적으로 검토합니다. 방화벽을 통과하는 트래픽의 양을 줄일 수 있는 기회를 찾습니다.",
+ "text": "방화벽을 통한 트래픽을 최적화합니다. Azure Firewall에서 처리하는 트래픽을 정기적으로 검토합니다. 방화벽을 통과하는 트래픽의 양을 줄일 수 있는 기회를 찾습니다.",
"type": "checklist",
"waf": "비용"
},
@@ -2574,7 +2422,7 @@
"description": "",
"guid": "debc5298-dba5-4c67-a03a-1ca626025139",
"service": "Azure Firewall",
- "text": "저장하는 로그 데이터의 양을 줄입니다. Azure Firewall은 Azure Event Hubs를 사용하여 트래픽의 메타데이터를 포괄적으로 기록하고 Log Analytics 작업 영역, Azure Storage 또는 타사 솔루션으로 보낼 수 있습니다. 모든 로깅 솔루션에는 데이터를 처리하고 스토리지를 제공하는 데 비용이 발생합니다. 많은 양의 데이터는 상당한 비용을 초래할 수 있습니다. Log Analytics에 대한 비용 효율적인 접근 방식 및 대안을 고려하고 비용을 예측합니다. 모든 로깅 범주에 대한 트래픽 메타데이터를 기록해야 하는지 여부를 고려합니다.",
+ "text": "저장하는 로그 데이터의 양을 줄입니다. Azure Firewall은 Azure Event Hubs를 사용하여 트래픽의 메타데이터를 포괄적으로 기록하고 Log Analytics 작업 영역, Azure Storage 또는 타사 솔루션으로 보낼 수 있습니다. 모든 로깅 솔루션에는 데이터를 처리하고 스토리지를 제공하는 데 비용이 발생합니다. 많은 양의 데이터에는 상당한 비용이 발생할 수 있습니다. Log Analytics에 대한 비용 효율적인 접근 방식과 대안을 고려하고 비용을 예측합니다. 모든 로깅 범주에 대한 트래픽 메타데이터를 기록해야 하는지 여부를 고려합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -2587,10 +2435,10 @@
"waf": "비용"
},
{
- "description": "방화벽을 통해 가장 많은 트래픽을 생성하는 워크로드를 최적화하여 트래픽 볼륨을 줄임으로써 방화벽의 부하를 줄이고 데이터 처리 및 대역폭 비용을 최소화합니다.",
+ "description": "방화벽을 통해 가장 많은 트래픽을 생성하는 워크로드를 최적화하여 트래픽 볼륨을 줄여 방화벽의 부하를 줄이고 데이터 처리 및 대역폭 비용을 최소화합니다.",
"guid": "fcd6975c-5cb6-4716-9bab-fe8e7cd50e00",
"service": "Azure Firewall",
- "text": "Azure Firewall이 처리하는 트래픽을 정기적으로 검토하고 원래 워크로드 최적화를 찾습니다. 팻 흐름 로그라고도 하는 상위 흐름 로그는 방화벽을 통해 가장 높은 처리량에 기여하는 상위 연결을 보여 줍니다.",
+ "text": "Azure Firewall에서 처리하는 트래픽을 정기적으로 검토하고 원래 워크로드 최적화를 찾습니다. 뚱뚱한 흐름 로그라고도 하는 상위 흐름 로그는 방화벽을 통해 가장 높은 처리량에 기여하는 상위 연결을 보여 줍니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -2606,7 +2454,7 @@
"description": "Firewall Manager 및 해당 정책을 적절하게 사용하여 운영 비용을 절감하고 효율성을 높이며 관리 오버헤드를 줄입니다.",
"guid": "0afd66fd-36c6-44ad-8e71-cd3b247c6816",
"service": "Azure Firewall",
- "text": "Firewall Manager 정책, 연결 및 상속을 신중하게 검토하여 비용을 최적화합니다. 정책은 방화벽 연결을 기준으로 요금이 청구됩니다. 방화벽 연결이 0개 또는 1개인 정책은 무료입니다. 여러 방화벽 연결이 있는 정책은 고정 요율로 청구됩니다. 자세한 내용은 Firewall Manager 요금을 참조하세요.",
+ "text": "Firewall Manager 정책, 연결 및 상속을 신중하게 검토하여 비용을 최적화합니다. 정책은 방화벽 연결을 기준으로 청구됩니다. 방화벽 연결이 0개 또는 1개 있는 정책은 무료입니다. 여러 방화벽 연결이 있는 정책은 고정 요율로 청구됩니다. 자세한 내용은 Firewall Manager 요금을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -2614,7 +2462,7 @@
"description": "사용하지 않는 IP 주소를 삭제하여 비용을 절감합니다.",
"guid": "2cbff8d4-4f59-42dc-b186-58f7c4965dbe",
"service": "Azure Firewall",
- "text": "구성의 모든 공용 IP 주소를 검토하고 사용하지 않는 IP 주소의 연결을 끊고 삭제합니다. IP 주소를 제거하기 전에 원본 SNAT(네트워크 주소 변환) 포트 사용량을 평가합니다. 자세한 내용은 Azure Firewall 로그 및 메트릭 모니터링 및 SNAT 포트 사용량을 참조하세요.",
+ "text": "구성의 모든 공용 IP 주소를 검토하고 사용하지 않는 IP 주소의 연결을 끊고 삭제합니다. IP 주소를 제거하기 전에 SNAT(원본 네트워크 주소 변환) 포트 사용량을 평가합니다. 자세한 내용은 Azure Firewall 로그 및 메트릭 모니터링 및 SNAT 포트 사용량을 참조하세요.",
"type": "recommendation",
"waf": "비용"
},
@@ -2630,7 +2478,7 @@
"description": "",
"guid": "8271c7ff-1472-4a86-ab05-0538a869631c",
"service": "Azure Firewall",
- "text": "Azure Policy 아티팩트의 정기적인 백업을 유지 관리합니다. 코드형 인프라 접근 방식을 사용하여 Azure Firewall 및 모든 종속성을 유지 관리하는 경우 Azure Firewall 정책의 백업 및 버전 관리가 있어야 합니다. 그렇지 않은 경우 외부 논리 앱을 기반으로 하는 도우미 메커니즘을 배포하여 효과적인 자동화 솔루션을 제공할 수 있습니다.",
+ "text": "Azure Policy 아티팩트의 정기적인 백업을 유지 관리합니다. 코드로서의 인프라 접근 방식을 사용하여 Azure Firewall 및 모든 종속성을 유지 관리하는 경우 Azure Firewall 정책의 백업 및 버전 관리가 있어야 합니다. 그렇지 않은 경우 외부 논리 앱을 기반으로 하는 도우미 메커니즘을 배포하여 효과적인 자동화된 솔루션을 제공할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -2670,12 +2518,12 @@
"description": "진단 로그를 사용하도록 설정하여 Azure Firewall에 대한 모니터링 도구 및 전략을 최적화합니다. 구조화된 방화벽 로그를 사용하여 로그 데이터를 구조화하여 쉽게 검색, 필터링 및 분석할 수 있습니다. 최신 모니터링 도구는 이러한 유형의 로그를 기반으로 하므로 필수 구성 요소인 경우가 많습니다.",
"guid": "1069db41-1f8c-43b3-a25f-9981cc78e397",
"service": "Azure Firewall",
- "text": "Azure Firewall에 대한 진단 로그를 사용하도록 설정합니다. 방화벽 로그 또는 통합 문서를 사용하여 Azure Firewall을 모니터링합니다. 활동 로그를 사용하여 Azure Firewall 리소스에 대한 작업을 감사할 수도 있습니다. 구조화된 방화벽 로그 형식을 사용합니다. 이전 진단 로그 형식은 필요한 기존 도구가 있는 경우에만 사용합니다. 두 로깅 형식을 동시에 사용하도록 설정하지 마세요.",
+ "text": "Azure Firewall에 대한 진단 로그를 사용하도록 설정합니다. 방화벽 로그 또는 통합 문서를 사용하여 Azure Firewall을 모니터링합니다. 활동 로그를 사용하여 Azure Firewall 리소스에 대한 작업을 감사할 수도 있습니다. 구조적 방화벽 로그 형식을 사용합니다. 이전 진단 로그 형식은 필요한 기존 도구가 있는 경우에만 사용합니다. 두 로깅 형식을 동시에 사용하도록 설정하지 마세요.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "Azure Firewall 통합 문서를 사용하여 Azure Firewall 이벤트에서 중요한 인사이트를 추출하고, 애플리케이션 및 네트워크 규칙을 분석하고, URL, 포트 및 주소에서 방화벽 활동에 대한 통계를 검토할 수 있습니다.",
+ "description": "Azure Firewall 통합 문서를 사용하여 Azure Firewall 이벤트에서 중요한 인사이트를 추출하고, 애플리케이션 및 네트워크 규칙을 분석하고, URL, 포트 및 주소에서 방화벽 활동에 대한 통계를 검사할 수 있습니다.",
"guid": "3e10f8ea-c20e-4374-9e58-52969a407dc5",
"service": "Azure Firewall",
"text": "기본 제공 Azure Firewall 통합 문서를 사용합니다.",
@@ -2710,7 +2558,7 @@
"description": "",
"guid": "9e42071b-fe43-455d-afa9-5ed2c33c7d20",
"service": "Azure Firewall",
- "text": "Well-Architected Framework 권장 사항에 따라 Azure Firewall 구성을 최적화하여 코드 및 인프라를 최적화하고 최대 작업을 보장합니다. 효율적이고 안전한 네트워크를 유지하려면 방화벽 규칙을 정기적으로 검토하고 최적화해야 합니다. 이 방법은 방화벽 구성이 유효하고 최신 보안 위협에 대해 최신 상태로 유지되도록 하는 데 도움이 됩니다.",
+ "text": "Well-Architected Framework 권장 사항에 따라 Azure Firewall 구성을 최적화하여 코드 및 인프라를 최적화하고 최대 작업을 보장합니다. 효율적이고 안전한 네트워크를 유지하려면 방화벽 규칙을 정기적으로 검토하고 최적화해야 합니다. 이 방법은 방화벽 구성이 최신 보안 위협에 대해 효과적이고 최신 상태로 유지되도록 하는 데 도움이 됩니다.",
"type": "checklist",
"waf": "공연"
},
@@ -2726,7 +2574,7 @@
"description": "",
"guid": "c3ae17a3-eff4-4f6e-98b9-df3a59bacfd9",
"service": "Azure Firewall",
- "text": "성능 테스트 전에 Azure Firewall을 적절하게 워밍업합니다. 테스트 20분 전에 부하 테스트에 포함되지 않은 초기 트래픽을 만듭니다. 진단 설정을 사용하여 스케일 업 및 스케일 다운 이벤트를 캡처합니다. Azure Load Testing 서비스를 사용하여 초기 트래픽을 생성할 수 있으므로 Azure Firewall을 최대 인스턴스 수로 확장할 수 있습니다.",
+ "text": "성능 테스트 전에 Azure Firewall을 적절하게 워밍업합니다. 테스트 20분 전에 부하 테스트의 일부가 아닌 초기 트래픽을 만듭니다. 진단 설정을 사용하여 스케일 업 및 스케일 다운 이벤트를 캡처합니다. Azure Load Testing 서비스를 사용하여 초기 트래픽을 생성할 수 있으므로 Azure Firewall을 최대 인스턴스 수로 확장할 수 있습니다.",
"type": "checklist",
"waf": "공연"
},
@@ -2755,15 +2603,15 @@
"waf": "공연"
},
{
- "description": "자주 사용하는 규칙을 규칙 집합의 상위에 배치하여 처리 대기 시간을 최적화합니다. Azure Firewall은 규칙 유형, 상속, 규칙 컬렉션 그룹 우선 순위 및 규칙 컬렉션 우선 순위에 따라 규칙을 처리합니다. Azure Firewall은 우선 순위가 높은 규칙 컬렉션 그룹을 먼저 처리합니다. 규칙 컬렉션 그룹 내에서 Azure Firewall은 우선 순위가 가장 높은 규칙 컬렉션을 먼저 처리합니다.",
+ "description": "자주 사용하는 규칙을 규칙 집합의 높은 위치에 배치하여 처리 대기 시간을 최적화합니다. Azure Firewall은 규칙 유형, 상속, 규칙 컬렉션 그룹 우선 순위 및 규칙 컬렉션 우선 순위에 따라 규칙을 처리합니다. Azure Firewall은 우선 순위가 높은 규칙 컬렉션 그룹을 먼저 처리합니다. 규칙 컬렉션 그룹 내에서 Azure Firewall은 우선 순위가 가장 높은 규칙 컬렉션을 먼저 처리합니다.",
"guid": "ce0fa221-61f9-41ab-a9ed-233f5546d732",
"service": "Azure Firewall",
- "text": "자주 사용하는 규칙을 그룹의 초기에 배치하여 규칙 집합이 큰 Azure Firewall 정책에 대한 대기 시간을 최적화합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.",
+ "text": "자주 사용하는 규칙을 그룹의 초기에 배치하여 큰 규칙 집합이 있는 Azure Firewall 정책에 대한 대기 시간을 최적화합니다. 자세한 내용은 Azure Firewall 정책을 사용하여 규칙 처리를 참조하세요.",
"type": "recommendation",
"waf": "공연"
},
{
- "description": "이 방법을 사용하면 제한을 초과하지 않고 처리할 수 있는 IP 주소 수가 효과적으로 늘어납니다. 각 규칙에 대해 Azure는 포트에 IP 주소를 곱합니다. 따라서 한 규칙에 4개의 IP 주소 범위와 5개의 포트가 있는 경우 20개의 네트워크 규칙을 사용합니다.",
+ "description": "이 방법을 사용하면 제한을 초과하지 않고 처리할 수 있는 IP 주소 수를 효과적으로 늘릴 수 있습니다. 각 규칙에 대해 Azure는 포트에 IP 주소를 곱합니다. 따라서 하나의 규칙에 4개의 IP 주소 범위와 5개의 포트가 있는 경우 20개의 네트워크 규칙을 사용합니다.",
"guid": "1d2f023e-7dcf-4f55-b07f-1a93c9c0ab4e",
"service": "Azure Firewall",
"text": "IP 그룹을 사용하여 IP 주소 범위를 요약하고 고유한 원본 또는 고유한 대상 네트워크 규칙의 제한을 초과하지 않도록 합니다. Azure Firewall은 네트워크 규칙을 만들 때 IP 그룹을 단일 주소로 처리합니다.",
@@ -2779,7 +2627,7 @@
"waf": "공연"
},
{
- "description": "경고 및 거부 모드에서 IDPS를 활성화하여 악의적인 네트워크 활동을 탐지하고 방지합니다. 이 기능을 사용하면 성능이 저하될 수 있습니다. 그에 따라 계획할 수 있도록 워크로드에 미치는 영향을 이해합니다.",
+ "description": "경고 및 거부 모드에서 IDPS를 활성화하여 악의적인 네트워크 활동을 탐지하고 방지합니다. 이 기능으로 인해 성능 저하가 발생할 수 있습니다. 그에 따라 계획할 수 있도록 업무량에 미치는 영향을 이해합니다.",
"guid": "984c7d68-82f6-48e9-a894-a8e7717d49e2",
"service": "Azure Firewall",
"text": "경고 및 거부 모드에서 IDPS의 성능 영향을 평가합니다. 자세한 내용은 Azure Firewall 성능을 참조하세요.",
@@ -2798,7 +2646,7 @@
"description": "",
"guid": "59ed40bd-06a0-4125-ab99-afc88a248aa5",
"service": "Azure Front Door",
- "text": "트래픽 패턴과 볼륨을 추정합니다. 클라이언트에서 Azure Front Door 에지로의 요청 수는 계층 선택에 영향을 줄 수 있습니다. 많은 양의 요청을 지원해야 하는 경우 성능이 궁극적으로 가용성에 영향을 미치므로 Azure Front Door 프리미엄 계층을 고려합니다. 그러나 비용 절충안이 있습니다. 이러한 계층은 성능 효율성에 설명되어 있습니다.",
+ "text": "트래픽 패턴과 볼륨을 추정합니다. 클라이언트에서 Azure Front Door 에지에 대한 요청 수는 계층 선택에 영향을 줄 수 있습니다. 많은 양의 요청을 지원해야 하는 경우 성능이 궁극적으로 가용성에 영향을 미치므로 Azure Front Door 프리미엄 계층을 고려합니다. 그러나 비용 절충안이 있습니다. 이러한 계층은 성능 효율성에 설명되어 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -2822,7 +2670,7 @@
"description": "",
"guid": "9bc96e35-d25f-4521-86f8-8cadefb23576",
"service": "Azure Front Door",
- "text": "상태 엔드포인트 모니터링 패턴을 구현합니다. 응용 프로그램은 응용 프로그램이 요청을 처리하는 데 필요한 중요한 서비스 및 종속성의 상태를 집계하는 상태 엔드포인트를 노출해야 합니다. Azure Front Door 상태 프로브는 엔드포인트를 사용하여 원본 서버의 상태를 감지합니다. 자세한 내용은 상태 엔드포인트 모니터링 패턴을 참조하세요.",
+ "text": "상태 엔드포인트 모니터링 패턴을 구현합니다. 응용 프로그램은 응용 프로그램이 요청을 처리하는 데 필요한 중요한 서비스 및 종속성의 상태를 집계하는 상태 엔드포인트를 노출해야 합니다. Azure Front Door 상태 프로브는 엔드포인트를 사용하여 원본 서버의 상태를 검색합니다. 자세한 내용은 상태 엔드포인트 모니터링 패턴을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -2838,15 +2686,15 @@
"description": "",
"guid": "750bc3ba-30aa-44fc-88aa-bc93cdf29cdf",
"service": "Azure Front Door",
- "text": "중복 트래픽 관리 옵션을 고려합니다. Azure Front Door는 환경에서 싱글톤으로 실행되는 전역적으로 분산된 서비스입니다. Azure Front Door는 시스템에서 발생할 수 있는 단일 실패 지점입니다. 서비스가 실패하면 클라이언트는 가동 중지 시간 동안 애플리케이션에 액세스할 수 없습니다.",
+ "text": "중복 트래픽 관리 옵션을 고려하십시오. Azure Front Door는 환경에서 싱글톤으로 실행되는 전역적으로 분산된 서비스입니다. Azure Front Door는 시스템에서 발생할 수 있는 단일 실패 지점입니다. 서비스가 실패하면 클라이언트는 가동 중지 시간 동안 애플리케이션에 액세스할 수 없습니다.",
"type": "checklist",
"waf": "신뢰도"
},
{
- "description": "일련의 결정 단계와 설계를 사용하여 최상의 원본 리소스를 선택할 수 있습니다. 선택한 오리진은 지정된 가중치 비율로 허용 가능한 지연 시간 범위 내에서 트래픽을 처리합니다.",
+ "description": "일련의 의사 결정 단계와 설계를 사용하여 최상의 원본 리소스를 선택할 수 있습니다. 선택한 오리진은 지정된 가중치 비율로 허용 가능한 지연 시간 범위 내에서 트래픽을 처리합니다.",
"guid": "1a6fba56-5098-4506-9be0-940fe556996c",
"service": "Azure Front Door",
- "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 보조 지역으로 트래픽을 백업으로 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 앞의 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
+ "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 적용 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 백업으로 보조 지역으로 트래픽을 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 이전 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -2854,9 +2702,9 @@
"description": "다중 오리진은 애플리케이션의 여러 인스턴스에 트래픽을 분산하여 중복성을 지원합니다. 한 인스턴스를 사용할 수 없는 경우 다른 백 엔드 오리진은 여전히 트래픽을 수신할 수 있습니다.",
"guid": "00f51ce2-46a9-4051-ab0e-762743d0837d",
"service": "Azure Front Door",
- "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 가지고 있으며 각 인스턴스가 끝점 또는 원본을 노출하는지 확인하십시오. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
+ "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 사용하고 각 인스턴스가 끝점 또는 원본을 노출하는지 확인합니다. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
"type": "recommendation",
- "waf": null
+ "waf": "신뢰도"
},
{
"description": "사용하도록 설정된 상태 프로브는 상태 모니터링 패턴 구현의 일부입니다. 상태 프로브는 Azure Front Door가 요청을 처리할 수 있을 만큼 건강한 인스턴스로만 트래픽을 라우팅하도록 합니다. 자세한 내용은 상태 프로브에 대한 모범 사례를 참조하세요.",
@@ -2875,10 +2723,10 @@
"waf": "신뢰도"
},
{
- "description": "세션 어피니티(affinity), 인증(authentication), 권한 부여(authorization)로 인한 오작동을 방지하기 위해 동일한 호스트 이름을 설정합니다. 자세한 내용은 역방향 프록시와 해당 백 엔드 웹 응용 프로그램 간의 원래 HTTP 호스트 이름 유지를 참조하세요.",
+ "description": "세션 어피니티(affinity), 인증(authentication), 권한 부여(authorization)로 인한 오작동을 방지하기 위해 동일한 호스트 이름을 설정합니다. 자세한 내용은 역방향 프록시와 해당 백 엔드 웹 응용 프로그램 간에 원래 HTTP 호스트 이름 유지를 참조하세요.",
"guid": "7af90aa7-b21f-432f-858b-2d872c752d7f",
"service": "Azure Front Door",
- "text": "Azure Front Door 및 원본에서 동일한 호스트 이름을 사용합니다. Azure Front Door는 들어오는 요청의 호스트 헤더를 다시 쓸 수 있으며, 이는 하나의 원본으로 라우팅되는 여러 사용자 지정 도메인 이름이 있는 경우에 유용합니다. 그러나 호스트 헤더를 다시 작성하면 요청 쿠키 및 URL 리디렉션에 문제가 발생할 수 있습니다.",
+ "text": "Azure Front Door 및 원본에서 동일한 호스트 이름을 사용합니다. Azure Front Door는 들어오는 요청의 호스트 헤더를 다시 작성할 수 있으며, 이는 하나의 원본으로 라우팅되는 여러 사용자 지정 도메인 이름이 있는 경우에 유용합니다. 그러나 호스트 헤더를 다시 작성하면 요청 쿠키 및 URL 리디렉션에 문제가 발생할 수 있습니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -2891,7 +2739,7 @@
"waf": "신뢰도"
},
{
- "description": "클라이언트가 애플리케이션에 너무 많은 트래픽을 보내는 것을 방지하기 위해 요청을 제한합니다. 속도 제한은 재시도 폭풍과 같은 문제를 방지하는 데 도움이 될 수 있습니다.",
+ "description": "요청을 제한하여 클라이언트가 애플리케이션에 너무 많은 트래픽을 보내지 않도록 합니다. 속도 제한은 재시도 폭풍과 같은 문제를 방지하는 데 도움이 될 수 있습니다.",
"guid": "63faaf18-da4b-4274-ac3c-d955f2a2e01b",
"service": "Azure Front Door",
"text": "WAF(웹 애플리케이션 방화벽)에 포함된 속도 제한 규칙을 활용합니다.",
@@ -2918,7 +2766,7 @@
"description": "",
"guid": "903b1844-994a-49e8-8e08-6ef445aec4f7",
"service": "Azure Front Door",
- "text": "컨트롤 플레인에 대한 권한 있는 액세스만 허용합니다. Azure Front Door RBAC(역할 기반 액세스 제어)를 사용하여 필요한 ID에 대한 액세스만 제한합니다.",
+ "text": "컨트롤 플레인에 대해 권한이 부여된 액세스만 허용합니다. Azure Front Door RBAC(역할 기반 액세스 제어)를 사용하여 필요한 ID에 대한 액세스만 제한합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -2942,7 +2790,7 @@
"description": "",
"guid": "fcb4a654-3e3b-408c-9538-a1dfefdef774",
"service": "Azure Front Door",
- "text": "전송 중인 데이터를 보호합니다. 엔드투엔드 TLS(전송 계층 보안), HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서를 사용하도록 설정합니다(해당하는 경우). 자세한 내용은 Azure Front Door에 대한 TLS 모범 사례를 참조하세요.",
+ "text": "전송 중인 데이터를 보호합니다. 엔드투엔드 TLS(전송 계층 보안), HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서(해당하는 경우)를 사용하도록 설정합니다. 자세한 내용은 Azure Front Door에 대한 TLS 모범 사례를 참조하세요.",
"type": "checklist",
"waf": "안전"
},
@@ -2958,7 +2806,7 @@
"description": "기본 규칙 집합은 OWASP 상위 10개 공격 유형 및 Microsoft 위협 인텔리전스의 정보에 따라 자주 업데이트됩니다. 특수 규칙 집합은 특정 사용 사례를 감지합니다. 예를 들어, 봇 규칙은 클라이언트 IP 주소를 기반으로 봇을 양호, 불량 또는 알 수 없음으로 분류합니다. 또한 악성 봇과 알려진 IP 주소를 차단하고 호출자의 지리적 위치에 따라 트래픽을 제한합니다. 규칙 집합을 조합하여 사용하면 다양한 의도를 가진 공격을 탐지하고 차단할 수 있습니다.",
"guid": "711c450c-ac42-4570-b2fd-22319b4a7913",
"service": "Azure Front Door",
- "text": "잠재적으로 악의적인 트래픽을 탐지하고 차단하는 WAF 규칙 집합을 사용하도록 설정합니다. 이 기능은 프리미엄 계층에서 사용할 수 있습니다. - 기본- 봇 보호- IP 제한- 지역 필터링- 속도 제한 규칙 집합을 사용하는 것이 좋습니다.",
+ "text": "잠재적으로 악의적인 트래픽을 감지하고 차단하는 WAF 규칙 집합을 사용하도록 설정합니다. 이 기능은 프리미엄 계층에서 사용할 수 있습니다. - 기본- 봇 보호- IP 제한- 지역 필터링- 속도 제한 규칙 집합을 사용하는 것이 좋습니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2966,7 +2814,7 @@
"description": "거짓 긍정을 줄이고 애플리케이션에 대한 합법적인 요청을 허용합니다.",
"guid": "a6fe49f4-0b1f-4677-af1f-b766f073ac6c",
"service": "Azure Front Door",
- "text": "관리형 규칙 집합에 대한 제외를 만듭니다. 몇 주 동안 검색 모드에서 WAF 정책을 테스트하고 배포하기 전에 가양성을 조정합니다.",
+ "text": "관리되는 규칙 집합에 대한 제외를 만듭니다. 몇 주 동안 검색 모드에서 WAF 정책을 테스트하고 배포하기 전에 가양성을 조정합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2974,7 +2822,7 @@
"description": "TLS는 변조를 방지하기 위해 브라우저, Azure Front Door 및 백 엔드 원본 간의 데이터 교환이 암호화되도록 합니다. Key Vault는 관리형 인증서 지원과 간단한 인증서 갱신 및 회전을 제공합니다.",
"guid": "450b511f-9e82-45ce-986b-769ea00dbeaa",
"service": "Azure Front Door",
- "text": "엔드투엔드 TLS, HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서(해당하는 경우)를 사용하도록 설정합니다. Azure Front Door에 대한 TLS 모범 사례를 검토합니다. TLS 버전 1.2를 애플리케이션과 관련된 암호와 함께 허용되는 최소 버전으로 사용합니다. Azure Front Door 관리형 인증서는 작업을 쉽게 하기 위해 기본 선택이어야 합니다. 그러나 인증서의 수명 주기를 관리하려면 Azure Front Door 사용자 지정 도메인 엔드포인트에서 사용자 고유의 인증서를 사용하고 Key Vault에 저장합니다.",
+ "text": "해당되는 경우 엔드투엔드 TLS, HTTP에서 HTTPS로 리디렉션 및 관리형 TLS 인증서를 사용하도록 설정합니다. Azure Front Door에 대한 TLS 모범 사례를 검토합니다. TLS 버전 1.2를 애플리케이션과 관련된 암호와 함께 허용되는 최소 버전으로 사용합니다. Azure Front Door 관리형 인증서는 작업을 쉽게 하기 위해 기본 선택이어야 합니다. 그러나 인증서의 수명 주기를 관리하려면 Azure Front Door 사용자 지정 도메인 엔드포인트에서 사용자 고유의 인증서를 사용하고 Key Vault에 저장합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -2982,7 +2830,7 @@
"description": "",
"guid": "baeb625f-93ac-4181-be7b-07f474584985",
"service": "Azure Front Door",
- "text": "Azure Front Door 계층 및 가격 책정을 검토합니다. 가격 계산기를 사용하여 각 계층의 현실적인 비용을 추정합니다. 시나리오에 대한 각 계층의 기능과 적합성을 비교합니다. 예를 들어 프리미엄 계층만 Private Link를 통해 원본에 연결할 수 있습니다.",
+ "text": "Azure Front Door 계층 및 가격 책정을 검토합니다. 가격 계산기를 사용하여 각 계층의 현실적인 비용을 예측합니다. 시나리오에 대한 각 계층의 기능과 적합성을 비교합니다. 예를 들어 프리미엄 계층만 Private Link를 통해 원본에 연결할 수 있도록 지원합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -3006,7 +2854,7 @@
"description": "",
"guid": "337e7030-494e-4be5-8920-9144cb02c399",
"service": "Azure Front Door",
- "text": "리소스를 효율적으로 사용합니다. Azure Front Door는 리소스 최적화에 도움이 되는 라우팅 방법을 사용합니다. 워크로드가 대기 시간에 매우 민감하지 않는 한, 배포된 리소스를 효과적으로 사용할 수 있도록 모든 환경에서 트래픽을 균등하게 분산합니다.",
+ "text": "리소스를 효율적으로 사용합니다. Azure Front Door는 리소스 최적화에 도움이 되는 라우팅 방법을 사용합니다. 워크로드가 대기 시간에 매우 민감하지 않는 한 모든 환경에서 트래픽을 균등하게 분산하여 배포된 리소스를 효과적으로 사용합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -3046,7 +2894,7 @@
"description": "라우팅 결정을 내리는 데 필요하지 않은 요청을 비활성화하여 대역폭 비용을 절약할 수 있습니다.",
"guid": "5d3ad5cb-d897-4ae7-8d1c-ae8398c79ed6",
"service": "Azure Front Door",
- "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성된 경우 이러한 호출이 필요하지 않습니다.",
+ "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성되어 있는 경우 이러한 호출이 필요하지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -3078,7 +2926,7 @@
"description": "",
"guid": "5e1264a9-c6cc-4d4e-8e73-7ca4b3f05c17",
"service": "Azure Front Door",
- "text": "워크로드 모니터링의 일환으로 Azure Front Door 운영 데이터를 수집하고 분석합니다. Azure Monitor 로그를 사용하여 관련 Azure Front Door 로그 및 메트릭을 캡처합니다. 이 데이터는 문제를 해결하고, 사용자 행동을 이해하고, 작업을 최적화하는 데 도움이 됩니다.",
+ "text": "워크로드 모니터링의 일환으로 Azure Front Door 운영 데이터를 수집하고 분석합니다. Azure Monitor 로그를 사용하여 관련 Azure Front Door 로그 및 메트릭을 캡처합니다. 이 데이터는 문제를 해결하고, 사용자 행동을 이해하고, 운영을 최적화하는 데 도움이 됩니다.",
"type": "checklist",
"waf": "작업"
},
@@ -3134,7 +2982,7 @@
"description": "",
"guid": "d18003c9-2d90-4e52-b503-5fcdb4ffcd96",
"service": "Azure Front Door",
- "text": "예상되는 트래픽 패턴을 분석하여 용량을 계획합니다. 응용 프로그램이 다양한 부하에서 어떻게 작동하는지 이해하기 위해 철저한 테스트를 수행합니다. 동시 트랜잭션, 요청 속도 및 데이터 전송과 같은 요소를 고려합니다.",
+ "text": "예상 트래픽 패턴을 분석하여 용량을 계획합니다. 응용 프로그램이 다양한 부하에서 어떻게 작동하는지 이해하기 위해 철저한 테스트를 수행합니다. 동시 트랜잭션, 요청 속도 및 데이터 전송과 같은 요소를 고려합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -3166,7 +3014,7 @@
"description": "",
"guid": "8596ddcf-3f3c-4b1c-baa1-a7eb844b2fb6",
"service": "Azure Front Door",
- "text": "오리진 라우팅 방법을 검토합니다. Azure Front Door는 대기 시간 기반, 우선 순위 기반, 가중치 기반 및 세션 선호도 기반 라우팅을 비롯한 다양한 라우팅 방법을 원본에 제공합니다. 이러한 방법은 응용 프로그램의 성능에 큰 영향을 줍니다. 시나리오에 가장 적합한 트래픽 라우팅 옵션에 대한 자세한 내용은 원본에 대한 트래픽 라우팅 방법을 참조하세요.",
+ "text": "오리진 라우팅 방법을 검토합니다. Azure Front Door는 대기 시간 기반, 우선 순위 기반, 가중치 기반 및 세션 선호도 기반 라우팅을 비롯한 다양한 라우팅 방법을 원본에 제공합니다. 이러한 메서드는 응용 프로그램의 성능에 큰 영향을 줍니다. 시나리오에 가장 적합한 트래픽 라우팅 옵션에 대한 자세한 내용은 원본에 대한 트래픽 라우팅 방법을 참조하세요.",
"type": "checklist",
"waf": "공연"
},
@@ -3174,12 +3022,12 @@
"description": "",
"guid": "205d3288-088c-4f24-af39-f9cb610c54a1",
"service": "Azure Front Door",
- "text": "원본 서버의 위치를 검토합니다. 원본 서버의 위치는 애플리케이션의 응답성에 영향을 줍니다. 원본 서버는 사용자와 더 가까워야 합니다. Azure Front Door는 특정 위치의 사용자가 가장 가까운 Azure Front Door 진입점에 액세스할 수 있도록 합니다. 성능 이점에는 더 빠른 사용자 환경, Azure Front Door의 대기 시간 기반 라우팅 더 나은 사용, 사용자에게 더 가까운 콘텐츠를 저장하는 캐싱을 사용하여 데이터 전송 시간 최소화 등이 있습니다.",
+ "text": "원본 서버의 위치를 검토합니다. 원본 서버의 위치는 애플리케이션의 응답성에 영향을 줍니다. 원본 서버는 사용자에게 더 가까이 있어야 합니다. Azure Front Door는 특정 위치의 사용자가 가장 가까운 Azure Front Door 진입점에 액세스할 수 있도록 합니다. 성능 이점에는 더 빠른 사용자 환경, Azure Front Door의 대기 시간 기반 라우팅 더 나은 사용, 사용자에게 더 가까운 콘텐츠를 저장하는 캐싱을 사용하여 데이터 전송 시간 최소화 등이 포함됩니다.",
"type": "checklist",
"waf": "공연"
},
{
- "description": "Azure Front Door는 네트워크 에지에서 콘텐츠를 캐시하는 강력한 콘텐츠 배달 네트워크 솔루션을 제공합니다. 캐싱은 백 엔드 서버의 부하를 줄이고 네트워크를 통한 데이터 이동을 줄여 대역폭 사용을 오프로드하는 데 도움이 됩니다.",
+ "description": "Azure Front Door는 네트워크 에지에서 콘텐츠를 캐시하는 강력한 콘텐츠 배달 네트워크 솔루션을 제공합니다. 캐싱은 백엔드 서버의 부하를 줄이고 네트워크를 통한 데이터 이동을 줄여 대역폭 사용량을 오프로드하는 데 도움이 됩니다.",
"guid": "2f6a39a1-884a-4661-accd-f534bf795a96",
"service": "Azure Front Door",
"text": "캐싱을 활성화합니다. 캐싱을 위해 쿼리 문자열을 최적화할 수 있습니다. 순전히 정적인 콘텐츠의 경우 쿼리 문자열을 무시하여 캐시 사용을 최대화합니다. 응용 프로그램에서 쿼리 문자열을 사용하는 경우 캐시 키에 포함하는 것이 좋습니다. 캐시 키에 쿼리 문자열을 포함하면 Azure Front Door가 구성에 따라 캐시된 응답 또는 기타 응답을 제공할 수 있습니다.",
@@ -3187,7 +3035,7 @@
"waf": "공연"
},
{
- "description": "Azure Front Door의 압축은 최적의 형식으로 콘텐츠를 제공하고, 페이로드가 더 작고, 사용자에게 콘텐츠를 더 빠르게 전달하는 데 도움이 됩니다.",
+ "description": "Azure Front Door의 압축은 최적의 형식으로 콘텐츠를 제공하고, 페이로드가 더 작고, 사용자에게 콘텐츠를 더 빠르게 제공하는 데 도움이 됩니다.",
"guid": "09c90ce3-ade6-413a-9c1b-45d33d6d9069",
"service": "Azure Front Door",
"text": "다운로드 가능한 콘텐츠에 액세스할 때 파일 압축을 사용합니다.",
@@ -3206,7 +3054,7 @@
"description": "성능을 최적화하고 사용자 세션의 연속성을 유지하며, 특히 응용 프로그램이 로컬에서 상태 정보를 유지 관리하는 데 의존하는 경우 더욱 그렇습니다.",
"guid": "2a92f55e-a422-49f4-9a26-8ba819a17323",
"service": "Azure Front Door",
- "text": "동일한 사용자의 요청이 동일한 백엔드 서버로 전달되어야 하는 경우 세션 선호도를 사용하도록 설정해야 하는지 여부를 평가합니다. 안정성 관점에서는 이 방법을 사용하지 않는 것이 좋습니다. 이 옵션을 사용하면 응용 프로그램이 사용자 세션을 중단하지 않고 정상적으로 복구되어야 합니다. 또한 부하 분산에 대한 절충안이 있는데, 이는 여러 백 엔드에 트래픽을 균등하게 분산하는 유연성을 제한하기 때문입니다.",
+ "text": "동일한 사용자의 요청이 동일한 백엔드 서버로 전달되어야 하는 경우 세션 선호도를 사용하도록 설정해야 하는지 여부를 평가합니다. 안정성 관점에서는 이 방법을 권장하지 않습니다. 이 옵션을 사용하면 응용 프로그램이 사용자 세션을 중단하지 않고 정상적으로 복구되어야 합니다. 또한 부하 분산에는 여러 백엔드에 트래픽을 균등하게 분산하는 유연성을 제한하기 때문에 절충안이 있습니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -3214,7 +3062,7 @@
"description": "",
"guid": "ad7540f5-4cb1-4fc5-b168-e1cd97a0aef6",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 중요한 워크로드의 경우 AKS 클러스터에 대한 가용성 영역을 사용합니다.",
+ "text": "클러스터 아키텍처: 중요한 워크로드의 경우 AKS 클러스터에 가용성 영역을 사용합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -3238,7 +3086,7 @@
"description": "",
"guid": "fa12c27b-df70-41fd-a93a-680e3cacf7ac",
"service": "Azure Kubernetes Service",
- "text": "워크로드 아키텍처: 워크로드가 수평적 확장을 지원하도록 구축되고 애플리케이션 준비 상태 및 상태를 보고하도록 합니다.",
+ "text": "워크로드 아키텍처: 워크로드가 수평적 확장을 지원하도록 구축되었는지 확인하고 애플리케이션 준비 상태 및 상태를 보고합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -3246,7 +3094,7 @@
"description": "",
"guid": "f2297ffc-fec7-43c6-9187-9739264c9d66",
"service": "Azure Kubernetes Service",
- "text": "클러스터 및 워크로드 아키텍처: 워크로드가 사용자 노드 풀에서 실행 중인지 확인하고 올바른 크기의 SKU를 선택했습니다. 최소한 사용자 노드 풀에 대한 두 개의 노드와 시스템 노드 풀에 대한 세 개의 노드를 포함합니다.",
+ "text": "클러스터 및 워크로드 아키텍처: 워크로드가 사용자 노드 풀에서 실행 중인지 확인하고 올바른 크기의 SKU를 선택합니다. 최소한 사용자 노드 풀에 대한 두 개의 노드와 시스템 노드 풀에 대한 세 개의 노드를 포함합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -3259,7 +3107,7 @@
"waf": "신뢰도"
},
{
- "description": "쿠버네티스 스케줄러가 노드의 하드웨어별로 워크로드를 논리적으로 격리할 수 있도록 한다. 허용 오차와 달리, 일치하는 노드 선택기가 없는 Pod는 레이블이 지정된 노드에서 예약할 수 있으며, 이렇게 하면 노드에서 사용되지 않는 리소스를 사용할 수 있지만 일치하는 노드 선택기를 정의하는 Pod에 우선 순위가 부여됩니다. 유연성을 높이기 위해 노드 어피니티를 사용하면 Pod를 노드와 일치시킬 수 없는 경우 발생하는 작업을 정의할 수 있습니다.",
+ "description": "Kubernetes 스케줄러가 노드의 하드웨어별로 워크로드를 논리적으로 격리할 수 있습니다. 허용 오차와 달리, 일치하는 노드 선택기가 없는 Pod는 레이블이 지정된 노드에서 예약할 수 있으며, 이렇게 하면 노드에서 사용되지 않는 리소스를 사용할 수 있지만 일치하는 노드 선택기를 정의하는 Pod에 우선 순위가 부여됩니다. 유연성을 높이기 위해 노드 어피니티를 사용하면 Pod를 노드와 일치시킬 수 없는 경우 발생하는 작업을 정의할 수 있습니다.",
"guid": "b11892cd-f678-4399-bac8-b98095e250c6",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 노드 선택기 및 선호도를 사용하여 Pod 스케줄링을 제어합니다.",
@@ -3275,7 +3123,7 @@
"waf": "신뢰도"
},
{
- "description": "AKS 작동 시간 SLA는 - Azure 가용성 영역을 사용하는 AKS 클러스터에 대한 Kubernetes API 서버 엔드포인트의 '99.95%' 가용성 또는 Azure 가용성 영역을 사용하지 않는 AKS 클러스터에 대한 '99.9%' 가용성을 보장합니다.",
+ "description": "AKS 작동 시간 SLA는 Azure 가용성 영역을 사용하는 AKS 클러스터에 대한 Kubernetes API 서버 엔드포인트의 '99.95%' 가용성 또는 Azure 가용성 영역을 사용하지 않는 AKS 클러스터에 대한 '99.9%' 가용성을 보장합니다.",
"guid": "4bfaa73e-a949-404a-a93b-a2b0a7feeff5",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 프로덕션 등급 클러스터에 AKS 작동 시간 SLA를 사용합니다.",
@@ -3286,7 +3134,7 @@
"description": "노드 풀을 여러 영역에 분산하면 다른 영역이 다운되더라도 한 노드 풀의 노드가 계속 실행됩니다. 공동 지역성 요구 사항이 있는 경우 단일 영역에 대한 일반 VMSS 기반 AKS 배포 또는 근접 배치 그룹을 사용하여 노드 간 대기 시간을 최소화할 수 있습니다.",
"guid": "74ff8612-55b7-4029-81bc-da363b133f16",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 가용성 영역을 사용하여 AKS 에이전트 노드를 물리적으로 분리된 데이터 센터에 분산하여 Azure 지역 내에서 복원력을 최대화합니다.",
+ "text": "클러스터 아키텍처: 가용성 영역을 사용하여 AKS 에이전트 노드를 물리적으로 분리된 데이터 센터에 분산하여 Azure 지역 내의 복원력을 최대화합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -3310,7 +3158,7 @@
"description": "시스템 노드 풀에는 2개 이상의 vCPU와 4GB 메모리의 VM SKU가 필요하지만 4개 이상의 vCPU를 사용하는 것이 좋습니다. 자세한 요구 사항은 시스템 및 사용자 노드 풀을 참조하십시오.",
"guid": "55429203-5f2a-4ed1-9107-22d2c47b8ef1",
"service": "Azure Kubernetes Service",
- "text": "클러스터 및 워크로드 아키텍처: 시스템 노드 풀을 애플리케이션 워크로드와 격리된 상태로 유지합니다.",
+ "text": "클러스터 및 워크로드 아키텍처: 시스템 노드 풀을 애플리케이션 워크로드로부터 격리된 상태로 유지합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -3323,7 +3171,7 @@
"waf": "신뢰도"
},
{
- "description": "동시 아웃바운드 트래픽이 많은 Azure Load Balancer 제한과 관련된 안정성 문제를 방지하려면 대신 NAT Gateway를 사용하여 대규모로 신뢰할 수 있는 송신 트래픽을 지원합니다.",
+ "description": "동시 아웃바운드 트래픽이 높은 Azure Load Balancer 제한으로 인한 안정성 문제를 방지하려면 대신 NAT Gateway를 사용하여 대규모로 신뢰할 수 있는 송신 트래픽을 지원합니다.",
"guid": "d441f009-ca99-4caf-9544-c71de5949d10",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 동시 아웃바운드 연결이 많은 워크로드를 실행하는 클러스터에 NAT 게이트웨이를 사용합니다.",
@@ -3342,7 +3190,7 @@
"description": "",
"guid": "d44b3684-99d7-4946-ab75-fb58d9d8626e",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 최소 권한 액세스를 위해 Microsoft Entra ID와 함께 Kubernetes RBAC(역할 기반 액세스 제어)를 사용하고 구성 및 비밀 액세스를 보호하기 위해 관리자 권한 부여를 최소화합니다.",
+ "text": "클러스터 아키텍처: 최소 권한 액세스를 위해 Microsoft Entra ID와 함께 Kubernetes RBAC(역할 기반 액세스 제어)를 사용하고 구성 및 비밀 액세스를 보호하기 위한 관리자 권한 부여를 최소화합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -3379,7 +3227,7 @@
"waf": "안전"
},
{
- "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소를 중앙 집중화할 수 있습니다. 사용자 계정 또는 그룹 상태의 모든 변경 내용은 AKS 클러스터에 대한 액세스에서 자동으로 업데이트됩니다. 쿠버네티스 클러스터의 개발자와 애플리케이션 소유자는 서로 다른 리소스에 액세스해야 합니다.",
+ "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화됩니다. 사용자 계정 또는 그룹 상태의 모든 변경 내용은 AKS 클러스터에 대한 액세스에서 자동으로 업데이트됩니다. 쿠버네티스 클러스터의 개발자와 애플리케이션 소유자는 서로 다른 리소스에 액세스해야 한다.",
"guid": "463da713-377d-46e1-a9cf-a384a0657537",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Microsoft Entra 통합을 사용합니다.",
@@ -3395,7 +3243,7 @@
"waf": "안전"
},
{
- "description": "기본적으로 노드 풀과 API 서버 간의 네트워크 트래픽은 Microsoft 백본 네트워크를 이동합니다. 개인 클러스터를 사용하면 API 서버에 대한 네트워크 트래픽이 개인 네트워크에서만 유지되도록 할 수 있습니다.",
+ "description": "기본적으로 노드 풀과 API 서버 간의 네트워크 트래픽은 Microsoft 백본 네트워크를 이동합니다. 개인 클러스터를 사용하면 API 서버에 대한 네트워크 트래픽이 개인 네트워크에만 유지되도록 할 수 있습니다.",
"guid": "10d61300-19e4-403c-bf22-a554c56b4afc",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 프라이빗 AKS 클러스터를 사용하여 API 서버에 대한 네트워크 트래픽을 보호합니다.",
@@ -3406,7 +3254,7 @@
"description": "공용 클러스터를 사용하는 경우에도 권한 있는 IP 범위 기능을 사용하여 클러스터 API 서버에 도달할 수 있는 트래픽을 제한할 수 있습니다. 배포 빌드 에이전트의 공용 IP, 작업 관리 및 노드 풀의 송신 지점(예: Azure Firewall)과 같은 원본을 포함합니다.",
"guid": "b845e9a6-c5f3-4cf7-a956-6f1ffde88569",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 프라이빗이 아닌 AKS 클러스터의 경우 API 서버 권한이 있는 IP 범위를 사용합니다.",
+ "text": "클러스터 아키텍처: 프라이빗이 아닌 AKS 클러스터의 경우 API 서버 권한이 부여된 IP 범위를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -3427,10 +3275,10 @@
"waf": "안전"
},
{
- "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 것이 있는지 여부를 제어할 수 있습니다.",
+ "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 항목이 있는지 제어할 수 있습니다.",
"guid": "d65686d0-3988-49b5-8a98-59818ba81c50",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터와 Pod를 보호합니다.",
+ "text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터 및 Pod를 보호합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -3462,7 +3310,7 @@
"description": "강력한 암호화를 사용하여 Azure Key Vault에서 비밀, 인증서 및 연결 문자열을 보호하고 회전합니다. 액세스 감사 로그를 제공하고 핵심 비밀을 배포 파이프라인에서 제외합니다.",
"guid": "0f5b5089-02fc-4f46-839c-7ff86610366a",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Azure Key Vault에서 오픈 소스 Microsoft Entra Workload ID 및 Secrets Store CSI 드라이버를 사용합니다.",
+ "text": "클러스터 아키텍처: Azure Key Vault와 함께 오픈 소스 Microsoft Entra 워크로드 ID 및 비밀 저장소 CSI 드라이버를 사용합니다.",
"type": "recommendation",
"waf": "안전"
},
@@ -3502,12 +3350,12 @@
"description": "",
"guid": "43ffe0b7-7bc4-42b0-a370-af4a943b19c0",
"service": "Azure Kubernetes Service",
- "text": "클러스터 및 워크로드 아키텍처: 자동 확장 처리를 사용하여 워크로드의 활동이 적을 때 축소합니다.",
+ "text": "클러스터 및 워크로드 아키텍처: 자동 확장 처리를 사용하여 워크로드의 활동이 적을 때 규모를 축소합니다.",
"type": "checklist",
"waf": "비용"
},
{
- "description": "워크로드 요구 사항에 맞게 선택 항목을 일치시키면 불필요한 리소스에 대한 비용을 지불하지 않아도 됩니다.",
+ "description": "선택 항목을 워크로드 요구 사항에 맞추면 불필요한 리소스에 대한 비용을 지불하지 않아도 됩니다.",
"guid": "c4ce3529-2891-41f1-aa3f-e87a791b01a3",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: SKU 선택 및 관리 디스크 크기를 워크로드 요구 사항에 맞게 조정합니다.",
@@ -3515,7 +3363,7 @@
"waf": "비용"
},
{
- "description": "올바른 가상 머신 인스턴스 유형을 선택하는 것은 AKS에서 애플리케이션을 실행하는 비용에 직접적인 영향을 미치므로 중요합니다. 적절한 사용률 없이 고성능 인스턴스를 선택하면 낭비적인 지출이 발생할 수 있으며, 덜 강력한 인스턴스를 선택하면 성능 문제와 가동 중지 시간이 증가할 수 있습니다. 올바른 가상 머신 인스턴스 유형을 결정하려면 워크로드 특성, 리소스 요구 사항 및 가용성 요구 사항을 고려합니다.",
+ "description": "올바른 가상 머신 인스턴스 유형을 선택하는 것은 AKS에서 애플리케이션을 실행하는 비용에 직접적인 영향을 미치므로 중요합니다. 적절한 사용률 없이 고성능 인스턴스를 선택하면 낭비적인 지출로 이어질 수 있으며, 덜 강력한 인스턴스를 선택하면 성능 문제와 가동 중지 시간이 증가할 수 있습니다. 올바른 가상 머신 인스턴스 유형을 결정하려면 워크로드 특성, 리소스 요구 사항 및 가용성 요구 사항을 고려합니다.",
"guid": "1088060f-7467-48db-950d-5890503e2974",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 올바른 가상 머신 인스턴스 유형을 선택합니다.",
@@ -3539,7 +3387,7 @@
"waf": "비용"
},
{
- "description": "많은 요인으로 인해 리소스 비용은 Azure의 지역마다 다릅니다. 비용, 지연 시간 및 규정 준수 요구 사항을 평가하여 워크로드를 비용 효율적으로 실행하고 있는지, 최종 사용자에게 영향을 미치거나 추가 네트워킹 비용이 발생하지 않는지 확인합니다.",
+ "description": "여러 요인으로 인해 리소스 비용은 Azure의 지역마다 다릅니다. 비용, 대기 시간 및 규정 준수 요구 사항을 평가하여 워크로드를 비용 효율적으로 실행하고 있으며 최종 사용자에게 영향을 미치거나 추가 네트워킹 요금이 발생하지 않는지 확인합니다.",
"guid": "433efe5b-3776-459c-8560-058f87773838",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: 적절한 지역을 선택합니다.",
@@ -3547,7 +3395,7 @@
"waf": "비용"
},
{
- "description": "이미지를 간소화하면 새 노드가 이러한 이미지를 다운로드해야 하므로 비용을 줄이는 데 도움이 됩니다. 컨테이너가 가능한 한 빨리 시작될 수 있는 방식으로 이미지를 빌드하여 애플리케이션이 시작되는 동안 사용자 요청 실패 또는 시간 초과를 방지하여 잠재적으로 오버프로비저닝으로 이어질 수 있습니다.",
+ "description": "이미지를 간소화하면 새 노드가 이러한 이미지를 다운로드해야 하므로 비용을 줄이는 데 도움이 됩니다. 애플리케이션이 시작되는 동안 사용자 요청 실패 또는 시간 초과를 방지하는 데 도움이 되도록 가능한 한 빨리 컨테이너를 시작할 수 있는 방식으로 이미지를 빌드하여 잠재적으로 오버프로비저닝으로 이어질 수 있습니다.",
"guid": "65d3f70e-457a-4d62-8140-de2b0c4f7f99",
"service": "Azure Kubernetes Service",
"text": "워크로드 아키텍처: 작고 최적화된 이미지를 유지 관리합니다.",
@@ -3558,7 +3406,7 @@
"description": "AKS 클러스터의 노드 수를 자동으로 축소하면 수요가 낮을 때 효율적인 클러스터를 실행하고 수요가 돌아올 때 스케일 업할 수 있습니다.",
"guid": "b4d583e3-7268-41d9-9e93-0394bed77298",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Cluster Autoscaler를 활성화하여 과도한 리소스 용량에 대한 응답으로 에이전트 노드 수를 자동으로 줄일 수 있습니다.",
+ "text": "클러스터 아키텍처: Cluster Autoscaler를 활성화하여 과도한 리소스 용량에 대한 응답으로 에이전트 노드 수를 자동으로 줄입니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -3590,12 +3438,12 @@
"description": "처리 중인 이벤트 수에 따라 크기를 조정합니다. 50+ KEDA 스케일러의 풍부한 카탈로그에서 선택하십시오.",
"guid": "fe3d7c5f-f5a9-4b5e-a4f9-81bf76930967",
"service": "Azure Kubernetes Service",
- "text": "워크로드 아키텍처: Kubernetes KEDA(Event Driven Autoscaling)를 사용합니다.",
+ "text": "워크로드 아키텍처: KEDA(Kubernetes Event Driven Autoscaling)를 사용합니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "비용 최적화를 가능하게 하는 기반은 비용 절감 클러스터의 확산입니다. 재무 운영 접근 방식(FinOps)은 조직이 클라우드 비용을 절감하는 데 도움이 되는 데 자주 사용됩니다. 이는 재무, 운영 및 엔지니어링 팀 간의 협업을 통해 비용 절감 목표를 조정하고 클라우드 비용에 대한 투명성을 확보하는 관행입니다.",
+ "description": "비용 최적화를 가능하게 하는 기반은 비용 절감 클러스터의 확산입니다. 재무 운영 접근 방식(FinOps)은 조직이 클라우드 비용을 절감하는 데 도움이 되는 데 자주 사용됩니다. 이는 재무, 운영 및 엔지니어링 팀 간의 협업을 포함하여 비용 절감 목표를 조정하고 클라우드 비용에 대한 투명성을 확보하는 관행입니다.",
"guid": "3a7d1aa1-37a0-40aa-acbf-ff1852c15c93",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: 클라우드 재무 규율과 문화적 관행을 채택하여 클라우드 사용에 대한 소유권을 촉진합니다.",
@@ -3603,7 +3451,7 @@
"waf": "비용"
},
{
- "description": "용량을 적절하게 계획한 경우 워크로드를 예측할 수 있고 장기간 동안 존재하므로 Azure 예약 또는 절약 플랜에 등록하여 리소스 비용을 더욱 줄입니다.",
+ "description": "용량을 적절하게 계획한 경우 워크로드를 예측할 수 있고 장기간 존재하므로 Azure 예약 또는 절약 플랜에 등록하여 리소스 비용을 더욱 줄입니다.",
"guid": "ed669535-43d7-4988-9ec5-3b70762e54eb",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Azure Reservations 또는 Azure Savings Plan에 등록합니다.",
@@ -3630,7 +3478,7 @@
"description": "",
"guid": "1255b75f-0f3b-4fd7-96c5-17e4e30bbe11",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: 자동화된 프로세스를 구축하여 클러스터가 필요한 클러스터 전체 구성 및 배포로 부트스트랩되도록 합니다. 이것은 종종 GitOps를 사용하여 수행됩니다.",
+ "text": "클러스터 아키텍처: 자동화된 프로세스를 구축하여 클러스터가 필요한 클러스터 전체 구성 및 배포로 부트스트랩되도록 합니다. 이 작업은 종종 GitOps를 사용하여 수행됩니다.",
"type": "checklist",
"waf": "작업"
},
@@ -3691,7 +3539,7 @@
"waf": "작업"
},
{
- "description": "AKS에서 애플리케이션을 성공적으로 빌드하고 실행하려면 이해하고 구현해야 할 주요 고려 사항이 있습니다. 이러한 영역에는 멀티 테넌시 및 스케줄러 기능, 클러스터 및 Pod 보안 또는 비즈니스 연속성 및 재해 복구가 포함됩니다.",
+ "description": "AKS에서 애플리케이션을 성공적으로 빌드하고 실행하려면 이해하고 구현해야 하는 주요 고려 사항이 있습니다. 이러한 영역에는 멀티 테넌시 및 스케줄러 기능, 클러스터 및 Pod 보안 또는 비즈니스 연속성 및 재해 복구가 포함됩니다.",
"guid": "95ee25c6-37fc-47c0-a3e1-eea5c1324edb",
"service": "Azure Kubernetes Service",
"text": "클러스터 및 워크로드 아키텍처: AKS 모범 사례 설명서를 검토합니다.",
@@ -3715,7 +3563,7 @@
"waf": "작업"
},
{
- "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 것이 있는지 여부를 제어할 수 있습니다.",
+ "description": "Azure Policy는 중앙 집중화되고 일관된 방식으로 클러스터에 대규모 적용 및 보호 기능을 적용하는 데 도움이 될 수 있습니다. 또한 Pod에 부여되는 기능과 회사 정책에 반하는 항목이 있는지 제어할 수 있습니다.",
"guid": "02f47a84-6d0c-4243-a5ab-743c85dcce67",
"service": "Azure Kubernetes Service",
"text": "클러스터 아키텍처: Azure Policy를 사용하여 클러스터 및 Pod 구성 표준을 운영합니다.",
@@ -3758,7 +3606,7 @@
"description": "",
"guid": "9b168db7-a88b-4e2c-b555-bc525c7e48da",
"service": "Azure Kubernetes Service",
- "text": "클러스터 아키텍처: Horizontal Pod 자동 스케일러를 사용하여 CPU 사용률 또는 기타 선택 메트릭에 따라 배포의 Pod 수를 조정합니다.",
+ "text": "클러스터 아키텍처: Horizontal Pod 자동 크기 조정기를 사용하여 CPU 사용률 또는 기타 선택 메트릭에 따라 배포의 Pod 수를 조정합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -3811,7 +3659,7 @@
"waf": "공연"
},
{
- "description": "모든 크기 조정 결정을 CPU 또는 메모리 메트릭에서 파생할 수 있는 것은 아닙니다. 규모 조정 고려 사항은 더 복잡하거나 외부 데이터 요소에서 오는 경우가 많습니다. KEDA를 사용하여 워크로드와 관련된 신호를 기반으로 의미 있는 자동 크기 조정 규칙 집합을 빌드합니다.",
+ "description": "모든 크기 조정 결정이 CPU 또는 메모리 메트릭에서 파생될 수 있는 것은 아닙니다. 규모 조정 고려 사항은 더 복잡하거나 외부 데이터 요소에서 오는 경우가 많습니다. KEDA를 사용하여 워크로드와 관련된 신호를 기반으로 의미 있는 자동 크기 조정 규칙 집합을 빌드합니다.",
"guid": "bc908693-9e21-478c-9fde-e92ba949c89e",
"service": "Azure Kubernetes Service",
"text": "워크로드 아키텍처: 의미 있는 워크로드 확장 메트릭을 사용합니다.",
@@ -3822,7 +3670,7 @@
"description": "",
"guid": "f4804af8-4f42-450d-916c-5593c145ccf9",
"service": "Azure Machine Learning",
- "text": "복원력: AKS와 같은 가용성 영역을 지원하는 환경에 모델을 배포합니다. 배포가 가용성 영역에 분산되도록 하면 데이터 센터 오류가 발생하는 경우에도 배포를 사용할 수 있습니다. 안정성과 가용성을 향상시키려면 다중 지역 배포 토폴로지를 사용하는 것이 좋습니다.",
+ "text": "복원력: AKS와 같은 가용성 영역을 지원하는 환경에 모델을 배포합니다. 배포가 가용성 영역에 분산되도록 하면 데이터 센터 오류가 발생하는 경우에도 배포를 사용할 수 있습니다. 안정성과 가용성을 향상시키려면 다중 지역 배포 토폴로지를 고려합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -3862,7 +3710,7 @@
"description": "",
"guid": "de5be058-1d22-4f38-96aa-3fbca5071a8f",
"service": "Azure Machine Learning",
- "text": "복구: 대규모 모델을 학습할 때 Machine Learning에서 지원하는 검사점 지정 기능과 같은 자동 복구 기능이 있는지 확인합니다.",
+ "text": "복구: 대규모 모델을 학습할 때 Machine Learning에서 지원하는 검사점 지정 기능과 같은 자체 복구 기능이 있는지 확인합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -3886,15 +3734,15 @@
"description": "모델 체크포인트는 훈련 중에 기계 학습 모델의 상태를 주기적으로 저장하므로 중단, 실패 또는 종료 시 복원할 수 있습니다. 자세한 내용은 Boost checkpoint speed and reduce cost with Nebula를 참조하십시오.",
"guid": "8eaf992c-ccd9-495f-b625-d4f544d38d38",
"service": "Azure Machine Learning",
- "text": "모델 학습 복원력: 모델 검사점을 지원하는 Azure Container for PyTorch, TensorFlow Estimator 클래스 또는 Run 개체 및 FileDataset 클래스를 포함하여 Machine Learning에서 지원하는 검사점 지정 기능을 사용합니다.",
+ "text": "모델 학습 복원력: Azure Container for PyTorch, TensorFlow Estimator 클래스 또는 모델 검사점을 지원하는 Run 개체 및 FileDataset 클래스를 포함하여 Machine Learning에서 지원하는 검사점 지정 기능을 사용합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "우선 순위가 낮은 가상 머신은 가격이 저렴하지만 선점할 수 있습니다. 전용 가상 머신 계층을 사용하는 클러스터는 선점되지 않습니다.",
+ "description": "우선 순위가 낮은 가상 머신은 할인된 가격으로 제공되지만 선점할 수 있습니다. 전용 가상 머신 계층을 사용하는 클러스터는 선점되지 않습니다.",
"guid": "19720202-b456-44c4-8ff1-28eaa20e1a7d",
"service": "Azure Machine Learning",
- "text": "컴퓨팅 클러스터에 전용 가상 머신 계층 사용: 일괄 처리 추론을 위한 컴퓨팅 클러스터에 전용 가상 머신 계층을 사용하여 일괄 처리 작업이 선점되지 않도록 합니다.",
+ "text": "계산 클러스터에 전용 가상 머신 계층 사용: 일괄 처리 유추를 위해 계산 클러스터에 전용 가상 머신 계층을 사용하여 일괄 처리 작업이 선점되지 않도록 합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -3902,7 +3750,7 @@
"description": "",
"guid": "303116b4-65cb-43e5-8ceb-7bebaf16b568",
"service": "Azure Machine Learning",
- "text": "가용성: 작업 영역에 대한 액세스를 가상 네트워크 내의 리소스로 제한하여 Machine Learning 작업 영역의 공격 노출 영역을 줄입니다.",
+ "text": "가용성: 작업 영역에 대한 액세스를 가상 네트워크 내의 리소스로 제한하여 Machine Learning 작업 영역의 공격 표면을 줄입니다.",
"type": "checklist",
"waf": "안전"
},
@@ -3926,7 +3774,7 @@
"description": "",
"guid": "30341513-1f91-480e-bc19-8031f1851087",
"service": "Azure Machine Learning",
- "text": "무결성: 특정 사용 사례 또는 프로젝트를 기반으로 작업 영역을 설정하여 Machine Learning 작업 영역에 대한 사용 사례 분리를 구현합니다. 이 접근 방식은 사용 사례 또는 프로젝트에 대한 데이터 및 실험 자산에 대한 액세스가 필요한 개인만 작업 영역에 액세스할 수 있도록 하여 최소 권한 원칙을 준수합니다.",
+ "text": "무결성: 특정 사용 사례 또는 프로젝트를 기반으로 작업 영역을 설정하여 Machine Learning 작업 영역에 대한 사용 사례 분리를 구현합니다. 이 접근 방식은 사용 사례 또는 프로젝트에 대한 데이터 및 실험 자산에 액세스해야 하는 개인만 작업 영역에 액세스할 수 있도록 하여 최소 권한 원칙을 준수합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -3958,7 +3806,7 @@
"description": "",
"guid": "8d9aea78-3ebe-4ec6-968d-3daa07abc239",
"service": "Azure Machine Learning",
- "text": "무결성: Machine Learning 컴퓨팅 환경에서 학습에 사용되는 코드에 서명해야 합니다. 코드 서명을 요구하면 실행되는 코드가 신뢰할 수 있는 출처에서 제공되었으며 변조되지 않았음을 확인할 수 있습니다.",
+ "text": "무결성: Machine Learning 컴퓨팅 환경에서 학습에 사용되는 코드에 서명해야 합니다. 코드 서명을 요구하면 실행 중인 코드가 신뢰할 수 있는 출처에서 제공되었으며 변조되지 않았음을 확인할 수 있습니다.",
"type": "checklist",
"waf": "안전"
},
@@ -3979,7 +3827,7 @@
"waf": "안전"
},
{
- "description": "보안 기준은 네트워크 보안, ID 관리, 데이터 보호 및 권한 있는 액세스와 같은 중요한 보안 측면에 대한 맞춤형 지침을 제공합니다. 최적의 보안을 위해 클라우드용 Microsoft Defender를 사용하여 이러한 측면을 모니터링합니다.",
+ "description": "보안 기준은 네트워크 보안, ID 관리, 데이터 보호 및 권한 있는 액세스와 같은 중요한 보안 측면에 대한 맞춤형 지침을 제공합니다. 최적의 보안을 위해 클라우드용 Microsoft Defender 사용하여 이러한 측면을 모니터링합니다.",
"guid": "0e30e670-0c69-4c8a-82f5-b88494e56879",
"service": "Azure Machine Learning",
"text": "보안 기준: Machine Learning Service의 보안 및 규정 준수를 강화하려면 Machine Learning에 대한 Azure 보안 기준을 적용합니다.",
@@ -3987,7 +3835,7 @@
"waf": "안전"
},
{
- "description": "관리형 가상 네트워크 격리는 작업 영역을 다른 네트워크로부터 격리하여 보안을 강화하고 무단 액세스의 위험을 줄입니다. 조직 내의 다른 네트워크에서 위반이 발생하는 시나리오에서 Machine Learning 작업 영역의 격리된 네트워크는 영향을 받지 않고 유지되어 기계 학습 워크로드를 보호합니다.",
+ "description": "관리형 가상 네트워크 격리는 작업 영역을 다른 네트워크와 격리하여 무단 액세스의 위험을 줄여 보안을 강화합니다. 조직 내의 다른 네트워크에서 위반이 발생하는 시나리오에서 Machine Learning 작업 영역의 격리된 네트워크는 영향을 받지 않고 유지되어 기계 학습 워크로드를 보호합니다.",
"guid": "aeb66f5c-45bc-45d8-a7bf-a6bd5c6e5f9a",
"service": "Azure Machine Learning",
"text": "관리형 가상 네트워크 격리: Machine Learning에 대한 관리형 가상 네트워크 격리를 구성합니다. 관리형 가상 네트워크 격리를 사용하도록 설정하면 작업 영역에 대한 관리형 가상 네트워크가 만들어집니다. 작업 영역에 대해 만드는 관리형 컴퓨팅 리소스는 이 관리형 가상 네트워크를 자동으로 사용합니다. 관리형 가상 네트워크 격리를 구현할 수 없는 경우 네트워크 토폴로지 권장 사항에 따라 작업 영역 리소스에 대한 프라이빗 엔드포인트를 포함하여 솔루션의 나머지 리소스와 떨어진 전용 서브넷으로 컴퓨팅을 분리해야 합니다.",
@@ -4027,7 +3875,7 @@
"waf": "안전"
},
{
- "description": "로컬 인증을 사용하지 않도록 설정하면 Machine Learning 컴퓨팅의 보안이 강화되고 ID 및 리소스 자격 증명을 중앙 집중식으로 제어하고 관리할 수 있습니다.",
+ "description": "로컬 인증을 사용하지 않도록 설정하면 Machine Learning 컴퓨팅의 보안이 강화되고 ID 및 리소스 자격 증명을 중앙 집중식으로 제어 및 관리할 수 있습니다.",
"guid": "70477454-0ddb-4ad6-9342-1ad6290bbb06",
"service": "Azure Machine Learning",
"text": "로컬 인증 사용 안 함: Machine Learning 컴퓨팅 클러스터 및 인스턴스에 대한 로컬 인증을 사용하지 않도록 설정합니다.",
@@ -4035,7 +3883,7 @@
"waf": "안전"
},
{
- "description": "SSH 액세스를 비활성화하면 권한이 없는 개인이 액세스 권한을 얻어 잠재적으로 시스템에 해를 끼치는 것을 방지하고 무차별 암호 대입 공격으로부터 사용자를 보호할 수 있습니다.",
+ "description": "SSH 액세스를 비활성화하면 권한이 없는 개인이 액세스 권한을 얻어 잠재적으로 시스템에 해를 끼치는 것을 방지하고 무차별 암호 대입 공격으로부터 보호할 수 있습니다.",
"guid": "cbd359bc-8057-4a9c-9183-c4fc1e70a69b",
"service": "Azure Machine Learning",
"text": "공용 SSH 포트 사용 안 함: 'remoteLoginPortPublicAccess'를 '사용 안 함'으로 설정하여 Machine Learning 컴퓨팅 클러스터에서 공용 SSH(Secure Shell) 포트가 닫혀 있는지 확인합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
@@ -4046,12 +3894,12 @@
"description": "컴퓨팅 인스턴스 또는 클러스터에 대한 무단 액세스 가능성을 제한하여 보안을 강화하기 위해 공용 IP 주소를 프로비저닝하지 마세요.",
"guid": "cc532133-2bba-484f-b316-035b93b3ee6a",
"service": "Azure Machine Learning",
- "text": "Machine Learning 컴퓨팅에 대한 공용 IP 주소 프로비저닝 안 함: Machine Learning 컴퓨팅 클러스터 또는 컴퓨팅 인스턴스를 프로비저닝할 때 enableNodePublicIP를 'false'로 설정합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
+ "text": "Machine Learning 컴퓨팅에 대한 공용 IP 주소를 프로비전하지 않음: Machine Learning 컴퓨팅 클러스터 또는 컴퓨팅 인스턴스를 프로비전할 때 enableNodePublicIp를 'false'로 설정합니다. 다른 컴퓨팅을 사용하는 경우 유사한 구성을 적용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "최신 이미지를 사용하면 최신 보안 패치를 사용하는 것을 포함하여 일관되고 안정적이며 안전한 환경을 유지할 수 있습니다.",
+ "description": "최신 이미지를 사용하면 최신 보안 패치를 포함하여 일관되고 안정적이며 안전한 환경을 유지할 수 있습니다.",
"guid": "cb49b636-1011-43a0-a12b-25378f677153",
"service": "Azure Machine Learning",
"text": "최신 운영 체제 이미지 가져오기: 컴퓨트 인스턴스를 다시 만들어 최신 운영 체제 이미지를 가져옵니다.",
@@ -4059,7 +3907,7 @@
"waf": "안전"
},
{
- "description": "엄격한 작업 영역 액세스 제어는 개인이 자신의 역할에 필요한 권한만 갖도록 하여 보안을 강화합니다. 예를 들어 데이터 사이언티스트는 실험을 실행할 수 있는 액세스 권한이 있지만 보안 설정을 수정할 수는 없어 잠재적인 보안 위험을 최소화할 수 있습니다.",
+ "description": "엄격한 작업 영역 액세스 제어는 개인이 자신의 역할에 필요한 권한만 갖도록 하여 보안을 강화합니다. 예를 들어 데이터 사이언티스트는 실험을 실행할 수 있는 액세스 권한이 있지만 보안 설정을 수정할 수는 없으므로 잠재적인 보안 위험을 최소화할 수 있습니다.",
"guid": "17cac647-8c6f-4a6f-a66d-c436e17c91c8",
"service": "Azure Machine Learning",
"text": "엄격한 Machine Learning 작업 영역 액세스 제어: Microsoft Entra ID 그룹을 사용하여 작업 영역 액세스를 관리하고 RBAC에 대한 최소 권한 원칙을 준수합니다.",
@@ -4075,7 +3923,7 @@
"waf": "안전"
},
{
- "description": "미사용 데이터를 암호화하면 사용자가 직접 관리하는 키를 사용하여 중요한 데이터를 암호화하여 데이터 보안을 강화할 수 있습니다. 자체 암호화 키를 관리해야 하는 규정 요구 사항이 있는 경우 이 기능을 사용하여 해당 요구 사항을 준수합니다.",
+ "description": "미사용 데이터를 암호화하면 사용자가 직접 관리하는 키를 사용하여 중요한 데이터를 암호화하여 데이터 보안을 강화할 수 있습니다. 자체 암호화 키를 관리하기 위한 규정 요구 사항이 있는 경우 이 기능을 사용하여 해당 요구 사항을 준수합니다.",
"guid": "5e14c11e-83fb-40f1-a8dc-d96767d73a13",
"service": "Azure Machine Learning",
"text": "미사용 데이터 암호화: Machine Learning에서 고객 관리형 키를 사용하는 것이 좋습니다.",
@@ -4102,7 +3950,7 @@
"description": "",
"guid": "8e98fc4b-2fa4-44b9-9aa7-1c01f67aecb7",
"service": "Azure Machine Learning",
- "text": "사용량 최적화: 낭비를 줄이기 위해 사용하지 않는 컴퓨팅 리소스가 유휴 상태일 때 축소되거나 종료되도록 합니다.",
+ "text": "사용량 최적화: 낭비를 줄이기 위해 사용되지 않는 컴퓨팅 리소스가 유휴 상태일 때 축소되거나 종료되도록 합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -4126,7 +3974,7 @@
"description": "",
"guid": "945e262b-3a0f-4ac9-ac51-69b5500f9ee6",
"service": "Azure Machine Learning",
- "text": "요금 최적화: 향후 1년에서 3년 동안의 사용량을 잘 예측하는 경우 Azure Reserved Virtual Machine Instances를 구매합니다.",
+ "text": "요금 최적화: 향후 1년에서 3년 동안의 사용량을 잘 예측할 수 있는 경우 Azure Reserved Virtual Machine Instances를 구매합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -4139,15 +3987,15 @@
"waf": "비용"
},
{
- "description": "올바른 컴퓨팅을 선택하는 것은 워크로드 실행 비용에 직접적인 영향을 미치므로 매우 중요합니다. 적절하게 사용하지 않고 GPU 또는 고성능 SKU를 선택하면 낭비적인 지출로 이어질 수 있으며, 크기가 작은 컴퓨팅을 선택하면 엄청나게 긴 훈련 시간과 성능 문제가 발생할 수 있습니다.",
+ "description": "올바른 컴퓨팅을 선택하는 것은 워크로드 실행 비용에 직접적인 영향을 미치므로 매우 중요합니다. 적절한 사용 없이 GPU 또는 고성능 SKU를 선택하면 낭비적인 지출로 이어질 수 있으며, 크기가 작은 컴퓨팅을 선택하면 엄청나게 긴 훈련 시간과 성능 문제가 발생할 수 있습니다.",
"guid": "3d87f935-99a6-4aee-aac2-069994de09ff",
"service": "Azure Machine Learning",
- "text": "Optimize compute resources(계산 리소스 최적화): 워크로드의 요구 사항에 따라 계산 리소스를 최적화합니다. 워크로드에 가장 적합한 SKU 선택: - 범용 – 균형 잡힌 CPU 대 메모리 비율, 모든 용도에 적합합니다.
- 컴퓨팅 최적화 – CPU 대 메모리 비율이 높아 수학이 많이 필요한 계산에 적합합니다.
- 메모리 최적화 – CPU 대비 메모리가 높아 메모리 내 계산 또는 데이터베이스 애플리케이션에 적합합니다.
- M 시리즈 – 엄청난 양의 메모리와 CPU를 가진 매우 큰 컴퓨터.
- GPU – 더 높은 병렬 처리와 전문화된 핵심 명령의 이점을 누릴 수 있는 변수 수가 많은 모델에 더 좋습니다. 일반적인 응용 분야는 딥 러닝, 이미지 또는 비디오 처리, 과학 시뮬레이션, 데이터 마이닝, GPU 개발 프레임워크 활용 등입니다. 여러 패밀리로 테스트하고 결과를 기준선으로 문서화합니다. 모델과 데이터가 발전함에 따라 가장 적절한 컴퓨팅 리소스가 변경될 수 있습니다. 실행 시간을 모니터링하고 필요에 따라 다시 평가합니다.",
+ "text": "Optimize compute resources(계산 리소스 최적화): 워크로드의 요구 사항에 따라 계산 리소스를 최적화합니다. 워크로드에 가장 적합한 SKU 선택:
- 범용 – 균형 잡힌 CPU 대 메모리 비율, 모든 용도에 적합합니다.
- 컴퓨팅 최적화 – CPU 대 메모리 비율이 높아 수학이 많이 필요한 계산에 적합합니다.
- 메모리 최적화 – CPU 대비 메모리가 높아 메모리 내 계산 또는 데이터베이스 애플리케이션에 적합합니다.
- M 시리즈 – 엄청난 양의 메모리와 CPU를 가진 매우 큰 기계.
- GPU – 더 높은 병렬 처리와 전문화된 핵심 명령의 이점을 누릴 수 있는 변수 수가 많은 모델에 더 좋습니다. 일반적인 응용 분야는 딥 러닝, 이미지 또는 비디오 처리, 과학 시뮬레이션, 데이터 마이닝, GPU 개발 프레임워크 활용 등입니다. 여러 패밀리로 테스트하고 결과를 기준선으로 문서화합니다. 모델과 데이터가 발전함에 따라 가장 적절한 컴퓨팅 리소스가 변경될 수 있습니다. 실행 시간을 모니터링하고 필요에 따라 다시 평가합니다.",
"type": "recommendation",
"waf": "비용"
},
{
- "description": "사용량이 적을 때 컴퓨팅 클러스터가 축소되도록 자동 크기 조정을 구성합니다. 학습 클러스터가 사용하지 않을 때 0으로 축소되도록 최소 노드 수를 0으로 설정합니다.",
+ "description": "사용량이 낮을 때 축소하도록 컴퓨팅 클러스터에 대한 자동 크기 조정을 구성합니다. 사용하지 않을 때 학습 클러스터가 0으로 축소되도록 최소 노드 수를 0으로 설정합니다.",
"guid": "d30cfeeb-6c61-4a9d-9a56-c8296cec72cb",
"service": "Azure Machine Learning",
"text": "컴퓨팅 크기 조정 최적화: 필요한 항목만 사용하도록 자동 크기 조정을 위해 컴퓨팅 클러스터를 구성합니다. 학습 클러스터의 경우 최소 노드 수를 0으로 설정하고 노드가 유휴 상태인 시간을 적절한 시간으로 구성합니다. 반복적인 실험을 줄이려면 시간을 줄여 비용을 절감하십시오. 더 반복적인 실험의 경우 각 변경 후 확장 또는 축소에 대한 비용을 지불하지 않도록 더 많은 시간을 사용합니다.",
@@ -4214,7 +4062,7 @@
"description": "",
"guid": "7b5de736-4956-4313-82be-0a0ff07d7ab6",
"service": "Azure Machine Learning",
- "text": "자신 있게 배포: Machine Learning 작업 영역, 컴퓨팅 클러스터, 컴퓨팅 인스턴스 및 기타 배포 환경을 위한 IaC(Infrastructure as Code)를 구현합니다.",
+ "text": "자신 있게 배포: Machine Learning 작업 영역, 컴퓨팅 클러스터, 컴퓨팅 인스턴스 및 기타 배포 환경에 대한 IaC(Infrastructure as Code)를 구현합니다.",
"type": "checklist",
"waf": "작업"
},
@@ -4243,7 +4091,7 @@
"waf": "작업"
},
{
- "description": "작업 공간 수를 제한하면 유지 관리 노력과 운영 비용이 절감됩니다. 보안과 같은 요구 사항의 경우 여러 개의 개별 작업 영역이 필요할 수 있습니다. 가능한 경우 작업 영역 수를 최소화합니다.",
+ "description": "작업 공간 수를 제한하면 유지 관리 작업과 운영 비용이 절감됩니다. 보안과 같은 요구 사항의 경우 여러 개의 개별 작업 영역이 필요할 수 있습니다. 가능한 경우 작업 영역 수를 최소화합니다.",
"guid": "bb6c4c2f-65f4-4fab-ada7-ebe079bde9cb",
"service": "Azure Machine Learning",
"text": "Machine Learning 작업 영역 인스턴스 최소화: 가능한 경우 작업 영역 수를 최소화하여 유지 관리를 줄입니다.",
@@ -4251,15 +4099,15 @@
"waf": "작업"
},
{
- "description": "Machine Learning 모델 레지스트리를 사용하여 기계 학습 모델을 저장하고 버전을 관리하여 변경 사항을 추적하고 교육에 사용되는 작업 및 데이터 세트와의 계보를 유지 관리합니다. Machine Learning 모델 카탈로그를 사용하면 데이터 과학 팀이 사전 훈련된 기본 기계 학습 모델을 검색, 평가 및 미세 조정할 수 있습니다. 버전이 지정된 모델을 Machine Learning 모델 레지스트리에 저장하면 A/B 릴리스, 카나리아 릴리스 및 롤백과 같은 배포 전략을 지원할 수 있습니다.",
+ "description": "Machine Learning 모델 레지스트리를 사용하여 기계 학습 모델을 저장하고 버전을 관리하여 변경 사항을 추적하고 교육에 사용되는 작업 및 데이터 세트와의 계보를 유지 관리합니다. Machine Learning 모델 카탈로그를 사용하면 데이터 과학 팀이 사전 훈련된 기본 기계 학습 모델을 검색, 평가 및 미세 조정할 수 있습니다. 버전이 지정된 모델을 Machine Learning 모델 레지스트리에 저장하면 A/B 릴리스, 카나리아 릴리스 및 롤백과 같은 배포 전략이 지원됩니다.",
"guid": "31841d05-3372-4bd4-b8bc-efcaaee1bd88",
"service": "Azure Machine Learning",
- "text": "모델 카탈로그 및 레지스트리 활용: Machine Learning 모델 카탈로그 및 레지스트리를 활용하여 기계 학습 자산을 저장, 버전 관리 및 공유합니다. Machine Learning 모델 카탈로그를 사용하여 모델의 A/B 테스트 및 배포를 구현할 수 있습니다.",
+ "text": "모델 카탈로그 및 레지스트리 활용: Machine Learning 모델 카탈로그 및 레지스트리를 활용하여 Machine Learning 자산을 저장, 버전 관리 및 공유합니다. Machine Learning 모델 카탈로그를 사용하여 A/B 테스트 및 모델 배포를 구현할 수 있습니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "배포된 모델을 모니터링하면 모델이 성능 요구 사항을 충족하는지 확인할 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하도록 할 수 있습니다.",
+ "description": "배포된 모델을 모니터링하면 모델이 성능 요구 사항을 충족하는지 확인할 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하는지 확인할 수 있습니다.",
"guid": "90a72a7e-6fb5-4e02-a159-7a4d907eb098",
"service": "Azure Machine Learning",
"text": "모델 성능 모니터링: 배포된 모델의 성능을 모니터링하고 데이터 세트에서 데이터 드리프트를 감지합니다.",
@@ -4267,7 +4115,7 @@
"waf": "작업"
},
{
- "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 메트릭에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는지 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 이 정보를 사용하여 규모 확대 또는 축소를 결정하거나, 다양한 성능의 SKU로 규모 축소를 결정하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
+ "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 지표에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는 경우 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 해당 정보를 사용하여 규모 감축 또는 축소를 결정하거나, 다양한 성능의 SKU로 확장 또는 축소하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
"guid": "b1d87076-b253-47ae-8727-97f804e49a3c",
"service": "Azure Machine Learning",
"text": "인프라 모니터링: 모델이 온라인 엔드포인트에 배포된 경우 Application Insights를 사용하여 온라인 엔드포인트 및 배포를 모니터링할 수 있습니다. 교육 인프라를 모니터링하여 기준 요구 사항을 충족하고 있는지 확인합니다. Machine Learning에 대한 리소스 로그를 수집하고 있는지 확인합니다.",
@@ -4334,15 +4182,15 @@
"description": "",
"guid": "e257de8e-a8ef-4b91-81a3-3d832682b1eb",
"service": "Azure Machine Learning",
- "text": "성능 달성 및 유지: 배포된 모델의 인프라 성능을 지속적으로 모니터링하고, 결과를 검토하고, 적절한 조치를 취합니다. 교육 인프라를 모니터링하여 교육 시간에 대한 요구 사항을 충족하고 있는지 확인합니다.",
+ "text": "성능 달성 및 유지: 배포된 모델의 인프라 성능을 지속적으로 모니터링하고, 결과를 검토하고, 적절한 조치를 취합니다. 교육 인프라스트럭처를 모니터링하여 교육 시간에 대한 요구 사항을 충족하고 있는지 확인합니다.",
"type": "checklist",
"waf": "공연"
},
{
- "description": "올바른 컴퓨팅을 선택하는 것은 학습 시간에 직접적인 영향을 미치므로 매우 중요합니다. 올바른 SKU 및 CPU와 GPU를 선택하면 모델 학습이 요구 사항과 성능 목표를 충족할 수 있습니다. 과도하게 사용되는 저성능 SKU를 선택하면 학습 시간이 엄청나게 길어지고 성능 문제가 발생할 수 있습니다. 컴퓨팅 클러스터는 수평적 확장을 지원하는 워크로드를 확장하여 성능을 개선할 수 있는 기능을 제공합니다. 이 방법은 다양한 요구 사항이 있는 워크로드를 처리할 수 있는 유연성을 제공하며 필요에 따라 컴퓨터를 추가하거나 제거할 수 있습니다.",
+ "description": "올바른 컴퓨팅을 선택하는 것은 학습 시간에 직접적인 영향을 미치므로 매우 중요합니다. GPU와 비교하여 올바른 SKU 및 CPU를 선택하면 모델 학습이 요구 사항과 성능 목표를 충족할 수 있습니다. 과도하게 사용되는 저성능 SKU를 선택하면 학습 시간이 엄청나게 길어지고 성능 문제가 발생할 수 있습니다. 컴퓨팅 클러스터는 수평적 확장을 지원하는 워크로드를 확장하여 성능을 개선할 수 있는 기능을 제공합니다. 이 방법은 다양한 요구 사항이 있는 워크로드를 처리할 수 있는 유연성을 제공하며 필요에 따라 컴퓨터를 추가하거나 제거할 수 있습니다.",
"guid": "352a223c-dabd-46da-8752-56a87c6f18b7",
"service": "Azure Machine Learning",
- "text": "모델 학습에 적합한 컴퓨팅 서비스 선택: 자동 크기 조정이 필요한 경우 모델 학습을 위해 컴퓨팅 인스턴스보다 Machine Learning 컴퓨팅 클러스터를 고려합니다. 학습 요구 사항에 따라 컴퓨팅 리소스를 최적화합니다. 먼저 CPU와 GPU 중에서 선택합니다. 기본적으로 CPU를 사용하지만 딥 러닝, 이미지 또는 비디오 처리 또는 대용량 데이터와 같은 워크로드에는 GPU를 사용하는 것이 좋습니다. 다음으로, 워크로드에 가장 적합한 이미지 SKU를 선택합니다. 테스트를 사용하여 기준선을 결정할 때 학습 시간 대비 비용을 최적화하는 컴퓨팅 옵션을 선택합니다.",
+ "text": "모델 학습에 적합한 컴퓨팅 서비스 선택: 자동 크기 조정이 필요한 경우 모델 학습을 위해 컴퓨팅 인스턴스보다 Machine Learning 컴퓨팅 클러스터를 고려합니다. 학습 요구 사항에 따라 컴퓨팅 리소스를 최적화합니다. 먼저 CPU와 GPU 중에서 선택합니다. 기본적으로 CPU를 사용하지만 딥 러닝, 이미지 또는 비디오 처리 또는 대용량 데이터와 같은 워크로드에는 GPU를 사용하는 것이 좋습니다. 다음으로, 워크로드에 가장 적합한 이미지 SKU를 선택합니다. 테스트를 사용하여 기준선을 결정할 때 학습 시간에 대한 비용을 최적화하는 컴퓨팅 옵션을 선택합니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -4355,7 +4203,7 @@
"waf": "공연"
},
{
- "description": "프로덕션에서 모델의 성능을 추적하면 데이터 드리프트, 예측 드리프트, 데이터 품질 및 기능 속성 드리프트와 같은 잠재적인 문제에 대한 경고를 받을 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하도록 할 수 있습니다.",
+ "description": "프로덕션에서 모델의 성능을 추적하면 데이터 드리프트, 예측 드리프트, 데이터 품질 및 기능 속성 드리프트와 같은 잠재적인 문제에 대한 경고를 받을 수 있습니다. 데이터 드리프트를 모니터링하면 모델 성능 저하로 이어질 수 있는 입력 데이터의 변경 사항을 감지하는 데 도움이 됩니다. 데이터 드리프트를 관리하면 모델이 시간이 지남에 따라 정확한 결과를 제공하는지 확인할 수 있습니다.",
"guid": "eccdaab6-7458-4967-9cd4-da6a89e3ce8c",
"service": "Azure Machine Learning",
"text": "모델 성능 모니터링: 배포된 모델의 성능을 모니터링합니다.",
@@ -4363,7 +4211,7 @@
"waf": "공연"
},
{
- "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 메트릭에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는지 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 이 정보를 사용하여 규모 확대 또는 축소를 결정하거나, 다양한 성능의 SKU로 규모 축소를 결정하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
+ "description": "엔드포인트를 모니터링하면 요청 대기 시간 및 분당 요청 수와 같은 지표에 대한 가시성을 얻을 수 있습니다. 성능과 기준을 비교하고 이 정보를 사용하여 그에 따라 컴퓨팅 리소스를 변경할 수 있습니다. 네트워크 바이트와 같은 메트릭을 모니터링하면 할당량 한도에 가까워지고 있는 경우 경고하고 제한을 방지할 수 있습니다. 마찬가지로, 학습 환경을 모니터링하면 학습 환경을 변경할 수 있는 정보를 얻을 수 있습니다. 해당 정보를 사용하여 규모 감축 또는 축소를 결정하거나, 다양한 성능의 SKU로 확장 또는 축소하거나, CPU 또는 GPU 중에서 선택할 수 있습니다.",
"guid": "76b80c26-8252-416e-aae1-ace03a9403dd",
"service": "Azure Machine Learning",
"text": "인프라 모니터링: 온라인 엔드포인트를 모니터링하고 Monitor와 통합하여 적절한 메트릭 및 로그를 추적하고 모니터링합니다. 온라인 배포를 만들 때 Application Insights를 사용하도록 설정합니다. 학습 인프라를 모니터링하고 모델을 학습할 때 메모리 및 CPU 또는 GPU 사용량과 같은 리소스 사용량을 검토하여 기준 요구 사항을 충족하고 있는지 확인합니다.",
@@ -4374,7 +4222,7 @@
"description": "",
"guid": "154d9075-f8f8-4dc8-b8f4-651d875d5dfe",
"service": "Azure Openai",
- "text": "복원력: 사용 사례에 따라 종량제 또는 프로비저닝된 처리량 중에서 적절한 배포 옵션을 선택합니다. 예약된 용량은 복원력을 높이기 때문에 프로덕션 솔루션에 대해 프로비저닝된 처리량을 선택합니다. 종량제 방식은 개발/테스트 환경에 이상적입니다.",
+ "text": "복원력: 사용 사례에 따라 종량제 또는 프로비저닝된 처리량의 적절한 배포 옵션을 선택합니다. 예약된 용량은 복원력을 높이기 때문에 프로덕션 솔루션에 대해 프로비저닝된 처리량을 선택합니다. 종량제 방식은 개발/테스트 환경에 이상적입니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4382,7 +4230,7 @@
"description": "",
"guid": "571ddd3c-601e-46a7-bf80-c52f04a301fb",
"service": "Azure Openai",
- "text": "중복성: Azure OpenAI 배포 앞에 적절한 게이트웨이를 추가합니다. 게이트웨이에는 제한과 같은 일시적인 오류를 견딜 수 있는 기능이 있어야 하며 여러 Azure OpenAI 인스턴스로 라우팅할 수도 있어야 합니다. 지역 중복성을 구축하기 위해 다른 지역의 인스턴스로 라우팅하는 것을 고려합니다.",
+ "text": "중복성: Azure OpenAI 배포 앞에 적절한 게이트웨이를 추가합니다. 게이트웨이에는 제한과 같은 일시적인 오류를 견딜 수 있는 기능이 있어야 하며 여러 Azure OpenAI 인스턴스로 라우팅할 수도 있어야 합니다. 지역 중복성을 구축하기 위해 다른 지역의 인스턴스로 라우팅하는 것이 좋습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4390,7 +4238,7 @@
"description": "",
"guid": "3861cb87-64b1-4958-b439-5575b8d1fc67",
"service": "Azure Openai",
- "text": "복원력: 프로비저닝된 처리량을 사용하는 경우 오버플로를 처리하기 위해 종량제 인스턴스를 배포하는 것도 고려합니다. 프로비저닝된 처리량 모델이 제한될 때 게이트웨이를 통해 종량제 인스턴스로 호출을 라우팅할 수 있습니다.",
+ "text": "복원력: 프로비저닝된 처리량을 사용하는 경우 오버플로를 처리하기 위해 종량제 인스턴스를 배포하는 것도 고려합니다. 프로비저닝된 처리량 모델이 제한될 때 게이트웨이를 통해 종량제 인스턴스로 통화를 라우팅할 수 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4406,7 +4254,7 @@
"description": "",
"guid": "950e6010-4345-43e6-a8e9-d8c95e45f818",
"service": "Azure Openai",
- "text": "복원력: 큰 데이터 파일을 미세 조정하고 Azure Blob 저장소에서 데이터를 가져오기 위한 지침을 따릅니다. 100MB 이상의 대용량 파일은 요청이 원자성이고 다시 시도하거나 재개할 수 없기 때문에 멀티파트 양식을 통해 업로드할 때 불안정해질 수 있습니다.",
+ "text": "복원력: 큰 데이터 파일을 미세 조정하고 Azure Blob 저장소에서 데이터를 가져오기 위한 지침을 따릅니다. 100MB 이상의 대용량 파일은 요청이 원자성이고 다시 시도하거나 다시 시작할 수 없기 때문에 멀티파트 양식을 통해 업로드할 때 불안정해질 수 있습니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4422,12 +4270,12 @@
"description": "이 중요한 처리량 정보는 배포 수요를 충족하기 위해 할당량에서 충분한 TPM을 할당하는 데 필요한 정보를 제공합니다. 충분한 할당량을 할당하면 배포된 모델에 대한 호출 제한을 방지할 수 있습니다.",
"guid": "f109deb2-54f9-4405-a9f0-f90fd0f76adf",
"service": "Azure Openai",
- "text": "종량제에 대한 속도 제한 모니터링: 종량제 방식을 사용하는 경우 모델 배포에 대한 속도 제한을 관리하고 TPM(분당 토큰) 및 RPM(분당 요청 수)의 사용량을 모니터링합니다.",
+ "text": "종량제에 대한 속도 제한 모니터링: 종량제 접근 방식을 사용하는 경우 모델 배포에 대한 속도 제한을 관리하고 TPM(분당 토큰) 및 RPM(분당 요청 수)의 사용량을 모니터링합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "배포된 모델에 대한 호출 제한을 방지하기 위해 프로비저닝 관리 사용률을 모니터링하여 100%를 초과하지 않도록 하는 것이 중요합니다.",
+ "description": "프로비저닝 관리 사용률을 모니터링하여 100%를 초과하지 않도록 하여 배포된 모델에 대한 호출 제한을 방지하는 것이 중요합니다.",
"guid": "ef12f5c3-dbe2-4040-be82-724eebc6f87e",
"service": "Azure Openai",
"text": "프로비저닝된 처리량에 대한 프로비저닝 관리 사용률 모니터링: 프로비저닝된 처리량 결제 모델을 사용하는 경우 프로비저닝 관리 사용률을 모니터링합니다.",
@@ -4438,7 +4286,7 @@
"description": "콘텐츠 필터는 불투명한 위험 분석을 기반으로 프롬프트 또는 완료를 차단합니다. 워크로드에 대한 예상 사용량을 허용하도록 콘텐츠 필터가 조정되어 있는지 확인합니다.",
"guid": "efcf5f6a-02bb-4cc8-8018-055ebf2e57e0",
"service": "Azure Openai",
- "text": "콘텐츠 필터 조정: 콘텐츠 필터를 조정하여 지나치게 공격적인 필터로 인한 오탐을 최소화합니다.",
+ "text": "콘텐츠 필터 조정: 콘텐츠 필터를 조정하여 과도하게 공격적인 필터로 인한 오탐을 최소화합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -4478,12 +4326,12 @@
"description": "",
"guid": "e0383d3b-71f1-4fda-9759-24cfd293abff",
"service": "Azure Openai",
- "text": "가용성 보호: 보안 제어를 사용하여 모델 사용 할당량을 소진할 수 있는 공격을 방지합니다. 네트워크에서 서비스를 격리하도록 컨트롤을 구성할 수 있습니다. 인터넷에서 서비스에 액세스할 수 있어야 하는 경우 게이트웨이를 사용하여 라우팅 또는 제한을 사용하여 의심되는 남용을 차단하는 것이 좋습니다.",
+ "text": "가용성 보호: 보안 제어를 사용하여 모델 사용 할당량을 고갈시킬 수 있는 공격을 방지합니다. 네트워크에서 서비스를 격리하도록 컨트롤을 구성할 수 있습니다. 인터넷에서 서비스에 액세스할 수 있어야 하는 경우 게이트웨이를 사용하여 라우팅 또는 제한을 사용하여 의심되는 남용을 차단하는 것이 좋습니다.",
"type": "checklist",
"waf": "안전"
},
{
- "description": "Key Vault에 저장하여 코드에서 비밀을 분리하면 비밀이 유출될 가능성이 줄어듭니다. 또한 분리는 비밀의 중앙 관리를 용이하게 하여 키 회전과 같은 책임을 완화합니다.",
+ "description": "비밀을 Key Vault에 저장하여 코드에서 분리하면 비밀이 유출될 가능성이 줄어듭니다. 또한 분리는 비밀의 중앙 관리를 용이하게 하여 키 회전과 같은 책임을 완화합니다.",
"guid": "c4310e87-1366-4523-b2e1-244e1074fbb0",
"service": "Azure Openai",
"text": "보안 키: 아키텍처에 Azure OpenAI 키 기반 인증이 필요한 경우 해당 키를 애플리케이션 코드가 아닌 Azure Key Vault에 저장합니다.",
@@ -4499,7 +4347,7 @@
"waf": "안전"
},
{
- "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화되고 API 키를 사용할 필요가 없습니다. Microsoft Entra ID와 함께 RBAC를 사용하면 사용자 또는 그룹이 작업을 수행하는 데 필요한 권한을 정확히 가질 수 있습니다. 이러한 종류의 세분화된 액세스 제어는 Azure OpenAI API 키에서는 불가능합니다.",
+ "description": "Microsoft Entra ID를 사용하면 ID 관리 구성 요소가 중앙 집중화되고 API 키를 사용할 필요가 없습니다. Microsoft Entra ID와 함께 RBAC를 사용하면 사용자 또는 그룹이 작업을 수행하는 데 필요한 권한을 정확하게 가질 수 있습니다. 이러한 종류의 세분화된 액세스 제어는 Azure OpenAI API 키에서는 사용할 수 없습니다.",
"guid": "d5892190-2da9-43f4-b1e1-76b38b369643",
"service": "Azure Openai",
"text": "Microsoft Entra ID: RBAC(역할 기반 액세스 제어)를 사용하여 Azure OpenAI에 대한 액세스 권한을 부여하고 인증에 Microsoft Entra ID를 사용합니다. Azure AI Services에서 로컬 인증을 사용하지 않도록 설정하고 'disableLocalAuth'를 'true'로 설정합니다. 완성 또는 이미지 생성을 수행하는 ID에 Cognitive Services OpenAI 사용자 역할을 부여합니다. 모델 자동화 파이프라인 및 임시 데이터 과학 액세스 권한에 Cognitive Services OpenAI 기여자와 같은 역할을 부여합니다.",
@@ -4550,7 +4398,7 @@
"description": "",
"guid": "2b2303c0-e057-431d-9a02-20a1a0b2b5b9",
"service": "Azure Openai",
- "text": "사용 최적화: 모델을 선택할 때 모델 가격 책정 및 기능을 고려합니다. 텍스트 생성 또는 완성 작업과 같은 덜 복잡한 작업을 위해 비용이 적게 드는 모델로 시작합니다. 언어 번역 또는 콘텐츠 이해와 같은 더 복잡한 작업의 경우 고급 모델을 사용하는 것이 좋습니다. 텍스트 포함, 이미지 생성 또는 전사 시나리오와 같은 사용 사례에 적합한 모델을 선택할 때 다양한 모델 기능과 최대 토큰 사용 제한을 고려합니다. 요구 사항에 가장 적합한 모델을 신중하게 선택하면 원하는 응용 프로그램 성능을 달성하면서 비용을 최적화할 수 있습니다.",
+ "text": "사용 최적화: 모델을 선택할 때 모델 가격 책정 및 기능을 고려합니다. 텍스트 생성 또는 완성 작업과 같은 덜 복잡한 작업을 위해 더 저렴한 모델로 시작하십시오. 언어 번역 또는 콘텐츠 이해와 같은 더 복잡한 작업의 경우 고급 모델을 사용하는 것이 좋습니다. 텍스트 포함, 이미지 생성 또는 전사 시나리오와 같은 사용 사례에 적합한 모델을 선택할 때 다양한 모델 기능과 최대 토큰 사용 제한을 고려합니다. 요구 사항에 가장 적합한 모델을 신중하게 선택하면 원하는 응용 프로그램 성능을 달성하면서 비용을 최적화할 수 있습니다.",
"type": "checklist",
"waf": "비용"
},
@@ -4590,7 +4438,7 @@
"description": "",
"guid": "160154da-ea9e-4a84-ac35-8a731658c0fd",
"service": "Azure Openai",
- "text": "비용 효율성: 호출당 오버헤드를 최소화하기 위해 가능한 경우 일괄 처리 요청을 수행하여 전체 비용을 줄일 수 있습니다. 배치 크기를 최적화해야 합니다.",
+ "text": "비용 효율성: 호출당 오버헤드를 최소화하기 위해 가능한 경우 일괄 처리 요청을 수행하여 전체 비용을 줄일 수 있습니다. 일괄 처리 크기를 최적화해야 합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -4614,7 +4462,7 @@
"description": "API 기능을 사용하여 사용을 제한하면 서비스 사용량이 클라이언트 요구 사항에 맞게 조정됩니다. 이렇게 하면 모델이 필요한 것보다 더 많은 토큰을 사용하는 지나치게 긴 응답을 생성하지 않도록 하여 비용을 절약할 수 있습니다.",
"guid": "afb53b41-825a-4310-b445-bf391792c568",
"service": "Azure Openai",
- "text": "제한을 설정하도록 클라이언트 코드 디자인: 사용자 지정 클라이언트는 모델당 토큰 수에 대한 최대 제한('max_tokens') 또는 생성까지의 완료 수('n')와 같은 Azure OpenAI 완성 API의 제한 기능을 사용해야 합니다. 제한을 설정하면 서버가 클라이언트에 필요한 것보다 더 많이 생성되지 않습니다.",
+ "text": "제한을 설정하도록 클라이언트 코드 설계: 사용자 지정 클라이언트는 모델당 토큰 수에 대한 최대 제한('max_tokens') 또는 생성 완료 수('n')와 같은 Azure OpenAI 완성 API의 제한 기능을 사용해야 합니다. 제한을 설정하면 서버가 클라이언트에 필요한 것보다 더 많이 생성되지 않습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -4646,7 +4494,7 @@
"description": "",
"guid": "3c5f9e8e-c1a9-4c18-ac05-72877f24ff22",
"service": "Azure Openai",
- "text": "Azure DevOps 문화: 개발, 테스트 및 프로덕션과 같은 다양한 환경에서 Azure OpenAI 인스턴스를 배포해야 합니다. 개발 주기 전반에 걸쳐 지속적인 학습과 실험을 지원할 수 있는 환경이 있는지 확인합니다.",
+ "text": "Azure DevOps 문화: 개발, 테스트 및 프로덕션과 같은 다양한 환경에서 Azure OpenAI 인스턴스를 배포해야 합니다. 개발 주기 전반에 걸쳐 지속적인 학습과 실험을 지원할 수 있는 환경을 갖추어야 합니다.",
"type": "checklist",
"waf": "작업"
},
@@ -4691,7 +4539,7 @@
"waf": "작업"
},
{
- "description": "진단은 메트릭과 로그를 수집하고 분석하여 Azure OpenAI의 가용성, 성능 및 작업을 모니터링하는 데 도움이 됩니다.",
+ "description": "진단은 메트릭 및 로그를 수집하고 분석하여 Azure OpenAI의 가용성, 성능 및 작업을 모니터링하는 데 도움이 됩니다.",
"guid": "ff3d2610-e8e8-4a78-aba5-556758a2798c",
"service": "Azure Openai",
"text": "Azure 진단 사용 및 구성: Azure OpenAI 서비스에 대한 진단을 사용하도록 설정하고 구성합니다.",
@@ -4710,7 +4558,7 @@
"description": "",
"guid": "14677a1d-0b65-455a-997b-1490c397fbc8",
"service": "Azure Openai",
- "text": "용량: 소비자의 예상 수요를 기반으로 토큰 사용 요구 사항을 벤치마킹합니다. PTU(프로비전된 처리량 단위) 배포를 사용하는 경우 처리량의 유효성을 검사하는 데 도움이 되도록 Azure OpenAI 벤치마킹 도구를 사용하는 것이 좋습니다.",
+ "text": "용량: 소비자의 예상 수요를 기반으로 토큰 사용 요구 사항을 벤치마킹합니다. PTU(프로비전된 처리량 단위) 배포를 사용하는 경우 처리량의 유효성을 검사하는 데 도움이 되는 Azure OpenAI 벤치마킹 도구를 사용하는 것이 좋습니다.",
"type": "checklist",
"waf": "공연"
},
@@ -4758,7 +4606,7 @@
"description": "",
"guid": "9aa6da24-6a00-4381-9da6-66c9d5cbf41f",
"service": "Azure Openai",
- "text": "성능 달성: 챗봇 또는 대화형 인터페이스와 같은 애플리케이션의 경우 스트리밍 구현을 고려합니다. 스트리밍은 증분 방식으로 사용자에게 응답을 제공하여 Azure OpenAI 애플리케이션의 인식된 성능을 향상시켜 사용자 환경을 개선할 수 있습니다.",
+ "text": "성능 향상: 챗봇 또는 대화형 인터페이스와 같은 애플리케이션의 경우 스트리밍 구현을 고려하세요. 스트리밍은 증분 방식으로 사용자에게 응답을 제공하여 사용자 환경을 개선함으로써 Azure OpenAI 애플리케이션의 체감 성능을 향상시킬 수 있습니다.",
"type": "checklist",
"waf": "공연"
},
@@ -4766,7 +4614,7 @@
"description": "",
"guid": "456cbf54-9c2f-4c6e-9739-eca408fa6baf",
"service": "Azure Openai",
- "text": "성능 달성: 미세 조정을 시작하기 전에 미세 조정을 사용할 시기를 결정합니다. 모델을 조정하는 데 필요한 정보가 너무 길거나 복잡하여 프롬프트에 맞지 않는 경우와 같이 미세 조정을 위한 좋은 사용 사례가 있지만 프롬프트 엔지니어링 및 검색 증강 생성(RAG) 접근 방식이 작동하지 않거나 명백히 더 비싸다는 것을 확인하십시오.",
+ "text": "성능 달성: 미세 조정을 수행하기 전에 미세 조정을 사용할 시기를 결정합니다. 모델을 조정하는 데 필요한 정보가 너무 길거나 복잡하여 프롬프트에 맞지 않는 경우와 같이 미세 조정을 위한 좋은 사용 사례가 있지만 프롬프트 엔지니어링 및 검색 증강 생성(RAG) 접근 방식이 작동하지 않거나 명백히 더 비싸다는 것을 확인해야 합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -4790,7 +4638,7 @@
"description": "",
"guid": "bf605fe8-6171-4c01-8290-d6c79a21cf10",
"service": "Virtual Machines",
- "text": "장애 모드 분석을 수행하여 네트워크 및 스토리지 구성 요소와의 VM 상호 작용을 분석하여 장애 지점을 최소화합니다. 임시 OS(운영 체제) 디스크와 같은 구성을 선택하여 디스크 액세스를 지역화하고 네트워크 홉을 방지합니다. 부하 분산 장치를 추가하여 네트워크 트래픽을 여러 VM에 분산하여 자체 보존을 강화하면 가용성과 안정성이 향상됩니다.",
+ "text": "오류 모드 분석을 수행하여 네트워크 및 스토리지 구성 요소와의 VM 상호 작용을 분석하여 오류 지점을 최소화합니다. 임시 OS(운영 체제) 디스크와 같은 구성을 선택하여 디스크 액세스를 지역화하고 네트워크 홉을 방지합니다. 부하 분산 장치를 추가하여 네트워크 트래픽을 여러 VM에 분산하여 자체 보존을 강화하면 가용성과 안정성이 향상됩니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4814,7 +4662,7 @@
"description": "",
"guid": "6d76e7b9-52d3-4878-83ab-2a08df23c8f6",
"service": "Virtual Machines",
- "text": "VM 및 해당 종속성을 영역 간에 중복합니다. VM이 실패하는 경우 워크로드는 중복성으로 인해 계속 작동해야 합니다. 중복성 선택에 종속성을 포함합니다. 예를 들어 디스크에서 사용할 수 있는 기본 제공 중복 옵션을 사용합니다. 영역 중복 IP를 사용하여 데이터 가용성과 높은 가동 시간을 보장합니다.",
+ "text": "VM 및 해당 종속성을 영역 간에 중복합니다. VM이 실패하면 중복성으로 인해 워크로드가 계속 작동해야 합니다. 중복성 선택에 종속성을 포함합니다. 예를 들어 디스크에서 사용할 수 있는 기본 제공 중복 옵션을 사용합니다. 영역 중복 IP를 사용하여 데이터 가용성과 높은 가동 시간을 보장합니다.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4830,7 +4678,7 @@
"description": "",
"guid": "3395416e-27c6-4ded-941a-de4e562c5c00",
"service": "Virtual Machines",
- "text": "자동 복구 옵션을 살펴보세요. Azure는 VM에 대한 상태 저하 모니터링 및 자동 복구 기능을 지원합니다. 예를 들어 확장 집합은 자동 인스턴스 복구를 제공합니다. 고급 시나리오에서 자동 복구에는 Azure Site Recovery를 사용하거나, 장애 조치(failover)할 수동 대기를 사용하거나, IaC(코드형 인프라)에서 다시 배포하는 작업이 포함됩니다. 선택하는 방법은 비즈니스 요구 사항 및 조직 운영에 맞아야 합니다. 자세한 내용은 VM 서비스 중단을 참조하세요.",
+ "text": "자동 복구 옵션을 살펴보세요. Azure는 VM에 대한 상태 저하 모니터링 및 자동 복구 기능을 지원합니다. 예를 들어 확장 집합은 자동 인스턴스 복구를 제공합니다. 고급 시나리오에서 자동 복구에는 Azure Site Recovery를 사용하거나, 장애 조치(failover)할 수동 대기 또는 IaC(Infrastructure as Code)에서 다시 배포하는 작업이 포함됩니다. 선택하는 방법은 비즈니스 요구 사항 및 조직 운영에 맞아야 합니다. 자세한 내용은 VM 서비스 중단을 참조하세요.",
"type": "checklist",
"waf": "신뢰도"
},
@@ -4859,7 +4707,7 @@
"waf": "신뢰도"
},
{
- "description": "확장을 위해 애플리케이션의 미래를 보장하고 지역 또는 가용성 영역의 장애 도메인 간에 VM을 분산하는 고가용성 보장을 활용하세요.",
+ "description": "확장을 위해 애플리케이션의 미래를 보장하고 지역 또는 가용성 영역의 장애 도메인 간에 VM을 분산하는 고가용성 보장을 활용합니다.",
"guid": "bb45d3f7-dae7-4eb6-a823-76737e6d0d88",
"service": "Virtual Machines",
"text": "(확장 집합) 유연한 오케스트레이션 모드에서 Virtual Machine Scale Sets 사용하여 VM을 배포합니다.",
@@ -4870,7 +4718,7 @@
"description": "인스턴스가 비정상으로 간주되는 경우에도 가용성을 유지합니다. 자동 복구는 결함이 있는 인스턴스를 교체하여 복구를 시작합니다. 시간 창을 설정하면 부주의하거나 조기 수리 작업을 방지할 수 있습니다.",
"guid": "29912435-4c36-465e-91e2-6c8fcb42b33f",
"service": "Virtual Machines",
- "text": "(가상 머신) VM에서 인스턴스 상태를 내보내는 heath 엔드포인트를 구현합니다. (확장 집합) 선호하는 복구 작업을 지정하여 확장 집합에서 자동 복구를 사용하도록 설정합니다. VM의 상태가 변경되는 경우 자동 복구가 일시 중지되는 시간 프레임을 설정하는 것이 좋습니다.",
+ "text": "(가상 머신) VM에서 인스턴스 상태를 내보내는 heath 엔드포인트를 구현합니다. (확장 집합) 기본 복구 작업을 지정하여 확장 집합에서 자동 복구를 사용하도록 설정합니다. VM의 상태가 변경되는 경우 자동 복구가 일시 중지되는 시간 프레임을 설정하는 것이 좋습니다.",
"type": "recommendation",
"waf": "신뢰도"
},
@@ -4883,7 +4731,7 @@
"waf": "신뢰도"
},
{
- "description": "이 옵션은 장애 도메인을 격리합니다. 유지 보수 기간 동안 하나의 장애 도메인이 업데이트되면 다른 장애 도메인에서 VM 인스턴스를 사용할 수 있습니다.",
+ "description": "이 옵션은 장애 도메인을 격리합니다. 유지 보수 기간 동안 하나의 장애 도메인이 업데이트되면 VM 인스턴스를 다른 장애 도메인에서 사용할 수 있습니다.",
"guid": "07b6117e-18f8-4df2-9816-9bba2f028219",
"service": "Virtual Machines",
"text": "(확장 집합) 유연한 오케스트레이션을 통해 VM 인스턴스를 가능한 한 많은 장애 도메인에 분산할 수 있습니다.",
@@ -4891,15 +4739,15 @@
"waf": "신뢰도"
},
{
- "description": "VM 인스턴스는 로컬 오류에 대한 내성이 있는 각 Azure 지역 내에서 물리적으로 분리된 위치에 프로비전됩니다. 리소스 가용성에 따라 영역 간에 균일하지 않은 수의 인스턴스가 있을 수 있음을 명심하십시오. 영역 분산은 한 영역이 다운된 경우 다른 영역에 충분한 인스턴스를 갖도록 하여 가용성을 지원합니다. 각 영역에 있는 두 개의 인스턴스는 업그레이드 중에 버퍼를 제공합니다.",
+ "description": "VM 인스턴스는 로컬 오류에 대한 내성이 있는 각 Azure 지역 내에서 물리적으로 분리된 위치에 프로비전됩니다. 리소스 가용성에 따라 영역 간에 인스턴스 수가 고르지 않을 수 있습니다. 영역 분산은 한 영역이 다운된 경우 다른 영역에 충분한 인스턴스를 갖도록 하여 가용성을 지원합니다. 각 영역에 있는 두 개의 인스턴스는 업그레이드 중에 버퍼를 제공합니다.",
"guid": "056b1e06-a521-4662-9c87-19371260efe6",
"service": "Virtual Machines",
- "text": "(확장 집합) 확장 집합의 가용성 영역에 배포합니다. 각 영역에 두 개 이상의 인스턴스를 설정합니다. 영역 분산은 인스턴스를 영역 간에 균등하게 분산합니다.",
+ "text": "(확장 집합) 확장 집합의 가용성 영역에 배포합니다. 각 영역에 인스턴스를 두 개 이상 설정합니다. 영역 분산은 인스턴스를 여러 영역에 균등하게 분산합니다.",
"type": "recommendation",
"waf": "신뢰도"
},
{
- "description": "용량은 사용자가 사용하도록 예약되어 있으며 해당 SLA 범위 내에서 사용할 수 있습니다. 용량 예약은 더 이상 필요하지 않을 때 삭제할 수 있으며 청구는 사용량을 기반으로 합니다.",
+ "description": "용량은 사용자가 사용하도록 예약되어 있으며 해당 SLA의 범위 내에서 사용할 수 있습니다. 용량 예약은 더 이상 필요하지 않을 때 삭제할 수 있으며 청구는 사용량을 기반으로 합니다.",
"guid": "2554bcd7-c6b8-4461-aaaa-071092d5483f",
"service": "Virtual Machines",
"text": "(가상 머신) 용량 예약 기능을 활용하세요.",
@@ -4926,7 +4774,7 @@
"description": "",
"guid": "5bc85e31-f7fa-4102-8e43-6fbe7add0d89",
"service": "Virtual Machines",
- "text": "상태를 보유하는 VM을 식별합니다. 조직에서 제공한 민감도 레이블에 따라 데이터가 분류되었는지 확인합니다. 적절한 수준의 미사용 및 전송 중 암호화와 같은 보안 제어를 사용하여 데이터를 보호합니다. 높은 민감도 요구 사항이 있는 경우 이중 암호화 및 Azure 기밀 컴퓨팅과 같은 높은 보안 컨트롤을 사용하여 사용 중인 데이터를 보호하는 것이 좋습니다.",
+ "text": "상태를 보유하는 VM을 식별합니다. 데이터가 조직에서 제공한 민감도 레이블에 따라 분류되었는지 확인합니다. 적절한 수준의 저장 및 전송 중 암호화와 같은 보안 제어를 사용하여 데이터를 보호합니다. 높은 민감도 요구 사항이 있는 경우 이중 암호화 및 Azure 기밀 컴퓨팅과 같은 높은 보안 컨트롤을 사용하여 사용 중인 데이터를 보호하는 것이 좋습니다.",
"type": "checklist",
"waf": "안전"
},
@@ -4942,7 +4790,7 @@
"description": "",
"guid": "becd6031-a256-4186-995e-75817fc7783c",
"service": "Virtual Machines",
- "text": "VM에 도달하려고 시도하는 ID 및 다른 리소스에 도달하는 VM에 액세스 제어를 적용합니다. 인증 및 권한 부여 요구 사항에 Microsoft Entra ID를 사용합니다. VM 및 해당 종속성(예: 비밀)에 대해 강력한 암호, 다단계 인증 및 RBAC(역할 기반 액세스 제어)를 배치하여 허용된 ID가 해당 역할에 필요한 작업만 수행할 수 있도록 합니다.",
+ "text": "VM에 도달하려고 시도하는 ID와 다른 리소스에 도달하는 VM에도 액세스 제어를 적용합니다. 인증 및 권한 부여 요구 사항에 Microsoft Entra ID를 사용합니다. VM 및 해당 종속성(예: 비밀)에 대해 강력한 암호, 다단계 인증 및 RBAC(역할 기반 액세스 제어)를 배치하여 허용된 ID가 해당 역할에 필요한 작업만 수행할 수 있도록 합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -4950,7 +4798,7 @@
"description": "",
"guid": "cc96d188-8a1f-4b48-9525-d6f3f867f322",
"service": "Virtual Machines",
- "text": "네트워크 컨트롤을 사용하여 수신 및 송신 트래픽을 제한합니다. Azure Virtual Network에서 VM 및 확장 집합을 격리하고 네트워크 보안 그룹을 정의하여 트래픽을 필터링합니다. DDoS(분산 서비스 거부) 공격으로부터 보호합니다. 로드 밸런서 및 방화벽 규칙을 사용하여 악성 트래픽 및 데이터 반출 공격으로부터 보호합니다.",
+ "text": "네트워크 제어를 사용하여 수신 및 송신 트래픽을 제한합니다. Azure Virtual Network에서 VM 및 확장 집합을 격리하고 네트워크 보안 그룹을 정의하여 트래픽을 필터링합니다. 분산 서비스 거부(DDoS) 공격으로부터 보호합니다. 로드 밸런서 및 방화벽 규칙을 사용하여 악의적인 트래픽 및 데이터 반출 공격으로부터 보호합니다.",
"type": "checklist",
"waf": "안전"
},
@@ -5006,12 +4854,12 @@
"description": "태그 지정은 리소스를 분류하고 구성하는 일반적인 방법이며 인시던트 관리 중에 중요할 수 있습니다. 자세한 내용은 이름 지정 및 태그 지정의 목적을 참조하십시오.",
"guid": "944802d9-671c-479f-b973-fd6111a18486",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) 프로비저닝된 리소스에 조직 권장 태그를 적용합니다.",
+ "text": "(VM, 확장 집합) 프로비저닝된 리소스에 organization-recommended 태그를 적용합니다.",
"type": "recommendation",
"waf": "안전"
},
{
- "description": "보안 프로필의 기능은 VM이 생성될 때 자동으로 활성화됩니다. 자세한 내용은 Virtual Machine Scale Sets에 대한 Azure 보안 기준을 참조하세요.",
+ "description": "보안 프로필의 기능은 VM이 생성될 때 자동으로 활성화됩니다. 자세한 내용은 Virtual Machine Scale Sets 대한 Azure 보안 기준을 참조하세요.",
"guid": "a6b12603-c2e3-43fd-9a79-6e6317817278",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) VM 구성에서 사용하도록 설정하려는 보안 기능을 사용하여 보안 프로필을 설정합니다. 예를 들어 프로필에서 호스트에서 암호화를 지정하면 VM 호스트에 저장된 데이터는 미사용 시 암호화되고 흐름은 스토리지 서비스로 암호화됩니다.",
@@ -5070,7 +4918,7 @@
"description": "",
"guid": "dff9f383-b459-4359-907e-bd33a92d4bd6",
"service": "Virtual Machines",
- "text": "종속 리소스에 적합한 기능을 선택합니다. 예약된 용량과 함께 Azure Backup 스토리지를 사용하여 자격 증명 모음 표준 계층에 대한 백업 스토리지 비용을 절감합니다. 1년 또는 3년 동안 예약하면 할인을 제공합니다.",
+ "text": "종속 리소스에 적합한 기능을 선택합니다. 예약된 용량의 Azure Backup 스토리지를 사용하여 자격 증명 모음 표준 계층에 대한 백업 스토리지 비용을 절감합니다. 1년 또는 3년 동안 예약하면 할인을 제공합니다.",
"type": "checklist",
"waf": "비용"
},
@@ -5094,7 +4942,7 @@
"description": "",
"guid": "877c04dd-441f-4202-9b87-9eeb3c60b564",
"service": "Virtual Machines",
- "text": "최적화할 수 있는 방법을 찾습니다. 일부 전략에는 기존 시스템의 리소스를 늘리거나, 스케일 업하고, 해당 시스템의 인스턴스를 더 추가하거나, 스케일 아웃 중에서 가장 비용 효율적인 방법을 선택하는 것이 포함됩니다. 수요를 다른 리소스에 분산하여 오프로드하거나 우선 순위 큐, 게이트웨이 오프로딩, 버퍼링 및 속도 제한을 구현하여 수요를 줄일 수 있습니다. 자세한 내용은 성능 효율성의 권장 사항을 참조하세요.",
+ "text": "최적화할 수 있는 방법을 찾아보세요. 일부 전략에는 기존 시스템의 리소스를 늘리거나, 스케일 업하고, 해당 시스템의 인스턴스를 더 추가하거나, 스케일 아웃하는 것 중에서 가장 비용 효율적인 방법을 선택하는 것이 포함됩니다. 수요를 다른 리소스에 분산하여 오프로드하거나 우선 순위 큐, 게이트웨이 오프로딩, 버퍼링 및 속도 제한을 구현하여 수요를 줄일 수 있습니다. 자세한 내용은 성능 효율성의 권장 사항을 참조하세요.",
"type": "checklist",
"waf": "비용"
},
@@ -5131,10 +4979,10 @@
"waf": "비용"
},
{
- "description": "온-프레미스 라이선스를 극대화하는 동시에 클라우드의 이점을 얻을 수 있습니다.",
+ "description": "온-프레미스 라이선스를 극대화하는 동시에 클라우드의 이점을 활용할 수 있습니다.",
"guid": "3c34c3e4-5715-472e-953e-2d5030bf18a0",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) Azure 하이브리드 혜택을 사용하여 라이선스 이동을 활용하세요. VM에는 사용자 고유의 온-프레미스 Windows Server OS 라이선스를 Azure로 가져올 수 있는 라이선스 옵션이 있습니다. 또한 Azure 하이브리드 혜택을 통해 특정 Linux 구독을 Azure로 가져올 수 있습니다.",
+ "text": "(VM, 확장 집합) Azure 하이브리드 혜택을 사용하여 라이선스 이동을 활용하세요. VM에는 고유한 온-프레미스 Windows Server OS 라이선스를 Azure로 가져올 수 있는 라이선스 옵션이 있습니다. 또한 Azure 하이브리드 혜택을 통해 특정 Linux 구독을 Azure로 가져올 수 있습니다.",
"type": "recommendation",
"waf": "비용"
},
@@ -5158,7 +5006,7 @@
"description": "",
"guid": "f99e71a9-05ee-41c2-81b7-8d794763040b",
"service": "Virtual Machines",
- "text": "일상적인 작업의 일부로 정기적인 시스템 패치를 포함하는 유지 관리 계획을 수립합니다. 즉각적인 패치 적용이 가능한 비상 프로세스를 포함합니다. 사용자 지정 프로세스를 사용하여 패치를 관리하거나 Azure에 작업을 부분적으로 위임할 수 있습니다.",
+ "text": "일상적인 작업의 일부로 정기적인 시스템 패치를 포함하는 유지 관리 계획을 수립합니다. 패치를 즉시 적용할 수 있는 비상 프로세스를 포함합니다. 사용자 지정 프로세스를 사용하여 패치를 관리하거나 Azure에 작업을 부분적으로 위임할 수 있습니다.",
"type": "checklist",
"waf": "작업"
},
@@ -5182,7 +5030,7 @@
"description": "",
"guid": "079c8821-00dd-4eaf-9cae-5a3dbfd6fdfa",
"service": "Virtual Machines",
- "text": "프로덕션 환경과 밀접하게 일치하는 테스트 환경을 구축하여 프로덕션에 배포하기 전에 업데이트 및 변경 사항을 테스트합니다. 보안 업데이트, 성능 기준 및 안정성 오류를 테스트하기 위한 프로세스를 마련합니다. Azure Chaos Studio 오류 라이브러리를 활용하여 오류 조건을 삽입하고 시뮬레이션합니다. 자세한 내용은 Azure Chaos Studio 오류 및 작업 라이브러리를 참조하세요.",
+ "text": "프로덕션 환경과 밀접하게 일치하는 테스트 환경을 구축하여 프로덕션 환경에 배포하기 전에 업데이트 및 변경 사항을 테스트합니다. 보안 업데이트, 성능 기준 및 안정성 오류를 테스트하기 위한 프로세스를 마련합니다. Azure Chaos Studio 오류 라이브러리를 활용하여 오류 조건을 삽입하고 시뮬레이션합니다. 자세한 내용은 Azure Chaos Studio 오류 및 작업 라이브러리를 참조하세요.",
"type": "checklist",
"waf": "작업"
},
@@ -5190,7 +5038,7 @@
"description": "",
"guid": "77cdbef0-ba18-4ef0-9ef4-088931e331c7",
"service": "Virtual Machines",
- "text": "할당량을 관리합니다. 워크로드에 필요한 할당량 수준을 계획하고 워크로드가 발전함에 따라 해당 수준을 정기적으로 검토합니다. 할당량을 늘리거나 줄여야 하는 경우 이러한 변경을 조기에 요청하세요.",
+ "text": "할당량을 관리합니다. 워크로드에 필요한 할당량 수준을 계획하고 워크로드가 발전함에 따라 해당 수준을 정기적으로 검토합니다. 할당량을 늘리거나 줄여야 하는 경우 조기에 변경을 요청하세요.",
"type": "checklist",
"waf": "작업"
},
@@ -5198,12 +5046,12 @@
"description": "유연한 오케스트레이션을 통해 VM 인스턴스를 대규모로 관리할 수 있습니다. 개별 VM을 처리하면 운영 오버헤드가 추가됩니다. 예를 들어 VM 인스턴스를 삭제하면 연결된 디스크 및 NIC도 자동으로 삭제됩니다. VM 인스턴스는 업데이트 작업으로 인해 서비스가 중단되지 않도록 여러 장애 도메인에 분산되어 있습니다.",
"guid": "3049efb5-d3ae-4e36-a8fa-12f2c4a44144",
"service": "Virtual Machines",
- "text": "(확장 집합) 유연한 오케스트레이션 모드의 Virtual Machine Scale Sets 워크로드의 배포 및 관리를 간소화하는 데 도움이 될 수 있습니다. 예를 들어 자동 복구를 사용하여 자가 복구를 쉽게 관리할 수 있습니다.",
+ "text": "(확장 집합) 유연한 오케스트레이션 모드의 Virtual Machine Scale Sets 워크로드의 배포 및 관리를 간소화하는 데 도움이 될 수 있습니다. 예를 들어 자동 복구를 사용하여 자체 복구를 쉽게 관리할 수 있습니다.",
"type": "recommendation",
"waf": "작업"
},
{
- "description": "보안은 업그레이드의 주된 이유입니다. 인스턴스에 대한 보안 보증은 시간이 지남에 따라 감소해서는 안 됩니다. 롤링 업그레이드는 배치로 수행되므로 모든 인스턴스가 동시에 다운되지 않습니다.",
+ "description": "보안은 업그레이드의 주된 이유입니다. 인스턴스에 대한 보안 보증은 시간이 지남에 따라 감소해서는 안 됩니다. 롤링 업그레이드는 일괄적으로 수행되므로 모든 인스턴스가 동시에 다운되지 않습니다.",
"guid": "19de83a6-2f87-49b1-8241-d1d687f46658",
"service": "Virtual Machines",
"text": "(확장 집합) 업그레이드 정책을 설정하여 VM을 최신 상태로 유지합니다. 롤링 업그레이드를 권장합니다. 그러나 세부적인 제어가 필요한 경우 수동으로 업그레이드하도록 선택합니다. 유연한 오케스트레이션의 경우 Azure Update Manager를 사용할 수 있습니다.",
@@ -5211,7 +5059,7 @@
"waf": "작업"
},
{
- "description": "확장 집합의 VM이 만들어지고 지정된 앱이 미리 설치되어 관리가 더 쉬워집니다.",
+ "description": "확장 집합의 VM이 만들어지고 지정된 앱이 미리 설치되므로 관리가 더 쉬워집니다.",
"guid": "65c832e8-2882-45ed-b239-0e68f74975aa",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) 프로필에서 응용 프로그램을 정의하여 Azure Compute Gallery에서 VM 응용 프로그램을 자동으로 배포합니다.",
@@ -5222,7 +5070,7 @@
"description": "확장은 각 VM에서 수동으로 설치, 구성 또는 업그레이드할 필요 없이 규모에 맞게 소프트웨어 설치를 간소화하는 데 도움이 될 수 있습니다.",
"guid": "40266c61-9685-4ee1-8cb6-a899a6b573f2",
"service": "Virtual Machines",
- "text": "부트스트래핑의 일부로 사전 구축된 소프트웨어 구성 요소를 확장으로 설치합니다. Azure는 VM에 대한 유틸리티 응용 프로그램을 구성, 모니터링, 보안 및 제공하는 데 사용할 수 있는 많은 확장을 지원합니다. 확장에서 자동 업그레이드를 사용하도록 설정합니다.",
+ "text": "사전 구축된 소프트웨어 구성 요소를 부트스트래핑의 일부로 확장으로 설치합니다. Azure는 VM에 대한 유틸리티 응용 프로그램을 구성, 모니터링, 보안 및 제공하는 데 사용할 수 있는 많은 확장을 지원합니다. 확장에서 자동 업그레이드를 사용하도록 설정합니다.",
"type": "recommendation",
"waf": "작업"
},
@@ -5230,7 +5078,7 @@
"description": "데이터 모니터링은 인시던트 해결의 핵심입니다. 포괄적인 모니터링 스택은 VM의 성능 및 상태에 대한 정보를 제공합니다. 인스턴스를 지속적으로 모니터링하면 성능 과부하 및 안정성 문제와 같은 오류에 대비하거나 예방할 수 있습니다.",
"guid": "72e210dc-5abb-4569-b650-ec27003bb1cf",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) VM 인스턴스의 상태를 모니터링하고 측정합니다. 모니터 에이전트 확장을 VM에 배포하여 OS별 데이터 수집 규칙을 사용하여 게스트 OS에서 모니터링 데이터를 수집합니다. VM 인사이트를 사용하여 상태 및 성능을 모니터링하고 수집된 데이터에서 추세를 볼 수 있습니다. 부팅 진단을 사용하여 VM이 부팅될 때 정보를 가져옵니다. 부팅 진단은 부팅 실패도 진단합니다.",
+ "text": "(VM, 확장 집합) VM 인스턴스의 상태를 모니터링하고 측정합니다. Monitor 에이전트 확장을 VM에 배포하여 OS별 데이터 수집 규칙을 사용하여 게스트 OS에서 모니터링 데이터를 수집합니다. VM 인사이트를 사용하여 상태 및 성능을 모니터링하고 수집된 데이터에서 추세를 볼 수 있습니다. 부팅 진단을 사용하여 VM이 부팅될 때 정보를 가져옵니다. 부트 진단은 부트 실패도 진단합니다.",
"type": "recommendation",
"waf": "작업"
},
@@ -5254,7 +5102,7 @@
"description": "",
"guid": "ffee7b2f-b57c-40cc-a8ab-9044dead9dc7",
"service": "Virtual Machines",
- "text": "VM 성능 튜닝. 성능 최적화를 활용하고 워크로드에 필요한 기능을 향상시킵니다. 예를 들어 고성능 사용 사례 및 가속화된 네트워킹을 위해 로컬에 연결된 NVMe(Non-Volatile Memory Express)를 사용하고 더 나은 성능과 확장성을 위해 프리미엄 SSD v2를 사용합니다.",
+ "text": "VM 성능 튜닝. 성능 최적화를 활용하고 워크로드에 필요한 기능을 향상시킵니다. 예를 들어 고성능 사용 사례 및 가속화된 네트워킹을 위해 로컬로 연결된 NVMe(Non-Volatile Memory Express)를 사용하고 더 나은 성능과 확장성을 위해 프리미엄 SSD v2를 사용합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -5270,7 +5118,7 @@
"description": "",
"guid": "739525ea-4d0a-4965-baef-ab0325fbed67",
"service": "Virtual Machines",
- "text": "성능 데이터를 수집합니다. 모니터링에 대한 Operational Excellence 모범 사례에 따라 적절한 확장을 배포하여 성능 지표에 대해 추적하는 메트릭을 확인합니다.",
+ "text": "성능 데이터를 수집합니다. 모니터링에 대한 Operational Excellence 모범 사례를 따르고 적절한 확장을 배포하여 성능 지표에 대해 추적하는 메트릭을 확인합니다.",
"type": "checklist",
"waf": "공연"
},
@@ -5286,7 +5134,7 @@
"description": "VM의 크기를 적절하게 조정하는 것은 워크로드의 성능에 큰 영향을 미치는 기본적인 결정입니다. 올바른 VM 집합이 없으면 성능 문제가 발생하고 불필요한 비용이 발생할 수 있습니다.",
"guid": "67cc04db-4b74-40f4-9bf6-0ba5f758b45e",
"service": "Virtual Machines",
- "text": "(VM, 확장 집합) 용량 계획에 맞는 VM에 대한 SKU를 선택합니다. 부적합한 SKU를 필터링할 수 있도록 코어 수, 메모리, 스토리지 및 네트워크 대역폭을 포함한 워크로드 요구 사항을 잘 이해해야 합니다.",
+ "text": "(VM, 확장 집합) 용량 계획에 맞는 VM용 SKU를 선택합니다. 부적합한 SKU를 필터링할 수 있도록 코어 수, 메모리, 스토리지 및 네트워크 대역폭을 포함한 워크로드 요구 사항을 잘 이해해야 합니다.",
"type": "recommendation",
"waf": "공연"
},
@@ -5299,7 +5147,7 @@
"waf": "공연"
},
{
- "description": "프리미엄 SSD는 I/O 집약적 워크로드가 있는 고성능 및 짧은 대기 시간 디스크 지원 VM을 제공합니다. 프리미엄 SSD v2는 디스크 크기 조정이 필요하지 않으므로 과도한 오버 프로비저닝 없이 고성능을 가능하게 하고 사용되지 않는 용량 비용을 최소화합니다. VM SKU에서 사용할 수 있는 경우 로컬로 연결된 NVMe 또는 유사한 디바이스는 특히 높은 IOPS(초당 입력/출력 작업 수)와 짧은 대기 시간이 필요한 사용 사례에 대해 고성능을 제공할 수 있습니다.",
+ "description": "프리미엄 SSD는 I/O 집약적 워크로드가 있는 고성능 및 짧은 대기 시간 디스크 지원 VM을 제공합니다. 프리미엄 SSD v2는 디스크 크기 조정이 필요하지 않으므로 과도한 오버 프로비저닝 없이 고성능을 가능하게 하고 사용하지 않는 용량의 비용을 최소화합니다. VM SKU에서 사용할 수 있는 경우 로컬로 연결된 NVMe 또는 유사한 디바이스는 특히 높은 IOPS(초당 입력/출력 작업 수) 및 짧은 대기 시간이 필요한 사용 사례에 대해 고성능을 제공할 수 있습니다.",
"guid": "a91aae92-2b2c-4c88-b268-2c70b995a952",
"service": "Virtual Machines",
"text": "(VM, 확장 집합) 기존 워크로드 및 VM SKU의 디스크 성능을 분석하여 스토리지 프로필을 설정합니다. 프로덕션 VM에 프리미엄 SSD를 사용합니다. 프리미엄 SSD v2를 사용하여 디스크의 성능을 조정합니다. 로컬로 연결된 NVMe 디바이스를 사용합니다.",
@@ -5307,7 +5155,7 @@
"waf": "공연"
},
{
- "description": "VM에 대한 SR-IOV(단일 루트 I/O 가상화)를 가능하게 하여 네트워킹 성능을 크게 향상시킵니다.",
+ "description": "VM에 대한 SR-IOV(단일 루트 I/O 가상화)를 활성화하여 네트워킹 성능을 크게 향상시킵니다.",
"guid": "57e446da-1b2e-4bdc-abc9-3e978a11e940",
"service": "Virtual Machines",
"text": "(가상 머신) 가속화된 네트워킹을 사용하도록 설정하는 것이 좋습니다.",
@@ -5326,7 +5174,7 @@
"metadata": {
"name": "WAF Service Guides",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -5353,31 +5201,31 @@
],
"waf": [
{
- "name": "공연"
+ "name": "신뢰도"
},
{
- "name": "안전"
+ "name": "비용"
},
{
- "name": "공연"
+ "name": "작업"
},
{
- "name": "비용"
+ "name": "안전"
},
{
- "name": "신뢰도"
+ "name": "공연"
},
{
- "name": "작업"
+ "name": "신뢰도"
},
{
"name": "작업"
},
{
- "name": "신뢰도"
+ "name": "안전"
},
{
- "name": "안전"
+ "name": "공연"
},
{
"name": "비용"
diff --git a/checklists-ext/wafsg_checklist.pt.json b/checklists-ext/wafsg_checklist.pt.json
index db4a33623..b1cbde4b1 100644
--- a/checklists-ext/wafsg_checklist.pt.json
+++ b/checklists-ext/wafsg_checklist.pt.json
@@ -476,489 +476,337 @@
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "Azure Application Gateway",
- "text": "Implante as instâncias em uma configuração com reconhecimento de zona, quando disponível.",
+ "text": "Use o Gateway de Aplicativo v2 em novas implantações, a menos que sua carga de trabalho exija especificamente o Gateway de Aplicativo v1.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "Azure Application Gateway",
- "text": "Use o Gateway de Aplicativo com o WAF (Firewall de Aplicativo Web) em uma rede virtual para proteger o tráfego 'HTTP/S' de entrada da Internet.",
+ "text": "Crie redundância em seu design. Distribua instâncias do Gateway de Aplicativo entre zonas de disponibilidade para melhorar a tolerância a falhas e criar redundância. O tráfego vai para outras zonas se uma delas falhar. Para obter mais informações, consulte Recomendações para usar zonas e regiões de disponibilidade.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "Azure Application Gateway",
- "text": "Em novas implantações, use o Gateway de Aplicativo do Azure v2, a menos que haja um motivo convincente para usar o Gateway de Aplicativo do Azure v1.",
+ "text": "Planeje um tempo extra para atualizações de regras e outras alterações de configuração antes de acessar o Gateway de Aplicativo ou fazer outras alterações. Por exemplo, você pode precisar de mais tempo para remover servidores de um pool de back-end porque eles precisam drenar as conexões existentes.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "Azure Application Gateway",
- "text": "Planejar atualizações de regras",
+ "text": "Implemente o padrão de Monitoramento de Ponto de Extremidade de Integridade. Seu aplicativo deve expor pontos de extremidade de integridade, que agregam o estado dos serviços críticos e dependências que seu aplicativo precisa para atender às solicitações. As investigações de integridade do Gateway de Aplicativo usam o ponto de extremidade para detectar a integridade dos servidores no pool de back-end. Para obter mais informações, consulte Padrão de monitoramento de ponto de extremidade de integridade.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "Azure Application Gateway",
- "text": "Usar investigações de integridade para detectar indisponibilidade de back-end",
+ "text": "Avalie o impacto das configurações de intervalo e limite em uma investigação de integridade. A investigação de integridade envia solicitações para o ponto de extremidade configurado em um intervalo definido. E o back-end tolera um número limitado de solicitações com falha antes de ser marcado como não íntegro. Essas configurações podem entrar em conflito, o que apresenta uma compensação.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "Azure Application Gateway",
- "text": "Examinar o impacto das configurações de intervalo e limite nas investigações de integridade",
+ "text": "Verifique as dependências downstream por meio de pontos de extremidade de integridade. Para isolar falhas, cada um dos back-ends pode ter suas próprias dependências. Por exemplo, um aplicativo que você hospeda por trás do Gateway de Aplicativo pode ter vários back-ends e cada back-end se conecta a um banco de dados ou réplica diferente. Quando essa dependência falha, o aplicativo pode funcionar, mas não retorna resultados válidos. Por esse motivo, o ponto de extremidade de integridade deve validar idealmente todas as dependências.",
"type": "checklist",
"waf": "fiabilidade"
},
{
"description": "",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "Azure Application Gateway",
- "text": "Verificar dependências downstream por meio de pontos de extremidade de integridade",
+ "text": "Considere as limitações do Gateway de Aplicativo e os problemas conhecidos que podem afetar a confiabilidade. Examine as Perguntas frequentes sobre o Gateway de Aplicativo para obter informações importantes sobre o comportamento por design, correções em construção, limitações da plataforma e possíveis soluções alternativas ou estratégias de mitigação. Não use UDRs na sub-rede dedicada do Gateway de Aplicativo.",
"type": "checklist",
"waf": "fiabilidade"
},
{
- "description": "Planeje tempo suficiente para atualizações antes de acessar o Gateway de Aplicativo ou fazer mais alterações. Por exemplo, a remoção de servidores do pool de back-end pode levar algum tempo porque eles precisam drenar as conexões existentes.",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "Azure Application Gateway",
- "text": "Planejar atualizações de regras",
- "type": "recommendation",
- "waf": "Fiabilidade"
+ "text": "Considere as limitações da porta SNAT (Conversão de Endereços de Rede de Origem) em seu design que podem afetar as conexões de back-end no Gateway de Aplicativo. Alguns fatores afetam como o Gateway de Aplicativo atinge o limite de porta SNAT. Por exemplo, se o back-end for um endereço IP público, ele exigirá sua própria porta SNAT. Para evitar limitações de porta SNAT, você pode executar uma das seguintes opções:",
+ "type": "checklist",
+ "waf": "fiabilidade"
},
{
- "description": "Se o Gateway de Aplicativo for usado para balancear a carga do tráfego de entrada em várias instâncias de back-end, recomendamos o uso de investigações de integridade. Isso garantirá que o tráfego não seja roteado para back-ends que não conseguem lidar com o tráfego.",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "Quando você distribui várias instâncias entre zonas, sua carga de trabalho pode suportar falhas em uma única zona. Se você tiver uma zona indisponível, o tráfego mudará automaticamente para instâncias íntegras em outras zonas, o que mantém a confiabilidade do aplicativo.",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "Azure Application Gateway",
- "text": "Usar investigações de integridade para detectar indisponibilidade de back-end",
+ "text": "Implante instâncias do Gateway de Aplicativo em uma configuração com reconhecimento de zona. Verifique o suporte regional para redundância de zona porque nem todas as regiões oferecem esse recurso.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "A investigação de integridade envia solicitações para o ponto de extremidade configurado em um intervalo definido. Além disso, há um limite de solicitações com falha que serão toleradas antes que o back-end seja marcado como não íntegro. Esses números apresentam uma compensação.- Definir um intervalo maior coloca uma carga maior em seu serviço. Cada instância do Gateway de Aplicativo envia suas próprias investigações de integridade, portanto, 100 instâncias a cada 30 segundos significam 100 solicitações a cada 30 segundos.- Definir um intervalo menor deixa mais tempo antes que uma interrupção seja detectada.- Definir um limite baixo e não íntegro pode significar que falhas curtas e transitórias podem derrubar um back-end. - Definir um limite alto, pode levar mais tempo para tirar um back-end da rotação.",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "As investigações de integridade garantem que o tráfego seja roteado apenas para back-ends que possam lidar com o tráfego. O Gateway de Aplicativo monitora a integridade de todos os servidores em seu pool de back-end e interrompe automaticamente o envio de tráfego para qualquer servidor que considere não íntegro.",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "Azure Application Gateway",
- "text": "Examinar o impacto das configurações de intervalo e limite nas investigações de integridade",
+ "text": "Use investigações de integridade do Gateway de Aplicativo para detectar a indisponibilidade de back-end.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Suponha que cada back-end tenha suas próprias dependências para garantir que as falhas sejam isoladas. Por exemplo, um aplicativo hospedado por trás do Gateway de Aplicativo pode ter vários back-ends, cada um conectado a um banco de dados diferente (réplica). Quando essa dependência falha, o aplicativo pode estar funcionando, mas não retornará resultados válidos. Por esse motivo, o ponto de extremidade de integridade deve validar idealmente todas as dependências. Lembre-se de que, se cada chamada para o ponto de extremidade de integridade tiver uma chamada de dependência direta, esse banco de dados receberá 100 consultas a cada 30 segundos em vez de 1. Para evitar isso, o ponto de extremidade de integridade deve armazenar em cache o estado das dependências por um curto período de tempo.",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "Use a limitação de taxa para evitar problemas como tempestades de repetição.",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "Azure Application Gateway",
- "text": "Verificar dependências downstream por meio de pontos de extremidade de integridade",
+ "text": "Configure regras de limitação de taxa para o WAF do Azure para que os clientes não possam enviar muito tráfego para seu aplicativo.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "Determinados cenários podem forçá-lo a implementar regras especificamente no Gateway de Aplicativo. Por exemplo, se as regras ModSec CRS 2.2.9, CRS 3.0 ou CRS 3.1 forem necessárias, essas regras só poderão ser implementadas no Gateway de Aplicativo. Por outro lado, a limitação de taxa e a filtragem geográfica estão disponíveis apenas no Azure Front Door, não no AppGateway.",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "UDRs na sub-rede do Gateway de Aplicativo podem causar alguns problemas. Não use UDRs na sub-rede do Gateway de Aplicativo para que você possa exibir a integridade, os logs e as métricas de back-end.",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "Azure Application Gateway",
- "text": "Ao usar o Azure Front Door e o Gateway de Aplicativo para proteger aplicativos 'HTTP/S', use políticas de WAF no Front Door e bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.",
+ "text": "Não use UDRs no Gateway de Aplicativo para que o relatório de integridade de back-end funcione corretamente e gere os logs e as métricas corretos. Se você precisar usar uma UDR na sub-rede do Gateway de Aplicativo, consulte UDRs com suporte.",
"type": "recommendation",
"waf": "Fiabilidade"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "Defina o IdleTimeout para corresponder ao back-end. Essa configuração garante que a conexão entre o Gateway de Aplicativo e o cliente permaneça aberta se o back-end levar mais de quatro minutos para responder à solicitação. Se você não definir essa configuração, a conexão será fechada e o cliente não verá a resposta de back-end.",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "Azure Application Gateway",
- "text": "Configurar uma política TLS para segurança aprimorada",
- "type": "checklist",
- "waf": "segurança"
+ "text": "Defina as configurações de IdleTimeout para corresponder às características de ouvinte e tráfego do aplicativo de back-end. O valor padrão é quatro minutos. Você pode configurá-lo para um máximo de 30 minutos. Para obter mais informações, consulte Redefinição do protocolo TCP (Protocolo de Controle de Transmissão) do balanceador de carga e tempo limite ocioso.",
+ "type": "recommendation",
+ "waf": "Fiabilidade"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "Azure Application Gateway",
- "text": "Usar o AppGateway para terminação TLS",
+ "text": "Examine a linha de base de segurança do Gateway de Aplicativo.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "Azure Application Gateway",
- "text": "Usar o Azure Key Vault para armazenar certificados TLS",
+ "text": "Bloqueie ameaças comuns na borda. O WAF se integra ao Gateway de Aplicativo. Habilite as regras do WAF nos front-ends para proteger os aplicativos contra explorações e vulnerabilidades comuns na borda da rede, que está próxima da origem do ataque. Para obter mais informações, consulte WAF no Gateway de Aplicativo.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "Azure Application Gateway",
- "text": "Ao criptografar novamente o tráfego de back-end, verifique se o certificado do servidor de back-end contém as CAs (Autoridades de Certificação) raiz e intermediária",
+ "text": "Permitir apenas acesso autorizado ao plano de controle. Use o RBAC (controle de acesso baseado em função) do Gateway de Aplicativo para restringir o acesso apenas às identidades que precisam dele.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "Azure Application Gateway",
- "text": "Usar um servidor DNS apropriado para recursos do pool de back-end",
+ "text": "Proteja os dados em trânsito. Habilite o TLS (Transport Layer Security) de ponta a ponta, a terminação TLS e a criptografia TLS de ponta a ponta. Ao criptografar novamente o tráfego de back-end, certifique-se de que o certificado do servidor de back-end contenha as autoridades de certificação (CAs) raiz e intermediária.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "Azure Application Gateway",
- "text": "Cumprir todas as restrições de NSG para Gateway de Aplicativo",
+ "text": "Proteja os segredos do aplicativo. Use o Azure Key Vault para armazenar certificados TLS para aumentar a segurança e facilitar o processo de renovação e rotação de certificados.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "Azure Application Gateway",
- "text": "Abster-se de usar UDRs na sub-rede do Gateway de Aplicativo",
+ "text": "Reduza a superfície de ataque e fortaleça a configuração. Remova as configurações padrão desnecessárias e proteja a configuração do Gateway de Aplicativo para reforçar os controles de segurança. Cumpra todas as restrições de NSG (grupo de segurança de rede) para o Gateway de Aplicativo.",
"type": "checklist",
"waf": "segurança"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "Azure Application Gateway",
- "text": "Esteja ciente das alterações de capacidade do Gateway de Aplicativo ao habilitar o WAF",
+ "text": "Monitore a atividade anômala. Revise regularmente os logs para verificar se há ataques e falsos positivos. Envie logs do WAF do Gateway de Aplicativo para o SIEM (gerenciamento de eventos e informações de segurança) centralizado da sua organização, como o Microsoft Sentinel, para detectar padrões de ameaças e incorporar medidas preventivas no design da carga de trabalho.",
"type": "checklist",
"waf": "segurança"
},
{
- "description": "Configure uma política TLS para segurança extra. Verifique se você está sempre usando a versão mais recente da política TLS disponível. Isso impõe o TLS 1.2 e cifras mais fortes.",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "Azure Application Gateway",
- "text": "Configurar uma política TLS para segurança aprimorada",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Há vantagens de usar o Gateway de Aplicativo para terminação TLS:- O desempenho melhora porque as solicitações que vão para back-ends diferentes precisam ser autenticadas novamente em cada back-end.- Melhor utilização dos servidores de back-end porque eles não precisam executar o processamento TLS- Roteamento inteligente acessando o conteúdo da solicitação.- Gerenciamento de certificados mais fácil porque o certificado só precisa ser instalado no Gateway de Aplicativo.",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "description": "Use a política TLS mais recente para impor o uso do TLS 1.2 e cifras mais fortes. A política TLS inclui o controle da versão do protocolo TLS e dos conjuntos de criptografia, e também a ordem na qual um handshake TLS usa criptografias.",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "Azure Application Gateway",
- "text": "Usar o AppGateway para terminação TLS",
+ "text": "Configure uma política TLS para segurança aprimorada. Certifique-se de usar a versão mais recente da política TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "O Gateway de Aplicativo pode ser integrado ao Key Vault. Isso fornece segurança mais forte, separação mais fácil de funções e responsabilidades, suporte para certificados gerenciados e um processo de renovação e rotação de certificados mais fácil.",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "description": "O desempenho melhora porque as solicitações que vão para back-ends diferentes não precisam ser autenticadas novamente em cada back-end. O gateway pode acessar o conteúdo da solicitação e tomar decisões de roteamento inteligentes. Você só precisa instalar o certificado no Gateway de Aplicativo, o que simplifica o gerenciamento de certificados.",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "Azure Application Gateway",
- "text": "Usar o Azure Key Vault para armazenar certificados TLS",
+ "text": "Use o Gateway de Aplicativo para terminação TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "Um certificado TLS do servidor back-end deve ser emitido por uma autoridade de certificação conhecida. Se o certificado não tiver sido emitido por uma autoridade de certificação confiável, o Gateway de Aplicativo verificará se o certificado foi emitido por uma autoridade de certificação confiável e assim por diante, até que um certificado de autoridade de certificação confiável seja encontrado. Só então uma conexão segura é estabelecida. Caso contrário, o Gateway de Aplicativo marcará o back-end como não íntegro.",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "description": "Essa abordagem fornece segurança mais forte, separação mais fácil de funções e responsabilidades, suporte para certificados gerenciados e um processo mais fácil de renovação e rotação de certificados.",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "Azure Application Gateway",
- "text": "Ao criptografar novamente o tráfego de back-end, verifique se o certificado do servidor de back-end contém as CAs (Autoridades de Certificação) raiz e intermediária",
+ "text": "Integre o Gateway de Aplicativo ao Key Vault para armazenar certificados TLS.",
"type": "recommendation",
"waf": "Segurança"
},
{
- "description": "Quando o pool de back-end contém um FQDN resolvível, a resolução DNS é baseada em uma zona DNS privada ou servidor DNS personalizado (se configurado na VNet) ou usa o DNS padrão fornecido pelo Azure.",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "A sub-rede do Gateway de Aplicativo dá suporte a NSGs, mas há algumas restrições. Por exemplo, alguma comunicação com determinados intervalos de portas é proibida. Certifique-se de entender as implicações dessas restrições.",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "Azure Application Gateway",
- "text": "Usar um servidor DNS apropriado para recursos do pool de back-end",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Os NSGs têm suporte na sub-rede do Gateway de Aplicativo, mas há algumas restrições. Por exemplo, alguma comunicação com determinados intervalos de portas é proibida. Certifique-se de entender as implicações dessas restrições. Para obter detalhes, consulte Grupos de segurança de rede.",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
- "service": "Azure Application Gateway",
- "text": "Cumprir todas as restrições de NSG para Gateway de Aplicativo",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "O uso de UDR (Rotas Definidas pelo Usuário) na sub-rede do Gateway de Aplicativo pode causar alguns problemas. O estado de integridade no back-end pode ser desconhecido. Os logs e métricas do Gateway de Aplicativo podem não ser gerados. Recomendamos que você não use UDRs na sub-rede do Gateway de Aplicativo para que possa exibir a integridade, os logs e as métricas de back-end. Se suas organizações precisarem usar a UDR na sub-rede do Gateway de Aplicativo, examine os cenários com suporte. Para obter mais informações, consulte Rotas definidas pelo usuário com suporte.",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
- "service": "Azure Application Gateway",
- "text": "Abster-se de usar UDRs na sub-rede do gateway de aplicativo",
- "type": "recommendation",
- "waf": "Segurança"
- },
- {
- "description": "Quando o WAF está habilitado, cada solicitação deve ser armazenada em buffer pelo Gateway de Aplicativo até que chegue totalmente, verifica se a solicitação corresponde a qualquer violação de regra em seu conjunto de regras principal e, em seguida, encaminha o pacote para as instâncias de back-end. Quando há uploads de arquivos grandes (30 MB+ de tamanho), isso pode resultar em uma latência significativa. Como os requisitos de capacidade do Gateway de Aplicativo são diferentes com o WAF, não recomendamos habilitar o WAF no Gateway de Aplicativo sem teste e validação adequados.",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
- "service": "Azure Application Gateway",
- "text": "Esteja ciente das alterações de capacidade do Gateway de Aplicativo ao habilitar o WAF",
+ "text": "Cumpra todas as restrições de NSG para Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Segurança"
},
{
"description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "Azure Application Gateway",
- "text": "Familiarize-se com os preços do Gateway de Aplicativo",
+ "text": "Familiarize-se com os preços do Gateway de Aplicativo e do WAF. Escolha opções de tamanho adequado para atender à sua demanda de capacidade de carga de trabalho e fornecer o desempenho esperado sem desperdiçar recursos. Para estimar os custos, use a calculadora de preços.",
"type": "checklist",
"waf": "custar"
},
{
"description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "Azure Application Gateway",
- "text": "Revise recursos subutilizados",
+ "text": "Remova instâncias não utilizadas do Gateway de Aplicativo e otimize instâncias subutilizadas. Para evitar custos desnecessários, identifique e exclua instâncias do Gateway de Aplicativo que têm pools de back-end vazios. Pare as instâncias do Gateway de Aplicativo quando elas não estiverem em uso.",
"type": "checklist",
"waf": "custar"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "Azure Application Gateway",
- "text": "Interromper instâncias do Gateway de Aplicativo que não estão em uso",
+ "text": "Otimize o custo de dimensionamento da instância do Gateway de Aplicativo. Para otimizar sua estratégia de dimensionamento e reduzir as demandas do wokload, consulte Recomendações para otimizar o custo de dimensionamento.",
"type": "checklist",
"waf": "custar"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "Azure Application Gateway",
- "text": "Ter uma política de redução e expansão",
+ "text": "Monitore as métricas de consumo do Gateway de Aplicativo e entenda seu impacto no custo. O Azure cobra por instâncias medidas do Gateway de Aplicativo com base em métricas rastreadas. Avalie as várias métricas e unidades de capacidade e determine os direcionadores de custo. Para obter mais informações, consulte Gerenciamento de Custos da Microsoft.",
"type": "checklist",
"waf": "custar"
},
{
- "description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "Uma instância do Gateway de Aplicativo interrompida não incorre em custos. As instâncias do Gateway de Aplicativo que são executadas continuamente podem incorrer em custos desnecessários. Avalie os padrões de uso e interrompa instâncias quando você não precisar deles. Por exemplo, espere baixo uso após o horário comercial em ambientes de desenvolvimento/teste.",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "Azure Application Gateway",
- "text": "Analise as métricas de consumo em diferentes parâmetros",
- "type": "checklist",
- "waf": "custar"
- },
- {
- "description": "Para obter informações sobre os preços do Gateway de Aplicativo, consulte Noções básicas sobre preços do Gateway de Aplicativo do Azure e do Firewall de Aplicativo Web. Você também pode aproveitar a calculadora de preços. Certifique-se de que as opções sejam dimensionadas adequadamente para atender à demanda de capacidade e fornecer o desempenho esperado sem desperdiçar recursos.",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "Familiarize-se com os preços do Gateway de Aplicativo",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Identifique e exclua instâncias do Gateway de Aplicativo com pools de back-end vazios para evitar custos desnecessários.",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "Azure Application Gateway",
- "text": "Revise recursos subutilizados",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Você não é cobrado quando o Gateway de Aplicativo está no estado parado. A execução contínua de instâncias do Gateway de Aplicativo pode incorrer em custos irrelevantes. Avalie os padrões de uso e interrompa instâncias quando você não precisar deles. Por exemplo, espera-se que o uso após o horário comercial em ambientes de desenvolvimento/teste seja baixo. Consulte estes artigos para obter informações sobre como interromper e iniciar instâncias.- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "Azure Application Gateway",
- "text": "Interromper instâncias do Gateway de Aplicativo quando não estiverem em uso",
- "type": "recommendation",
- "waf": "Custar"
- },
- {
- "description": "Uma política de expansão garante que haverá instâncias suficientes para lidar com o tráfego de entrada e picos. Além disso, tenha uma política de redução de escala que garanta que o número de instâncias seja reduzido quando a demanda cair. Considere a escolha do tamanho da instância. O tamanho pode afetar significativamente o custo. Algumas considerações são descritas em Estimar a contagem de instâncias do Gateway de Aplicativo. Para obter mais informações, consulte O que é o Gateway de Aplicativo do Azure v2?",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
- "service": "Azure Application Gateway",
- "text": "Ter uma política de redução e expansão",
+ "text": "Pare as instâncias do Gateway de Aplicativo quando elas não estiverem em uso. Para obter mais informações, consulte Stop-AzApplicationGateway e Start-AzApplicationGateway.",
"type": "recommendation",
"waf": "Custar"
},
{
- "description": "Você é cobrado com base em instâncias limitadas do Gateway de Aplicativo com base nas métricas rastreadas pelo Azure. Avalie as várias métricas e unidades de capacidade e determine os direcionadores de custo. Para obter mais informações, consulte Gerenciamento de Custos e Cobrança da Microsoft. As métricas a seguir são fundamentais para o Gateway de Aplicativo. Essas informações podem ser usadas para validar se a contagem de instâncias provisionadas corresponde à quantidade de tráfego de entrada.- Unidades de Capacidade Faturada Estimada- Unidades de Capacidade Faturáveis Fixas- Unidades de Capacidade AtuaisPara obter mais informações, consulte Métricas do Gateway de Aplicativo. Certifique-se de contabilizar os custos de largura de banda.",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "Use essas métricas para validar se a contagem de instâncias provisionadas corresponde à quantidade de tráfego de entrada e certifique-se de utilizar totalmente os recursos alocados.",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "Azure Application Gateway",
- "text": "Analise as métricas de consumo em diferentes parâmetros",
+ "text": "Monitore as principais métricas do Gateway de Aplicativo do direcionador de custo, como: - Unidades de capacidade faturadas estimadas. - Unidades fixas de capacidade faturável. - Unidades de capacidade atual. Certifique-se de contabilizar os custos de largura de banda.",
"type": "recommendation",
"waf": "Custar"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "Monitorar métricas de capacidade",
- "type": "checklist",
- "waf": "Operações"
- },
- {
- "description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "Azure Application Gateway",
- "text": "Habilitar o diagnóstico no Gateway de Aplicativo e no WAF (Firewall de Aplicativo Web)",
+ "text": "Habilite o diagnóstico no Gateway de Aplicativo e no WAF. Colete logs e métricas para que você possa monitorar a integridade da carga de trabalho, identificar tendências no desempenho e na confiabilidade da carga de trabalho e solucionar problemas. Para projetar sua abordagem geral de monitoramento, consulte Recomendações para projetar e criar um sistema de monitoramento.",
"type": "checklist",
"waf": "Operações"
},
{
"description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "Azure Application Gateway",
- "text": "Usar o Azure Monitor Network Insights",
+ "text": "Use o Azure Monitor Network Insights para obter uma visão abrangente da integridade e das métricas dos recursos de rede, incluindo o Gateway de Aplicativo. Use o monitoramento centralizado para identificar e resolver problemas rapidamente, otimizar o desempenho e garantir a confiabilidade de seus aplicativos.",
"type": "checklist",
"waf": "Operações"
},
{
"description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "Azure Application Gateway",
- "text": "Corresponder as configurações de tempo limite com o aplicativo de back-end",
+ "text": "Monitore as recomendações do Gateway de Aplicativo no Assistente do Azure. Configure alertas para notificar sua equipe quando você tiver recomendações novas e críticas para sua instância do Gateway de Aplicativo. O Advisor gera recomendações com base em propriedades, como categoria, nível de impacto e tipo de recomendação.",
"type": "checklist",
"waf": "Operações"
},
{
- "description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
- "service": "Azure Application Gateway",
- "text": "Monitorar problemas de configuração do Key Vault usando o Assistente do Azure",
- "type": "checklist",
- "waf": "Operações"
- },
- {
- "description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
+ "description": "Defina alertas quando as métricas ultrapassarem os limites para que você saiba quando seu uso aumenta. Essa abordagem garante que você tenha tempo suficiente para implementar as alterações necessárias em sua carga de trabalho e evita degradação ou interrupções.",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "Azure Application Gateway",
- "text": "Configurar e monitorar as limitações da porta SNAT",
- "type": "checklist",
- "waf": "Operações"
- },
- {
- "description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
- "service": "Azure Application Gateway",
- "text": "Considere as limitações da porta SNAT em seu design",
- "type": "checklist",
- "waf": "Operações"
- },
- {
- "description": "Use essas métricas como indicadores de utilização da capacidade provisionada do Gateway de Aplicativo. É altamente recomendável configurar alertas sobre a capacidade. Para obter detalhes, consulte Suporte de alto tráfego do Gateway de Aplicativo.",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "Monitorar métricas de capacidade",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "Há outras métricas que podem indicar problemas no Gateway de Aplicativo ou no back-end. Recomendamos avaliar os seguintes alertas:- Contagem de Hosts Não Íntegros- Status da Resposta (dimensão 4xx e 5xx)- Status da Resposta de Back-end (dimensão 4xx e 5xx)- Tempo de Resposta do Último Byte de Back-end- Tempo Total do Gateway de AplicativoPara obter mais informações, consulte Métricas do Gateway de Aplicativo.",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "Azure Application Gateway",
- "text": "Solucionar problemas usando métricas",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "Os logs de diagnóstico permitem que você exiba logs de firewall, logs de desempenho e logs de acesso. Use esses logs para gerenciar e solucionar problemas com instâncias do Gateway de Aplicativo. Para obter mais informações, consulte Logs de diagnóstico e integridade de back-end para o Gateway de Aplicativo.",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
- "service": "Azure Application Gateway",
- "text": "Habilitar o diagnóstico no Gateway de Aplicativo e no WAF (Firewall de Aplicativo Web)",
- "type": "recommendation",
- "waf": "Operações"
- },
- {
- "description": "O Azure Monitor Network Insights fornece uma visão abrangente da integridade e das métricas para recursos de rede, incluindo o Gateway de Aplicativo. Para obter detalhes adicionais e recursos com suporte para o Gateway de Aplicativo, consulte Insights de rede do Azure Monitor.",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
- "service": "Azure Application Gateway",
- "text": "Usar o Azure Monitor Network Insights",
+ "text": "Configure alertas para notificar sua equipe quando as métricas de capacidade, como uso da CPU e uso da unidade de computação, ultrapassarem os limites recomendados. Para configurar um conjunto abrangente de alertas com base em métricas de capacidade, consulte Suporte de alto tráfego do Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "Verifique se você configurou as configurações de IdleTimeout para corresponder às características do ouvinte e do tráfego do aplicativo de back-end. O valor padrão é definido como quatro minutos e pode ser configurado para um máximo de 30. Para obter mais informações, consulte Redefinição de TCP do Balanceador de Carga e Tempo Limite Ocioso.Para considerações sobre carga de trabalho, consulte Monitorando a integridade do aplicativo para confiabilidade.",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "Use alertas para ajudar a garantir que sua equipe possa responder aos problemas em tempo hábil e facilitar a solução de problemas.",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "Azure Application Gateway",
- "text": "Corresponder as configurações de tempo limite com o aplicativo de back-end",
+ "text": "Configure alertas para notificar sua equipe sobre métricas que indicam problemas no Gateway de Aplicativo ou no back-end. Recomendamos que você avalie os seguintes alertas:- Contagem de hosts não íntegros- Status de resposta, como erros 4xx e 5xx - Status de resposta de back-end, como erros 4xx e 5xx - Tempo de resposta do último byte de back-end- Tempo total do Gateway de AplicativoPara obter mais informações, consulte Métricas para o Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "O Gateway de Aplicativo verifica a versão renovada do certificado no Key Vault vinculado a cada intervalo de 4 horas. Se ele estiver inacessível devido a qualquer configuração incorreta do Key Vault, ele registrará esse erro e enviará uma recomendação do Assistente correspondente. Você deve configurar os alertas do Advisor para se manter atualizado e corrigir esses problemas imediatamente para evitar problemas relacionados ao plano de controle ou de dados. Para obter mais informações, consulte Investigando e resolvendo erros do cofre de chaves. Para definir um alerta para esse caso específico, use o Tipo de Recomendação como Resolver problema do Azure Key Vault para o Gateway de Aplicativo.",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
+ "description": "Use logs para ajudar a detectar, investigar e solucionar problemas com instâncias do Gateway de Aplicativo e sua carga de trabalho.",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "Azure Application Gateway",
- "text": "Monitorar problemas de configuração do Key Vault usando o Assistente do Azure",
+ "text": "Habilite logs de diagnóstico no Gateway de Aplicativo e no WAF para coletar logs de firewall, logs de desempenho e logs de acesso.",
"type": "recommendation",
"waf": "Operações"
},
{
- "description": "As limitações de porta SNAT são importantes para conexões de back-end no Gateway de Aplicativo. Há fatores separados que afetam como o Gateway de Aplicativo atinge o limite de porta SNAT. Por exemplo, se o back-end for um endereço IP público, ele exigirá sua própria porta SNAT. Para evitar limitações de porta SNAT, você pode aumentar o número de instâncias por Gateway de Aplicativo, escalar horizontalmente os back-ends para ter mais endereços IP ou mover seus back-ends para a mesma rede virtual e usar endereços IP privados para os back-ends. As solicitações por segundo (RPS) no Gateway de Aplicativo serão afetadas se o limite de porta SNAT for atingido. Por exemplo, se um Gateway de Aplicativo atingir o limite de porta SNAT, ele não poderá abrir uma nova conexão com o back-end e a solicitação falhará.",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "Use os alertas do Assistente para se manter atualizado e corrigir problemas imediatamente. Evite problemas relacionados ao plano de controle ou ao plano de dados. O Gateway de Aplicativo verifica a versão renovada do certificado na instância vinculada do Key Vault a cada 4 horas. Se a versão do certificado estiver inacessível devido a uma configuração incorreta do Key Vault, ele registrará esse erro e enviará uma recomendação do Assistente correspondente.",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "Azure Application Gateway",
- "text": "Considere as limitações da porta SNAT em seu design",
+ "text": "Use o Assistente para monitorar problemas de configuração do Key Vault. Defina um alerta para notificar sua equipe quando você receber a recomendação que declara Resolver problema do Azure Key Vault para o Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Operações"
},
{
"description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
- "service": "Azure Application Gateway",
- "text": "Estimar a contagem de instâncias do Gateway de Aplicativo",
- "type": "checklist",
- "waf": "desempenho"
- },
- {
- "description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "Definir a contagem máxima de instâncias",
- "type": "checklist",
- "waf": "desempenho"
- },
- {
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "Definir a contagem mínima de instâncias",
- "type": "checklist",
- "waf": "desempenho"
- },
- {
- "description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "Azure Application Gateway",
- "text": "Definir o tamanho da sub-rede do Gateway de Aplicativo",
+ "text": "Estime os requisitos de capacidade do Gateway de Aplicativo para dar suporte aos requisitos de carga de trabalho. Aproveite a funcionalidade de dimensionamento automático no Gateway de Aplicativo v2. Defina valores apropriados para o número mínimo e máximo de instâncias. Dimensione adequadamente a sub-rede dedicada que o Gateway de Aplicativo exige. Para obter mais informações, consulte Recomendações para planejamento de capacidade.",
"type": "checklist",
"waf": "desempenho"
},
{
"description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "Azure Application Gateway",
- "text": "Aproveite os recursos do Gateway de Aplicativo V2 para obter benefícios de dimensionamento automático e desempenho",
+ "text": "Aproveite os recursos para dimensionamento automático e benefícios de desempenho. O SKU v2 oferece dimensionamento automático, que escala verticalmente o Gateway de Aplicativo à medida que o tráfego aumenta. Em comparação com o SKU v1, o SKU v2 tem recursos que aprimoram o desempenho da carga de trabalho. Por exemplo, o SKU v2 tem melhor desempenho de descarregamento de TLS, tempos de implantação e atualização mais rápidos e suporte a redundância de zona. Para obter mais informações, consulte Dimensionar o Gateway de Aplicativo v2 e o WAF v2.",
"type": "checklist",
"waf": "desempenho"
},
{
- "description": "Para o SKU do Gateway de Aplicativo v2, o dimensionamento automático leva algum tempo (aproximadamente seis a sete minutos) antes que o conjunto adicional de instâncias esteja pronto para atender ao tráfego. Durante esse tempo, se houver picos curtos no tráfego, espere latência transitória ou perda de tráfego. Recomendamos que você defina sua contagem mínima de instâncias para um nível ideal. Depois de estimar a contagem média de instâncias e determinar as tendências de dimensionamento automático do Gateway de Aplicativo, defina a contagem mínima de instâncias com base nos padrões de aplicativo. Para obter informações, consulte Suporte de alto tráfego do Gateway de Aplicativo. Verifique as Unidades de Computação Atuais do último mês. Essa métrica representa a utilização da CPU do gateway. Para definir a contagem mínima de instâncias, divida o pico de uso por 10. Por exemplo, se a média de Unidades de Computação Atuais no mês passado for 50, defina a contagem mínima de instâncias como cinco.",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "Definir a contagem mínima de instâncias",
- "type": "recommendation",
- "waf": "Desempenho"
- },
- {
- "description": "Recomendamos 125 como a contagem máxima de instâncias de dimensionamento automático. Verifique se a sub-rede que tem o Gateway de Aplicativo tem endereços IP disponíveis suficientes para dar suporte ao conjunto de instâncias de expansão. Definir a contagem máxima de instâncias como 125 não tem implicações de custo porque você é cobrado apenas pela capacidade consumida.",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
+ "description": "Para o Gateway de Aplicativo v2, o dimensionamento automático leva aproximadamente seis a sete minutos antes que o conjunto extra de instâncias esteja pronto para atender ao tráfego. Durante esse tempo, se o Gateway de Aplicativo tiver picos curtos no tráfego, espere latência transitória ou perda de tráfego.",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "Azure Application Gateway",
- "text": "Definir a contagem máxima de instâncias",
+ "text": "Defina a contagem mínima de instâncias para um nível ideal com base na contagem de instâncias estimada, nas tendências reais de dimensionamento automático do Gateway de Aplicativo e nos padrões de aplicativo. Verifique as unidades de computação atuais do mês passado. Essa métrica representa o uso da CPU do gateway. Para definir a contagem mínima de instâncias, divida o pico de uso por 10. Por exemplo, se a média atual de unidades de computação no último mês for 50, defina a contagem mínima de instâncias como cinco.",
"type": "recommendation",
"waf": "Desempenho"
},
{
- "description": "O Gateway de Aplicativo precisa de uma sub-rede dedicada em uma rede virtual. A sub-rede pode ter várias instâncias do recurso de Gateway de Aplicativo implantado. Você também pode implantar outros recursos do Gateway de Aplicativo nessa sub-rede, SKU v1 ou v2. Aqui estão algumas considerações para definir o tamanho da sub-rede:- O Gateway de Aplicativo usa um endereço IP privado por instância e outro endereço IP privado se um IP de front-end privado estiver configurado.- O Azure reserva cinco endereços IP em cada sub-rede para uso interno.- O Gateway de Aplicativo (SKU Standard ou WAF) pode dar suporte a até 32 instâncias. Usando 32 endereços IP de instância + 1 IP de front-end privado + 5 Azure reservados, é recomendável um tamanho mínimo de sub-rede de /26. Como o SKU Standard_v2 ou WAF_v2 pode dar suporte a até 125 instâncias, usando o mesmo cálculo, é recomendável um tamanho de sub-rede de /24.- Se você quiser implantar recursos adicionais do Gateway de Aplicativo na mesma sub-rede, considere os endereços IP adicionais que serão necessários para a contagem máxima de instâncias para Standard e Standard v2.",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "O Gateway de Aplicativo pode escalar horizontalmente conforme necessário para lidar com o aumento do tráfego para seus aplicativos. Essa configuração não aumenta o custo porque você paga apenas pela capacidade consumida.",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "Azure Application Gateway",
- "text": "Definir o tamanho da sub-rede do Gateway de Aplicativo",
+ "text": "Defina a contagem máxima de instâncias de dimensionamento automático como o máximo possível, que é de 125 instâncias. Verifique se a sub-rede dedicada do Gateway de Aplicativo tem endereços IP disponíveis suficientes para dar suporte ao conjunto aumentado de instâncias.",
"type": "recommendation",
"waf": "Desempenho"
},
{
- "description": "O SKU v2 oferece dimensionamento automático para garantir que o Gateway de Aplicativo possa escalar verticalmente à medida que o tráfego aumenta. Quando comparada ao SKU v1, a v2 tem recursos que aprimoram o desempenho da carga de trabalho. Por exemplo, melhor desempenho de descarregamento de TLS, tempos de implantação e atualização mais rápidos, redundância de zona e muito mais. Para obter mais informações sobre recursos de dimensionamento automático, consulte Dimensionando o Gateway de Aplicativo v2 e o WAF v2. Se você estiver executando o SKU v1 Gateway de aplicativo, considere migrar para o SKU do gateway de aplicativo v2. Para obter mais informações, consulte Migrar o Gateway de Aplicativo do Azure e o Firewall de Aplicativo Web da v1 para a v2.",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
+ "description": "Use uma sub-rede /24 para fornecer suporte a todos os endereços IP necessários para a implantação do Gateway de Aplicativo v2. O Gateway de Aplicativo usará um endereço IP privado para cada instância e outro endereço IP privado se você configurar um IP de front-end privado. O SKU Standard_v2 ou WAF_v2 pode dar suporte a até 125 instâncias. O Azure reserva cinco endereços IP em cada sub-rede para uso interno.",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "Azure Application Gateway",
- "text": "Aproveite os recursos para dimensionamento automático e benefícios de desempenho",
+ "text": "Dimensione adequadamente a sub-rede dedicada do Gateway de Aplicativo. É altamente recomendável uma sub-rede /24 para uma implantação do Gateway de Aplicativo v2. Se você quiser implantar outros recursos do Gateway de Aplicativo na mesma sub-rede, considere os endereços IP extras necessários para a contagem máxima de instâncias. Para obter mais considerações sobre como dimensionar a sub-rede, consulte Configuração de infraestrutura do Gateway de Aplicativo.",
"type": "recommendation",
"waf": "Desempenho"
},
@@ -5326,7 +5174,7 @@
"metadata": {
"name": "WAF Service Guides",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -5353,31 +5201,31 @@
],
"waf": [
{
- "name": "Desempenho"
+ "name": "fiabilidade"
},
{
- "name": "segurança"
+ "name": "Custar"
},
{
- "name": "desempenho"
+ "name": "Operações"
},
{
- "name": "Custar"
+ "name": "segurança"
},
{
- "name": "Fiabilidade"
+ "name": "Desempenho"
},
{
- "name": "Operações"
+ "name": "Fiabilidade"
},
{
"name": "Operações"
},
{
- "name": "fiabilidade"
+ "name": "Segurança"
},
{
- "name": "Segurança"
+ "name": "desempenho"
},
{
"name": "custar"
diff --git a/checklists-ext/wafsg_checklist.zh-Hant.json b/checklists-ext/wafsg_checklist.zh-Hant.json
index 0e8cd9dd5..c37b92a79 100644
--- a/checklists-ext/wafsg_checklist.zh-Hant.json
+++ b/checklists-ext/wafsg_checklist.zh-Hant.json
@@ -296,7 +296,7 @@
"service": "App Service Web Apps",
"text": "定期檢查與數據相關的成本：延長數據保留期或昂貴的存儲層可能會導致高存儲成本。由於頻寬使用和日誌記錄數據的長期保留，可能會累積更多的費用。",
"type": "checklist",
- "waf": null
+ "waf": "成本"
},
{
"description": "",
@@ -310,7 +310,7 @@
"description": "與更高級別相比，免費和基本級別對預算友好。它們為不需要高級計劃的全部功能和性能的非生產環境提供了經濟高效的解決方案。",
"guid": "df7294a6-460e-4d50-b4a9-66141caada1d",
"service": "App Service Web Apps",
- "text": null,
+ "text": "（應用服務計劃）對於較低的環境，請選擇Free （免費） 或 Basic （基本） 套餐。我們建議將這些層級用於實驗性用途。當您不再需要這些層時，請將其刪除。",
"type": "recommendation",
"waf": "成本"
},
@@ -476,489 +476,337 @@
},
{
"description": "",
- "guid": "ee4fab35-3fcf-469c-aa4a-baaa7ea46a76",
+ "guid": "12b36c73-1ef0-428b-89b2-2b3db9077b88",
"service": "Azure Application Gateway",
- "text": "在區域感知配置中部署實例（如果可用）。",
+ "text": "在新部署中使用應用程式閘道 v2，除非工作負載特別需要應用程式閘道 v1。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "897c9b7a-c56c-4390-9938-71ed0ee875d8",
+ "guid": "f4a44a99-6a02-46f3-851a-5579949b9dee",
"service": "Azure Application Gateway",
- "text": "在虛擬網路中將應用程式閘道與 Web 應用程式防火牆 （WAF） 結合使用，以保護來自 Internet 的入站“HTTP/S”流量。",
+ "text": "在您的設計中構建冗餘。將應用程式閘道實例分佈在可用區中，以提高容錯能力並構建冗餘。如果一個區域發生故障，流量將流向其他區域。有關更多資訊，請參閱使用可用區和區域的建議。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "9d1d0113-dcc3-4309-bf89-57f43eff537c",
+ "guid": "54a59adf-6a9e-4068-9276-ced14131275e",
"service": "Azure Application Gateway",
- "text": "在新部署中，請使用 Azure 應用程式閘道 v2，除非有令人信服的理由使用 Azure 應用程式閘道 v1。",
+ "text": "在存取應用程式閘道或進行進一步更改之前，請為規則更新和其他配置更改計劃額外的時間。例如，您可能需要額外的時間才能從後端池中刪除伺服器，因為它們必須耗盡現有連接。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "guid": "fbc1a333-d306-4d1e-8796-17e2df93b21d",
"service": "Azure Application Gateway",
- "text": "規劃規則更新",
+ "text": "實施運行狀況終端節點監控模式。您的應用程式應公開運行狀況終端節點，這些終端節點聚合了應用程式為請求提供服務所需的關鍵服務和依賴項的狀態。應用程式閘道運行狀況探測使用終結點來檢測後端池中伺服器的運行狀況。有關更多資訊，請參閱運行狀況終端節點監控模式。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "guid": "a13fb2ce-1102-4f48-a841-41bb97cdecd8",
"service": "Azure Application Gateway",
- "text": "使用運行狀況探測檢測後端不可用",
+ "text": "評估間隔和閾值設置對運行狀況探測的影響。運行狀況探測以設定的時間間隔向配置的終端節點發送請求。後端在被標記為運行狀況不佳之前可以容忍有限數量的失敗請求。這些設置可能會發生衝突，這需要權衡。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "guid": "831469ab-6e35-4740-a283-1ac886bd1836",
"service": "Azure Application Gateway",
- "text": "查看間隔和閾值設置對運行狀況探測的影響",
+ "text": "通過運行狀況終端節點驗證下游依賴項。為了隔離故障，您的每個後端可能都有自己的依賴項。例如，託管在應用程式閘道後面的應用程式可能有多個後端，每個後端連接到不同的資料庫或副本。當此類依賴項失敗時，應用程式可能會正常工作，但不會返回有效結果。因此，理想情況下，運行狀況終結點應驗證所有依賴項。",
"type": "checklist",
"waf": "可靠性"
},
{
"description": "",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "guid": "b4a35881-6e26-4b8c-b870-fc00da6799eb",
"service": "Azure Application Gateway",
- "text": "通過運行狀況終端節點驗證下游依賴項",
+ "text": "考慮可能影響可靠性的應用程式閘道限制和已知問題。查看應用程式閘道常見問題解答，瞭解有關按設計行為、正在構建的修復、平臺限制以及可能的解決方法或緩解策略的重要資訊。不要在應用程式閘道專用子網中使用UDR。",
"type": "checklist",
"waf": "可靠性"
},
{
- "description": "在存取應用程式閘道或進行進一步更改之前，請計劃足夠的更新時間。例如，從後端池中刪除伺服器可能需要一些時間，因為它們必須耗盡現有連接。",
- "guid": "f6991e25-5c9d-4b36-9df6-d4cd17d6d7cc",
+ "description": "",
+ "guid": "aacf5d13-97a8-4b22-b3b3-e9920e26cc8a",
"service": "Azure Application Gateway",
- "text": "規劃規則更新",
- "type": "recommendation",
+ "text": "在設計中考慮源網路位址轉換 （SNAT） 埠限制，這些限制可能會影響應用程式閘道上的後端連接。某些因素會影響應用程式閘道達到 SNAT 埠限制的方式。例如，如果後端是公有IP位址，則需要自己的SNAT埠。要避免 SNAT 連接埠限制，您可以執行以下選項之一：",
+ "type": "checklist",
"waf": "可靠性"
},
{
- "description": "如果使用應用程式閘道對多個後端實例上的傳入流量進行負載均衡，我們建議使用運行狀況探測。這將確保流量不會路由到無法處理流量的後端。",
- "guid": "93d5c5fc-95da-40dc-a935-bcdf72bb49bc",
+ "description": "當您將多個實例分佈在多個區域中時，您的工作負載可以承受單個區域中的故障。如果您有不可用的可用區，流量會自動轉移到其他可用區中的運行狀況良好的實例，從而保持應用程式的可靠性。",
+ "guid": "d4a3a0ad-1d2b-4173-ac4c-44acb08fa368",
"service": "Azure Application Gateway",
- "text": "使用運行狀況探測檢測後端不可用",
+ "text": "在區域感知配置中部署應用程式閘道實例。 檢查區域冗餘的區域支援，因為並非所有區域都提供此功能。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "運行狀況探測以設定的時間間隔向配置的終端節點發送請求。此外，在後端標記為運行狀況不佳之前，將容忍一個失敗請求的閾值。這些數位表示權衡。- 設置較高的間隔會給您的服務帶來更高的負載。每個應用程式閘道實例都會發送自己的運行狀況探測，因此每30秒100個實例意味著每30秒100個請求。- 設置較低的間隔會留出更多時間，然後才能檢測到中斷。- 設置較低的不正常閾值可能意味著短暫的暫時性故障可能會使後端癱瘓。- 設置較高的閾值，可能需要更長的時間才能使後端退出輪換。",
- "guid": "e4a0745d-0b8a-459b-8fc0-0399061a6425",
+ "description": "運行狀況探測可確保流量僅路由到可以處理流量的後端。應用程式閘道會監視其後端池中所有伺服器的運行狀況，並自動停止向它認為運行狀況不佳的任何伺服器發送流量。",
+ "guid": "13ba88d2-e858-44f3-9747-f11a4c3615fd",
"service": "Azure Application Gateway",
- "text": "查看間隔和閾值設置對運行狀況探測的影響",
+ "text": "使用應用程式閘道運行狀況探測來檢測後端不可用。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "假設每個後端都有自己的依賴項，以確保隔離故障。例如，託管在應用程式閘道後面的應用程式可能有多個後端，每個後端都連接到不同的資料庫（副本）。當此類依賴項失敗時，應用程式可能正在運行，但不會返回有效結果。因此，理想情況下，運行狀況終結點應驗證所有依賴項。請記住，如果對運行狀況終端節點的每次調用都有直接依賴項調用，則該資料庫將每 30 秒收到 100 個查詢，而不是 1 個查詢。為避免這種情況，運行狀況終端節點應將依賴項的狀態緩存一小段時間。",
- "guid": "4d7b12c2-d9bb-4547-8238-c2c93491afed",
+ "description": "使用速率限制來避免重試風暴等問題。",
+ "guid": "0ace6ede-d8a6-4c71-bd0b-feba5fdb57ef",
"service": "Azure Application Gateway",
- "text": "通過運行狀況終端節點驗證下游依賴項",
+ "text": "為 Azure WAF 配置速率限制規則，以便客戶端無法向應用程式發送過多流量。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "某些方案可能會強制你專門在Application Gateway上實施規則。例如，如果需要ModSec CRS 2.2.9、CRS 3.0或 CRS 3.1 規則，則這些規則只能在應用程式閘道上實施。相反，速率限制和異地篩選僅在 Azure Front Door 上可用，在 AppGateway 上不可用。",
- "guid": "2cc68719-238d-40f1-9eda-37a4b77cabc2",
+ "description": "應用程式閘道子網上的 UDR 可能會導致一些問題。不要在應用程式閘道子網上使用 UDR，以便可以查看後端運行狀況、日誌和指標。",
+ "guid": "7fafa967-ba5d-4de5-8446-14c154e20b39",
"service": "Azure Application Gateway",
- "text": "使用 Azure Front Door 和應用程式閘道保護 HTTP/S“應用程式時，請在 Front Door 中使用 WAF 策略並鎖定應用程式閘道以僅接收來自 Azure Front Door 的流量。",
+ "text": "不要在應用程式閘道上使用 UDR，以便後端運行狀況報告正常運行並生成正確的日誌和指標。 如果必須在應用程式閘道子網中使用 UDR，請參閱支援的 UDR。",
"type": "recommendation",
"waf": "可靠性"
},
{
- "description": "",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
+ "description": "設置IdleTimeout以匹配後端。此設置可確保在後端回應請求的時間超過 4 分鐘時，應用程式閘道與客戶端之間的連接保持打開狀態。如果您未配置此設置，則連接將關閉，並且用戶端看不到後端回應。",
+ "guid": "e7750d05-2f4c-4dfa-b330-001d53221295",
"service": "Azure Application Gateway",
- "text": "設置 TLS 策略以增強安全性",
- "type": "checklist",
- "waf": "安全"
+ "text": "配置 IdleTimeout 設定以匹配後端應用程式的偵聽器和流量特徵。預設值為 4 分鐘。您可以將其配置為最長 30 分鐘。 有關更多資訊，請參閱負載均衡器傳輸控制協定 （TCP） 重置和空閒超時。",
+ "type": "recommendation",
+ "waf": "可靠性"
},
{
"description": "",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
+ "guid": "29e7a329-70b0-4458-8980-08810eeb5e8c",
"service": "Azure Application Gateway",
- "text": "使用 AppGateway 終止 TLS",
+ "text": "查看應用程式閘道的安全基線。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
+ "guid": "06e72d1f-194b-4f65-805a-fd78eb15deb1",
"service": "Azure Application Gateway",
- "text": "使用 Azure Key Vault 儲存 TLS 證書",
+ "text": "在邊緣阻止常見威脅。WAF 與 Application Gateway 集成。在前端啟用 WAF 規則，以保護應用程式免受靠近攻擊源的網路邊緣的常見漏洞和漏洞的影響。有關詳細資訊，請參閱應用程式閘道上的 WAF。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
+ "guid": "e92b04dd-c98e-4f4e-bdd5-903fd4e50098",
"service": "Azure Application Gateway",
- "text": "重新加密後端流量時，請確保後端伺服器證書同時包含根證書頒發機構 （CA） 和中間證書頒發機構 （CA）",
+ "text": "僅允許對control plane的授權訪問。使用應用程式閘道基於角色的訪問控制 （RBAC） 將訪問許可權限限為僅需要它的標識。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "guid": "616bcb27-4b69-4b6d-be33-c97788d267d9",
"service": "Azure Application Gateway",
- "text": "對後端池資源使用適當的 DNS 伺服器",
+ "text": "保護傳輸中的數據。啟用端到端傳輸層安全性 （TLS）、TLS 終止和端到端 TLS 加密。重新加密後端流量時，請確保後端伺服器證書同時包含根證書頒發機構和中間證書頒發機構 （CA）。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "guid": "dfb1da6c-7250-47eb-9780-6d3661bce1ed",
"service": "Azure Application Gateway",
- "text": "遵守應用程式閘道的所有 NSG 限制",
+ "text": "保護應用程式金鑰。使用 Azure Key Vault 儲存 TLS 證書，以提高安全性並簡化證書續訂和輪換過程。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "5ff5e810-ac1d-42ef-9a30-812c15c42be8",
+ "guid": "0dbdce8a-165e-48ad-a562-5d7d4fd259e5",
"service": "Azure Application Gateway",
- "text": "避免在應用程式閘道子網上使用UDR",
+ "text": "減少攻擊面並強化配置。刪除不需要的預設配置，並強化應用程式閘道配置以加強安全控制。遵守應用程式閘道的所有網路安全組 （NSG） 限制。",
"type": "checklist",
"waf": "安全"
},
{
"description": "",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "guid": "b6d22f85-e9d4-4a82-83cb-78e0bbe1c3da",
"service": "Azure Application Gateway",
- "text": "啟用 WAF 時請注意應用程式閘道容量的變化",
+ "text": "監控異常活動。定期查看日誌以檢查攻擊和誤報。將 WAF 日誌從應用程式閘道發送到組織的集中式安全資訊和事件管理 （SIEM），例如 Microsoft Sentinel，以檢測威脅模式並將預防措施納入工作負載設計中。",
"type": "checklist",
"waf": "安全"
},
{
- "description": "設置 TLS 策略以提高安全性。確保您始終使用可用的最新 TLS 策略版本。這將強制使用 TLS 1.2 和更強的密碼。",
- "guid": "c394ed0c-ddb2-4efa-b4eb-deb2f11cff32",
- "service": "Azure Application Gateway",
- "text": "設置 TLS 策略以增強安全性",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "使用應用程式閘道進行 TLS 終止有以下優點：- 性能提高，因為請求發送到不同的後端必須重新進行身份驗證。- 更好地利用後端伺服器，因為它們不必執行 TLS 處理- 通過訪問請求內容實現智慧路由- 證書管理更輕鬆，因為證書只需要安裝在應用程式閘道上。",
- "guid": "f2c0a397-56bb-45f1-ac4d-b1837045db05",
- "service": "Azure Application Gateway",
- "text": "使用 AppGateway 終止 TLS",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "應用程式閘道可以與 Key Vault 整合。這提供了更強的安全性、更輕鬆的角色和職責分離、對託管證書的支援以及更輕鬆的證書續訂和輪換過程。",
- "guid": "db6594c5-00d9-42e3-9190-0da310bd8af5",
- "service": "Azure Application Gateway",
- "text": "使用 Azure Key Vault 儲存 TLS 證書",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "後端伺服器的 TLS 證書必須由知名 CA 頒發。如果證書不是由受信任的 CA 頒發的，則應用程式閘道會檢查證書是否由受信任的 CA 頒發，依此類推，直到找到受信任的 CA 證書。只有這樣，才會建立安全連接。否則，應用程式閘道會將後端標記為運行狀況不佳。",
- "guid": "79778b7d-1a8d-47bf-9000-cfe8f28007ed",
- "service": "Azure Application Gateway",
- "text": "重新加密後端流量時，請確保後端伺服器證書同時包含根證書頒發機構 （CA） 和中間證書頒發機構 （CA）",
- "type": "recommendation",
- "waf": "安全"
- },
- {
- "description": "當後端池包含可解析的 FQDN 時，DNS 解析基於專用 DNS 區域或自定義 DNS 伺服器（如果在 VNet 上配置），或者它使用 Azure 提供的預設 DNS。",
- "guid": "32630271-62af-4005-933b-36e73b3d6c43",
+ "description": "使用最新的 TLS 策略強制使用 TLS 1.2 和更強的密碼。TLS 策略包括對 TLS 協定版本和密碼套件的控制，以及 TLS 握手使用密碼的順序。",
+ "guid": "1a3a9dbe-2312-4a68-b063-8b0c22592e23",
"service": "Azure Application Gateway",
- "text": "對後端池資源使用適當的 DNS 伺服器",
+ "text": "設置 TLS 策略以增強安全性。確保您使用最新的 TLS 策略版本。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "應用程式閘道子網支援 NSG，但存在一些限制。例如，禁止與某些埠範圍進行某些通信。確保您了解這些限制的含義。有關詳細資訊，請參閱網路安全組。",
- "guid": "5644f4cb-0c54-41d6-9aff-27357089743c",
+ "description": "性能得到提高，因為發送到不同後端的請求不必對每個後端重新進行身份驗證。網關可以訪問請求內容並做出智慧路由決策。您只需在應用程式閘道上安裝證書，從而簡化證書管理。",
+ "guid": "0c1b9371-c2cb-49da-85eb-26cc64757480",
"service": "Azure Application Gateway",
- "text": "遵守應用程式閘道的所有 NSG 限制",
+ "text": "使用應用程式閘道進行 TLS 終止。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "在應用程式閘道子網上使用使用者定義的路由 （UDR） 可能會導致一些問題。後端的運行狀況可能未知。應用程式網關日誌和指標可能無法生成。建議不要在應用程式閘道子網上使用UDR，以便查看後端運行狀況、日誌和指標。如果您的組織需要在應用程式閘道子網中使用 UDR，請確保查看支援的方案。有關更多資訊，請參閱支援的使用者自定義路由。",
- "guid": "96ac0266-6e5d-4944-bccb-0c6b3bd00b89",
+ "description": "這種方法提供了更強的安全性、更輕鬆的角色和職責分離、對託管證書的支援以及更輕鬆的證書續訂和輪換過程。",
+ "guid": "ea5e0485-b8da-4ee3-8a93-e99759bb4425",
"service": "Azure Application Gateway",
- "text": "避免在應用程式閘道子網上使用UDR",
+ "text": "將應用程式閘道與 Key Vault 整合以儲存 TLS 證書。",
"type": "recommendation",
"waf": "安全"
},
{
- "description": "啟用WAF后，應用程式閘道必須緩衝每個請求，直到它完全到達，檢查請求是否與其核心規則集中的任何規則衝突匹配，然後將數據包轉發到後端實例。當有大檔上傳（大小為 30MB+）時，可能會導致明顯的延遲。由於應用程式閘道容量要求與 WAF 不同，因此我們不建議在未進行適當測試和驗證的情況下在應用程式閘道上啟用 WAF。",
- "guid": "3ac67acb-dcca-413d-b0f9-50441d51675f",
+ "description": "應用程式閘道子網支援 NSG，但存在一些限制。例如，禁止與某些埠範圍進行某些通信。確保您了解這些限制的含義。",
+ "guid": "573c5c87-a8d7-434a-bc3f-209bab02e1e3",
"service": "Azure Application Gateway",
- "text": "啟用 WAF 時請注意應用程式閘道容量的變化",
+ "text": "遵守應用程式閘道的所有 NSG 限制。",
"type": "recommendation",
"waf": "安全"
},
{
"description": "",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
+ "guid": "5a84b7c4-ee9e-4d73-aa23-c72b22068b5c",
"service": "Azure Application Gateway",
- "text": "熟悉應用程式閘道定價",
+ "text": "熟悉應用程式閘道和 WAF 定價。選擇大小合適的選項，以滿足您的工作負載容量需求，並在不浪費資源的情況下提供預期的性能。要估算成本，請使用定價計算機。",
"type": "checklist",
"waf": "成本"
},
{
"description": "",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
+ "guid": "d3f52caf-385f-438a-a8f6-141c46452277",
"service": "Azure Application Gateway",
- "text": "查看未充分利用的資源",
+ "text": "刪除未使用的應用程式閘道實例，並優化未充分利用的實例。為避免不必要的成本，請識別並刪除具有空後端池的應用程式網關實例。在應用程式閘道實例不使用時停止這些實例。",
"type": "checklist",
"waf": "成本"
},
{
"description": "",
- "guid": "03e1fbfa-86c2-4550-a6aa-e111d6ab895d",
+ "guid": "189437c3-c8b7-4186-aefa-353651b4885a",
"service": "Azure Application Gateway",
- "text": "停止未使用的應用程式閘道實例",
+ "text": "優化應用程式閘道實例的縮放成本。要優化擴展策略並減少負載需求，請參閱優化擴展成本的建議。",
"type": "checklist",
"waf": "成本"
},
{
"description": "",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "guid": "2a8113e8-7870-49b1-aeaf-39fa6e5d9992",
"service": "Azure Application Gateway",
- "text": "具有橫向縮減和橫向擴展策略",
+ "text": "監視應用程式閘道消耗指標，並瞭解其成本影響。Azure 根據跟蹤的指標對應用程式閘道的計量實例收費。評估各種指標和容量單位，並確定成本動因。有關詳細資訊，請參閱 Microsoft 成本管理。",
"type": "checklist",
"waf": "成本"
},
{
- "description": "",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
+ "description": "已停止的應用程式閘道實例不會產生費用。持續運行的應用程式閘道實例可能會產生不必要的成本。評估使用模式，並在不需要實例時停止實例。例如，在開發/測試環境中，下班后預計使用率較低。",
+ "guid": "58efe3ac-2476-4879-a014-d8eccee8da2a",
"service": "Azure Application Gateway",
- "text": "查看不同參數的消耗量指標",
- "type": "checklist",
- "waf": "成本"
- },
- {
- "description": "有關應用程式閘道定價的資訊，請參閱瞭解 Azure 應用程式閘道和 Web 應用程式防火牆的定價。您還可以利用定價計算機。確保選項的大小足以滿足容量需求，並在不浪費資源的情況下提供預期的性能。",
- "guid": "dc1995b1-dcc3-4864-a862-0c5ceeb3452c",
- "service": "Azure Application Gateway",
- "text": "熟悉應用程式閘道定價",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "識別並刪除具有空後端池的應用程式閘道實例，以避免不必要的成本。",
- "guid": "baadcfab-050c-4d30-a79a-a235e775836a",
- "service": "Azure Application Gateway",
- "text": "查看未充分利用的資源",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "當應用程式閘道處於 stopped 狀態時，不會向你收費。持續運行應用程式閘道實例可能會產生額外成本。評估使用模式並在不需要實例時停止實例。例如，在Dev/Test環境中，下班後的使用率預計會很低。有關如何停止和啟動實例的資訊，請參閱以下文章。- Stop-AzApplicationGateway- Start-AzApplicationGateway",
- "guid": "6af81413-0516-4067-9e26-8aad8d2d06ca",
- "service": "Azure Application Gateway",
- "text": "在不使用時停止應用程式閘道實例",
+ "text": "在應用程式閘道實例不使用時停止這些實例。有關更多資訊，請參閱 Stop-AzApplicationGateway 和 Start-AzApplicationGateway。",
"type": "recommendation",
"waf": "成本"
},
{
- "description": "橫向擴展策略可確保有足夠的實例來處理傳入流量和峰值。此外，制定縮減策略，確保在需求下降時減少實例數量。考慮實例大小的選擇。大小會顯著影響成本。估計應用程式閘道實例計數中介紹了一些注意事項。有關詳細資訊，請參閱什麼是 Azure 應用程式閘道 v2？",
- "guid": "a63e6bb7-8040-4b43-9d0e-6ca8a3413315",
+ "description": "使用這些指標來驗證預置的實例計數是否與傳入流量匹配，並確保您充分利用分配的資源。",
+ "guid": "fd75964f-9b65-416c-a1c1-de548ad574ce",
"service": "Azure Application Gateway",
- "text": "具有橫向縮減和橫向擴展策略",
- "type": "recommendation",
- "waf": "成本"
- },
- {
- "description": "根據 Azure 跟蹤的指標，根據應用程式閘道的計量實例向你收費。評估各種指標和容量單位，並確定成本驅動因素。有關更多資訊，請參閱 Microsoft 成本管理和計費。以下指標是應用程式閘道的關鍵。此資訊可用於驗證預配的實例計數是否與傳入流量量匹配。- 估計的計費容量單位 - 固定的計費容量單位 - 當前容量單位有關詳細資訊，請參閱應用程式網關指標。確保考慮頻寬成本。",
- "guid": "352664a9-dea7-4e45-9f4a-b1160768ac1b",
- "service": "Azure Application Gateway",
- "text": "查看不同參數的消耗量指標",
+ "text": "監控關鍵成本驅動因素 Application Gateway 指標，例如：- 估計的計費容量單位。 - 固定的可計費容量單位。- 當前容量單位。 確保考慮頻寬成本。",
"type": "recommendation",
"waf": "成本"
},
{
"description": "",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
+ "guid": "21e05ca9-4195-40c4-a568-d40330b4a852",
"service": "Azure Application Gateway",
- "text": "監控容量指標",
+ "text": "在應用程式閘道和 WAF 上啟用診斷。收集日誌和指標，以便您可以監控工作負載的運行狀況，確定工作負載性能和可靠性的趨勢，並排查問題。要設計整體監控方法，請參閱有關設計和創建監控系統的建議。",
"type": "checklist",
"waf": "操作"
},
{
"description": "",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
+ "guid": "417dcfc5-3516-4d5d-ab16-86b929b8e06a",
"service": "Azure Application Gateway",
- "text": "在應用程式閘道和 Web 應用程式防火牆 （WAF） 上啟用診斷",
+ "text": "使用 Azure Monitor 網路見解全面了解網路資源（包括應用程式閘道）的運行狀況和指標。使用集中式監控來快速識別和解決問題、優化性能並確保應用程式的可靠性。",
"type": "checklist",
"waf": "操作"
},
{
"description": "",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "guid": "455209bc-8603-41ed-bcf9-0c535b024bda",
"service": "Azure Application Gateway",
- "text": "使用 Azure Monitor 網路見解",
+ "text": "在 Azure 顧問中監視應用程式閘道建議。配置警報，以便在您有針對應用程式閘道實例的新關鍵建議時通知您的團隊。Advisor 根據屬性（如類別、影響級別和建議類型）生成建議。",
"type": "checklist",
"waf": "操作"
},
{
- "description": "",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
- "service": "Azure Application Gateway",
- "text": "將超時設置與後端應用程式匹配",
- "type": "checklist",
- "waf": "操作"
- },
- {
- "description": "",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
- "service": "Azure Application Gateway",
- "text": "使用 Azure 顧問監視 Key Vault 配置問題",
- "type": "checklist",
- "waf": "操作"
- },
- {
- "description": "",
- "guid": "78bbcbf2-30c3-4c77-8e8f-8faf4c4b817d",
- "service": "Azure Application Gateway",
- "text": "配置和監視 SNAT 埠限制",
- "type": "checklist",
- "waf": "操作"
- },
- {
- "description": "",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
+ "description": "在指標超過閾值時設置警報，以便您知道使用量何時增加。此方法可確保您有足夠的時間對工作負載實施必要的更改，並防止性能下降或中斷。",
+ "guid": "a6437209-8d1a-4a6b-94c8-84bb342256a4",
"service": "Azure Application Gateway",
- "text": "在設計中考慮 SNAT 埠限制",
- "type": "checklist",
- "waf": "操作"
- },
- {
- "description": "使用這些指標作為預配的應用程式閘道容量利用率的指標。我們強烈建議您設置容量警報。有關詳細資訊，請參閱應用程式網關高流量支援。",
- "guid": "2aeef441-2f0c-4f28-b3fe-85bb210e70d4",
- "service": "Azure Application Gateway",
- "text": "監控容量指標",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "還有其他指標可以指示應用程式閘道或後端存在問題。我們建議評估以下警報：- 不正常的主機計數 - 回應狀態（維度 4xx 和 5xx）- 後端回應狀態（維度 4xx 和 5xx）- 後端最後一個字節回應時間 - 應用程式網關總時間有關詳細資訊，請參閱應用程式閘道的指標。",
- "guid": "af883a3e-1ece-4f8a-9732-95a461fe244c",
- "service": "Azure Application Gateway",
- "text": "使用指標進行故障排除",
+ "text": "配置警報，以便在容量指標（如 CPU 使用率和計算單位使用率）超過建議的閾值時通知您的團隊。 若要根據容量指標配置一組全面的警報，請參閱應用程式網關高流量支援。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "診斷日誌允許您查看防火牆日誌、性能日誌和訪問日誌。使用這些日誌來管理和排查應用程式閘道實例的問題。有關詳細資訊，請參閱應用程式網關的後端運行狀況和診斷日誌。",
- "guid": "2a3d27da-fdb8-49b0-95ed-7f9b32b4f7ca",
+ "description": "使用警報有助於確保您的團隊能夠及時響應問題並促進故障排除。",
+ "guid": "0c7b12f7-1980-420c-bc6c-e6a14a76ef13",
"service": "Azure Application Gateway",
- "text": "在應用程式閘道和 Web 應用程式防火牆 （WAF） 上啟用診斷",
+ "text": "配置警報以通知團隊有關指示應用程式閘道或後端問題的指標。建議評估以下警報：- 運行狀況不佳的主機計數 - 回應狀態，例如 4xx 和 5xx 錯誤 - 後端回應狀態，例如 4xx 和 5xx 錯誤 - 後端最後一個字節回應時間 - 應用程式網關總時間有關詳細資訊，請參閱應用程式網關的指標。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "Azure Monitor 網路見解提供網路資源（包括應用程式閘道）的運行狀況和指標的全面檢視。有關應用程式閘道的其他詳細資訊和支援的功能，請參閱 Azure Monitor 網路見解。",
- "guid": "69a9c288-6a98-447b-92f8-68c84adc85cd",
+ "description": "使用日誌來幫助檢測、調查和排查應用程式閘道實例和工作負載的問題。",
+ "guid": "242dccc5-f6ec-483b-9f44-6b90695c9a55",
"service": "Azure Application Gateway",
- "text": "使用 Azure Monitor 網路見解",
+ "text": "在應用程式閘道和 WAF 上啟用診斷日誌，以收集防火牆日誌、性能日誌和訪問日誌。",
"type": "recommendation",
"waf": "操作"
},
{
- "description": "確保您已配置 IdleTimeout 設定以符合後端應用程式的偵聽器和流量特徵。默認值設置為 4 分鐘，最多可配置為 30。有關更多資訊，請參閱負載均衡器 TCP 重置和空閒超時。有關工作負載注意事項，請參閱監控應用程式運行狀況的可靠性。",
- "guid": "82f522dd-25e0-4e7c-a547-bc23577f7f1c",
+ "description": "使用 Advisor 警報保持最新狀態並立即解決問題。防止任何與控制平面或數據平面相關的問題。 應用程式閘道每 4 小時檢查一次連結的 Key Vault 實例中的續訂證書版本。如果證書版本由於 Key Vault 配置不正確而無法訪問，它會記錄該錯誤並推送相應的 Advisor 建議。",
+ "guid": "a0bfec93-73f3-421d-bce8-f055e8c52d03",
"service": "Azure Application Gateway",
- "text": "將超時設置與後端應用程式匹配",
+ "text": "使用 Advisor 監視 Key Vault 配置問題。設置警報，以便在收到指出 Resolve Azure Key Vault issue for your Application Gateway 的建議時通知你的團隊。",
"type": "recommendation",
"waf": "操作"
},
- {
- "description": "應用程式閘道每隔 4 小時檢查一次連結的 Key Vault 中續訂的證書版本。如果由於任何不正確的 Key Vault 配置而無法訪問它，它會記錄該錯誤並推送相應的顧問建議。您必須將 Advisor 警報配置為保持更新並立即修復此類問題，以避免任何與控制或數據平面相關的問題。有關更多資訊，請參閱調查和解決 Key Vault 錯誤。要針對此特定情況設置警報，請使用 Recommendation Type （建議類型） 作為 Resolve Azure Key Vault issue （解決應用程式閘道的 Azure Key Vault 問題）。",
- "guid": "6f9954fb-dff1-4d54-8672-0c1245908dca",
- "service": "Azure Application Gateway",
- "text": "使用 Azure 顧問監視 Key Vault 配置問題",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "SNAT 埠限制對於應用程式閘道上的後端連接非常重要。有單獨的因素會影響應用程式閘道達到 SNAT 埠限制的方式。例如，如果後端是公有IP位址，則需要自己的SNAT埠。為了避免 SNAT 埠限制，可以增加每個應用程式閘道的實例數，橫向擴展後端以擁有更多 IP 位址，或者將後端移動到同一虛擬網路中，並將專用 IP 位址用於後端。如果達到 SNAT 埠限制，應用程式閘道上的每秒請求數 （RPS） 將受到影響。例如，如果應用程式閘道達到 SNAT 埠限制，則它將無法打開與後端的新連接，並且請求將失敗。",
- "guid": "ca428415-6120-410f-9a91-c1baeb6c0084",
- "service": "Azure Application Gateway",
- "text": "在設計中考慮 SNAT 埠限制",
- "type": "recommendation",
- "waf": "操作"
- },
- {
- "description": "",
- "guid": "261fdf60-ce3b-4abd-8a85-b39ebb208df9",
- "service": "Azure Application Gateway",
- "text": "估計應用程式閘道實例計數",
- "type": "checklist",
- "waf": "性能"
- },
- {
- "description": "",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
- "service": "Azure Application Gateway",
- "text": "定義最大實例計數",
- "type": "checklist",
- "waf": "性能"
- },
- {
- "description": "",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
- "service": "Azure Application Gateway",
- "text": "定義最小實例計數",
- "type": "checklist",
- "waf": "性能"
- },
{
"description": "",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "guid": "6c174b42-25c9-48b5-a7f0-66194a921499",
"service": "Azure Application Gateway",
- "text": "定義應用程式閘道子網大小",
+ "text": "估計應用程式閘道的容量要求，以支援您的工作負載要求。利用應用程式閘道 v2 中的自動縮放功能。為最小和最大實例數設置適當的值。適當調整應用程式閘道所需的專用子網的大小。有關更多資訊，請參閱容量規劃建議。",
"type": "checklist",
"waf": "性能"
},
{
"description": "",
- "guid": "958240c8-23f1-447d-9cb7-ce9edb5aa606",
+ "guid": "6d050160-98d5-49dd-9181-c01917b3f19a",
"service": "Azure Application Gateway",
- "text": "利用應用程式閘道 V2 功能實現自動縮放和性能優勢",
+ "text": "利用自動擴展和性能優勢的功能。v2 SKU 提供自動縮放功能，可隨著流量的增加而縱向擴展應用程式網關。與 v1 SKU 相比，v2 SKU 具有增強工作負載性能的功能。例如，v2 SKU 具有更好的 TLS 卸載性能、更快的部署和更新時間以及區域冗餘支援。有關更多資訊，請參閱擴展應用程式閘道 v2 和 WAF v2。",
"type": "checklist",
"waf": "性能"
},
{
- "description": "對於應用程式閘道 v2 SKU，自動縮放需要一些時間（大約 6 到 7 分鐘），然後額外的實例集才能準備好提供流量。在此期間，如果流量出現短暫的峰值，則預計會出現暫時性延遲或流量丟失。我們建議您將最小實例計數設置為最佳水準。估計平均實例計數並確定應用程式閘道自動縮放趨勢後，請根據應用程式模式定義最小實例計數。有關資訊，請參閱應用程式閘道高流量支援。檢查過去一個月的 Current Compute Units（當前計算單位）。此指標表示閘道的CPU利用率。要定義最小實例計數，請將峰值使用量除以 10。例如，如果您在過去一個月的平均當前計算單位數為50，請將最小實例計數設置為5。",
- "guid": "4d24ceaf-6ff5-4b88-96e2-851546c368c1",
+ "description": "對於應用程式閘道 v2，自動縮放大約需要 6 到 7 分鐘，然後額外的實例集才能準備好提供流量。在此期間，如果應用程式閘道的流量峰值較短，則預計會出現暫時性延遲或流量丟失。",
+ "guid": "b556535f-178c-4d6f-a2eb-be758dfd24da",
"service": "Azure Application Gateway",
- "text": "定義最小實例計數",
+ "text": "根據估計的實例計數、實際應用程式閘道自動縮放趨勢和應用程式模式，將最小實例計數設置為最佳級別。 檢查過去一個月的當前計算單位。此指標表示閘道的CPU使用率。要定義最小實例計數，請將峰值使用量除以 10。例如，如果您在過去一個月的平均當前計算單位數為50，請將最小實例計數設置為5。",
"type": "recommendation",
"waf": "性能"
},
{
- "description": "我們建議將 125 作為最大自動縮放實例計數。確保具有應用程式閘道的子網具有足夠的可用IP位址來支援縱向擴展的實例集。將最大實例計數設置為125不會影響成本，因為您只需為使用的容量付費。",
- "guid": "895dcecb-9895-4a39-bafd-4df574353366",
+ "description": "應用程式閘道可以根據需要橫向擴展，以處理應用程式增加的流量。此設置不會增加成本，因為您只需為使用的容量付費。",
+ "guid": "4d433fe8-4f14-4878-b319-c27bb4846a48",
"service": "Azure Application Gateway",
- "text": "定義最大實例計數",
+ "text": "將最大自動縮放實例計數設置為可能的最大值，即125個實例。確保應用程式閘道專用子網具有足夠的可用IP位址來支援增加的實例集。",
"type": "recommendation",
"waf": "性能"
},
{
- "description": "應用程式閘道需要在虛擬網路中有一個專用子網。子網可以包含已部署的應用程式閘道資源的多個實例。還可以在該子網、v1 或 v2 SKU 中部署其他應用程式閘道資源。下面是定義子網大小的一些注意事項：- 應用程式閘道為每個實例使用一個專用IP位址，如果配置了專用前端IP，則使用另一個專用IP位址。- Azure 在每個子網中保留5個IP位址供內部使用。- 應用程式閘道（標準或 WAF SKU）最多可支援 32 個實例。以 32 個實例 IP 位址 + 1 個專用前端 IP + 5 個 Azure 預留位址為例，建議最小子網大小為 /26。由於 Standard_v2 SKU 或 WAF_v2 SKU 最多可以支援 125 個實例，因此使用相同的計算方法，建議使用 /24 的子網大小。如果要在同一子網中部署其他應用程式網關資源，請考慮標準和標準 v2 的最大實例計數所需的其他 IP 位址。",
- "guid": "57675336-826b-4523-b248-bfe3c324c38a",
+ "description": "使用 /24 子網為應用程式閘道 v2 部署所需的所有IP位址提供支援。 應用程式閘道為每個實例使用一個專用IP位址，如果配置了專用前端IP，則使用另一個專用IP位址。Standard_v2 SKU 或 WAF_v2 SKU 最多可支援 125 個實例。Azure 在每個子網中保留 5 個 IP 位址供內部使用。",
+ "guid": "e3323d47-6019-49e3-bc22-a24bcfa4efba",
"service": "Azure Application Gateway",
- "text": "定義應用程式閘道子網大小",
- "type": "recommendation",
- "waf": "性能"
- },
- {
- "description": "v2 SKU 提供自動縮放功能，以確保應用程式閘道可以隨著流量的增加而縱向擴展。與 v1 SKU 相比，v2 具有增強工作負載性能的功能。例如，更好的 TLS 卸載性能、更快的部署和更新時間、區域冗餘等。有關自動縮放功能的更多資訊，請參閱擴展應用程式閘道 v2 和 WAF v2。如果運行的是 v1 SKU 應用程式閘道，請考慮遷移到應用程式閘道 v2 SKU。有關詳細資訊，請參閱將 Azure 應用程式閘道和 Web 應用程式防火牆從 v1 遷移到 v2。",
- "guid": "508791c8-897f-4490-8590-fc33a9df8f73",
- "service": "Azure Application Gateway",
- "text": "利用自動擴展和性能優勢",
+ "text": "適當調整應用程式閘道專用子網的大小。強烈建議將 /24 子網用於應用程式閘道 v2 部署。 如果要在同一子網中部署其他應用程式閘道資源，請考慮最大實例計數所需的額外IP位址。 有關調整子網大小的更多注意事項，請參閱應用程式網關基礎結構配置。",
"type": "recommendation",
"waf": "性能"
},
@@ -1272,13 +1120,13 @@
"service": "Azure Blob Storage",
"text": "監控使用方式：持續監控使用模式並檢測未使用或未充分利用的帳戶和容器。使用 Storage Insights 來識別未使用或使用率低的帳戶。啟用 blob 清單報告，並使用 Azure Databricks 或 Azure Synapse Analytics 和 Power BI 等工具來分析成本數據。請注意容量的意外增加，這可能表示你正在收集大量日誌檔、blob 版本或軟刪除的 blob。制定策略，將物件過期或轉換為更具成本效益的訪問層。制定物件過期或將物件移動到更實惠的訪問層的計劃。",
"type": "checklist",
- "waf": null
+ "waf": "成本"
},
{
"description": "較冷的層具有較高的數據傳輸成本。通過減少大檔，可以減少傳輸數據所需的操作數。",
"guid": "7eb7a0d4-912b-4d5c-af98-31200e20cc63",
"service": "Azure Blob Storage",
- "text": null,
+ "text": "在將小檔移動到較冷的層之前，先將它們打包成較大的檔。您可以使用 TAR 或 ZIP 等檔案格式。",
"type": "recommendation",
"waf": "成本"
},
@@ -1315,7 +1163,7 @@
"waf": "成本"
},
{
- "description": null,
+ "description": "每次覆蓋 blob 時，都會創建一個新快照。容量費用增加的原因可能難以理解，因為這些快照的創建不會顯示在日誌中。為了降低容量費用，請將經常被覆蓋的數據存儲在禁用軟刪除的單獨存儲帳戶中。保留期可防止軟刪除的 blob 堆積並增加容量成本。",
"guid": "7041f493-74f4-42e8-bbd2-15602763dc40",
"service": "Azure Blob Storage",
"text": "如果啟用軟刪除，請將經常被覆蓋的 blob 放入未啟用軟刪除的帳戶中。設置保留期。請考慮從較短的保留期開始，以更好地瞭解該功能如何影響您的帳單。建議的最短保留期為 7 天。",
@@ -1334,7 +1182,7 @@
"description": "加密範圍按月收費。",
"guid": "b71aeb26-fc96-486c-8bed-c5c616c1d0b1",
"service": "Azure Blob Storage",
- "text": null,
+ "text": "禁用任何不需要的加密範圍，以避免不必要的費用。",
"type": "recommendation",
"waf": "成本"
},
@@ -1374,7 +1222,7 @@
"description": "可以使用現有的 DevOps 流程來部署新的儲存帳戶，並使用 Azure Policy 強制實施其配置。",
"guid": "d069785a-7a9f-4a12-9642-3987b04328d1",
"service": "Azure Blob Storage",
- "text": null,
+ "text": "使用基礎結構即代碼 （IaC） 在 Azure 資源管理器範本（ARM 範本）、Bicep 或 Terraform 中定義記憶體帳戶的詳細資訊。",
"type": "recommendation",
"waf": "操作"
},
@@ -1467,7 +1315,7 @@
"waf": "性能"
},
{
- "description": "大於 256 KiB 的 blob 或塊大小利用了平臺中專為較大的 blob 和塊大小設計的性能增強。",
+ "description": null,
"guid": "78872d9e-216b-4cc3-8686-0471d46a1acd",
"service": "Azure Blob Storage",
"text": "上傳 blob 或塊時，請使用大於 256 KiB 的 blob 或塊大小。",
@@ -1534,7 +1382,7 @@
"description": "在初始規劃階段，需要決定是要配置 ExpressRoute 線路還是 ExpressRoute Direct 連接。ExpressRoute 線路允許在連接供應商的説明下與 Azure 建立專用連接。ExpressRoute Direct 允許將本地網路直接擴展到對等互連位置的 Microsoft 網路。您還需要確定業務需求的頻寬要求和 SKU 類型要求。",
"guid": "09e0dd1a-b1f7-46c3-8df1-48e841f53dca",
"service": "Azure Expressroute",
- "text": "規劃 ExpressRoute 線路或 ExpressRoute Direct",
+ "text": null,
"type": "recommendation",
"waf": "可靠性"
},
@@ -1568,7 +1416,7 @@
"service": "Azure Expressroute",
"text": "監控電路和網關運行狀況",
"type": "recommendation",
- "waf": "可靠性"
+ "waf": null
},
{
"description": "ExpressRoute 使用服務運行狀況來通知計劃內和計劃外維護。配置服務運行狀況將通知你對 ExpressRoute 線路所做的更改。",
@@ -5326,7 +5174,7 @@
"metadata": {
"name": "WAF Service Guides",
"state": "preview",
- "timestamp": "October 01, 2024",
+ "timestamp": "October 21, 2024",
"waf": "all"
},
"status": [
@@ -5353,31 +5201,31 @@
],
"waf": [
{
- "name": "性能"
+ "name": "可靠性"
},
{
- "name": "安全"
+ "name": "成本"
},
{
- "name": "性能"
+ "name": "操作"
},
{
- "name": "成本"
+ "name": "安全"
},
{
- "name": "可靠性"
+ "name": "性能"
},
{
- "name": "操作"
+ "name": "可靠性"
},
{
"name": "操作"
},
{
- "name": "可靠性"
+ "name": "安全"
},
{
- "name": "安全"
+ "name": "性能"
},
{
"name": "成本"
diff --git a/checklists/checklist.en.master.json b/checklists/checklist.en.master.json
index db42e3e6d..e456f3098 100644
--- a/checklists/checklist.en.master.json
+++ b/checklists/checklist.en.master.json
@@ -1,43401 +1,44502 @@
{
"items": [
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "9f519499-5820-4060-88fe-cab4538c9dd0",
- "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements",
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview",
"services": [
- "Storage"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "Physical",
- "text": "All planned storage pools should use direct-attached storage (SATA, SAS, NVMe)",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Business",
+ "text": "Understand what kind of solution you're creating, such as business-to-business (B2B), business-to-consumer (B2C), or your enterprise software, and how tenants are different from users.",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "f7c015e0-7d97-4283-b006-567afeb2b5ca",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/drive-symmetry-considerations#understand-capacity-imbalance",
- "services": [
- "ACR",
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "Physical",
- "text": "Disks are symmetrical across all nodes",
- "waf": "Performance"
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Business",
+ "text": "Define your tenants. Understand how many tenants you will support initially, and your growth plans.",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "f785b143-2c1e-4466-9baa-dde8ba4c7aaa",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity",
- "services": [
- "Storage",
- "Backup"
- ],
- "severity": "Medium",
- "subcategory": "S2D",
- "text": "Parity type disk redundancy should only be used for low I/O volumes (backup/archive)",
- "waf": "Performance"
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Business",
+ "text": "Define your pricing model and ensure it aligns with your tenants' consumption of Azure resources.",
+ "waf": "Cost"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "8a705965-9840-43cc-93b3-06d089406bb4",
- "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements#physical-deployments",
- "services": [
- "Storage"
- ],
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models",
+ "services": [],
"severity": "Medium",
- "subcategory": "S2D",
- "text": "Ensure there at least 2 capacity disks with available capacity in the Storage Pool",
- "waf": "Reliability"
- },
- {
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "2a4f629a-d623-4610-a8e3-d6fd66057d8e",
- "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/delimit-volume-allocation",
- "services": [
- "Storage"
- ],
- "severity": "Low",
- "subcategory": "S2D",
- "text": "'Delimited allocation' has been considered to improve volume resiliency in a multi-node failure",
- "waf": "Reliability"
+ "subcategory": "Business",
+ "text": "Understand whether you need to separate your tenants into different tiers. Tiers might have different pricing, features, performance promises, geographic locations, and so forth.",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "960eb9be-1f0f-4fc1-9b31-fcf1cf9e34e6",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#choosing-how-many-volumes-to-create",
- "services": [
- "Storage"
- ],
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "services": [],
"severity": "Medium",
- "subcategory": "S2D",
- "text": "CSVs are created in multiples of node count",
- "waf": "Performance"
+ "subcategory": "Business",
+ "text": "Based on your customers' requirements, decide on the tenancy models that are appropriate for various parts of your solution.",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "859ba2b9-a3a8-4ca1-bb61-165effbf1c03",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/cache",
+ "category": "Business",
+ "checklist": "Multitenant architecture",
+ "guid": "f5d76ae1-7048-4ff5-abba-f1ca799578b9",
+ "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer",
"services": [
- "Storage"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "S2D",
- "text": "If a cache tier is implemented, the number of capacity drives is a multiple of the number of cache drives",
- "waf": "Performance"
+ "subcategory": "Business",
+ "text": "When you're ready, sell your B2B multitenant solution using the Microsoft Commercial Marketplace.",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "d8a65f05-db06-461d-81dc-7899ad3f8f1e",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#reserve-capacity",
- "services": [
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "S2D",
- "text": "A minimum of 1 type of each disk type per node has been factored as a reserve disk",
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Reliability",
+ "text": "Review the Azure Well-Architected Reliability checklist, which is applicable to all workloads.",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "description": "VMFleet is a tool that can be used to measure the performance of a storage subsystem, best used to baseline performance prior to workload deployment",
- "guid": "9d138f1d-5363-476e-bbd7-acfa500bdc0c",
- "link": "https://github.com/microsoft/diskspd/wiki/VMFleet",
- "services": [
- "Storage"
- ],
- "severity": "Low",
- "subcategory": "S2D",
- "text": "VMFleet has been run prior to workload deployment to baseline storage performance",
- "waf": "Performance"
- },
- {
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "13c12e2a-c938-4dd1-9223-507d5e17f9c5",
- "services": [
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "Host OS",
- "text": "OS drives use a dedicated storage controller",
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
+ "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Reliability",
+ "text": "Understand the Noisy Neighbor antipattern. Prevent individual tenants from impacting the system's availability for other tenants.",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Stack HCI Review",
- "guid": "a631e7dc-8879-45bd-b0a7-e5927b805428",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-csv-cache",
- "services": [
- "Storage"
- ],
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Host OS",
- "text": "CSV in-memory read caching is enabled and properly configured",
- "waf": "Performance"
+ "subcategory": "Reliability",
+ "text": "Design your multitenant solution for the level of growth that you expect. But don't overengineer for unrealistic growth.",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "c062cd9a-f1db-4f83-aab3-9cb03f56c140",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements#switch-embedded-teaming-set",
- "services": [
- "ACR"
- ],
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics",
+ "services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "NICs are symmetrical across nodes",
+ "subcategory": "Reliability",
+ "text": "Define service-level objectives (SLOs) and optionally service-level agreements (SLAs) for your solution. SLAs and SLOs should be based on the requirements of your tenants, as well as the composite SLA of the Azure resources in your architecture.",
"waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "ea8054db-a558-4533-80c8-5d9cf447ba19",
- "services": [
- "Storage"
- ],
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
+ "services": [],
"severity": "High",
- "subcategory": "Host",
- "text": "Storage networking is redundant",
+ "subcategory": "Reliability",
+ "text": "Test the scale of your solution. Ensure that it performs well under all levels of load, and that it scales correctly as the number of tenants increases.",
"waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "15d976c5-e267-49a1-8b00-62010bfa5188",
- "link": "https://learn.microsoft.com/azure-stack/hci/deploy/network-atc",
+ "category": "Reliability",
+ "checklist": "Multitenant architecture",
+ "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
"services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "Host networking configuration is managed by Network ATC and intents are healthy",
+ "subcategory": "Reliability",
+ "text": "Apply chaos engineering principles to test the reliability of your solution.",
"waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "676c53ad-b29a-4de1-9d03-d7d2674405b8",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/network-hud-overview",
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
+ "link": "https://learn.microsoft.com/security/zero-trust",
"services": [],
- "severity": "Low",
- "subcategory": "Host",
- "text": "Network HUD has been configured",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Security",
+ "text": "Apply the Zero Trust and least privilege principles in all layers of your solution.",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "8f6d58d9-6c1a-4ec1-b2d7-b2c6ba8f3949",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements",
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests",
"services": [
- "Storage",
- "VNet"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "Host",
- "text": "Storage NICs are assigned static IP addresses on separate subnets and VLANs",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Security",
+ "text": "Ensure that you can correctly map user requests to tenants. Consider including the tenant context as part of the identity system, or by using another means, like application-level tenant authorization.",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "824e53ec-953e-40c2-a6b8-52970b5b0f74",
- "link": "https://learn.microsoft.com/azure-stack/hci/plan/two-node-switched-converged",
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
"services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "For switchless designs, dual link full mesh connectivity has been implemented",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Perform ongoing penetration testing and security code reviews.",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "dbc85d0e-0ebd-4589-a789-0fa8ceb1d0f0",
- "link": "https://learn.microsoft.com/azure-stack/hci/concepts/physical-network-requirements#using-switchless",
- "services": [
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "Host",
- "text": "If the cluster is made up of more than 3 nodes, a switched storage network has been implemented",
- "waf": "Reliability"
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Security",
+ "text": "Understand your tenants' compliance requirements, including data residency and any compliance or regulatory standards that they require you to meet.",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "603c6d71-59d2-419c-a312-8edc6e799c6a",
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names",
"services": [
- "Storage"
+ "DNS"
],
"severity": "High",
- "subcategory": "Host",
- "text": "RDMA is enabled on the Storage networking",
- "waf": "Performance"
+ "subcategory": "Security",
+ "text": "Correctly manage domain names and avoid vulnerabilities like dangling DNS and subdomain takeover attacks.",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "9e260eae-bca1-4827-a259-76ee63fda8d6",
- "link": "https://github.com/microsoft/SDN/blob/master/Diagnostics/Test-Rdma.ps1",
+ "category": "Security",
+ "checklist": "Multitenant architecture",
+ "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview",
"services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "Test-RDMA.ps1 has been run to validate the RDMA configuration",
- "waf": "Performance"
- },
- {
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "description": "This ensures that Management traffic is not exposed to the VM traffic",
- "guid": "abc85d0e-0ebd-4589-a777-0fa8ceb1d0f0",
- "link": "",
- "services": [
- "VM"
- ],
- "severity": "Medium",
- "subcategory": "Host",
- "text": "If a VMSwitch is shared for Compute and Management traffic, require that Management traffic is tagged with a VLAN ID",
+ "subcategory": "Security",
+ "text": "Follow service-specific guidance for multitenancy.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "description": "This ensures you have at least 3 NCs active at all times during NC upgrades.",
- "guid": "eb36f5f4-0fa7-4a2c-85f3-1b1c7c7817c0",
+ "category": "Cost Optimization",
+ "checklist": "Multitenant architecture",
+ "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist",
"services": [
- "VM"
+ "Cost"
],
"severity": "Medium",
- "subcategory": "SDN",
- "text": "There are at least 3 Network Controller VMs deployed",
- "waf": "Reliability"
+ "subcategory": "Cost Optimization",
+ "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
+ "waf": "Cost"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "8bc78c85-6028-4a43-af2d-082a0a344909",
- "link": "https://learn.microsoft.com/windows-server/networking/sdn/manage/update-backup-restore",
+ "category": "Cost Optimization",
+ "checklist": "Multitenant architecture",
+ "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption",
"services": [
- "Backup"
+ "Cost"
],
"severity": "High",
- "subcategory": "SDN",
- "text": "Backups of SDN infrastructure are configured and tested",
- "waf": "Operations"
+ "subcategory": "Cost Optimization",
+ "text": "Ensure you can adequately measure per-tenant consumption and correlate it with your infrastructure costs.",
+ "waf": "Cost"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "51eaa4b6-b9a7-43e1-a7dc-634d3107bc6d",
+ "category": "Cost Optimization",
+ "checklist": "Multitenant architecture",
+ "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation",
"services": [
+ "Cost",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Cluster",
- "text": "SCOM Managed Instance has been considered for more complex monitoring and alerting scenarios",
- "waf": "Operations"
+ "subcategory": "Cost Optimization",
+ "text": "Avoid antipatterns. Antipatterns include failing to track costs, tracking costs with unnecessary precision, real-time measurement, and using monitoring tools for billing.",
+ "waf": "Cost"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "831f5aca-99ef-41e7-8263-9509f5093b43",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/setup-hci-system-alerts",
- "services": [
- "Monitor"
- ],
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "0d475a5a-2c0f-47ab-b1e1-701da68d3407",
+ "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops",
+ "services": [],
"severity": "High",
- "subcategory": "Cluster",
- "text": "Alerts have been configured for the cluster, either using Azure Monitor, SCOM, or a third-party solution",
+ "subcategory": "Operational Excellence",
+ "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "f95d0e7e-9f61-476d-bf65-59f2454d1d39",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later",
- "services": [
- "Monitor"
- ],
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle",
+ "services": [],
"severity": "Medium",
- "subcategory": "Cluster",
- "text": "Insights has been enabled at the cluster level and all nodes are reporting data",
+ "subcategory": "Operational Excellence",
+ "text": "Use automation to manage the tenant lifecycle, such as onboarding, deployment, provisioning, and configuration.",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "f4250fcb-ff53-40c9-b304-3560464fd90c",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later",
- "services": [
- "Monitor"
- ],
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates",
+ "services": [],
"severity": "Medium",
- "subcategory": "Cluster",
- "text": "Azure Monitoring Agent has been deployed to hosts and an appropriate Data Collection Rule has been configured",
+ "subcategory": "Operational Excellence",
+ "text": "Find the right balance for deploying service updates. Consider both your tenants' requirements and your own operational requirements.",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "6143af1d-0d1a-4163-b1c9-662f7459bb98",
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
"services": [
"Monitor"
],
- "severity": "Medium",
- "subcategory": "Hardware",
- "text": "Relevant hardware monitoring has been configured",
+ "severity": "High",
+ "subcategory": "Operational Excellence",
+ "text": "Monitor the health of the overall system, as well as each tenant.",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Stack HCI Review",
- "guid": "9cbdf225-549a-41cf-9c97-794766a6f2b0",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/health-service-overview",
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
"services": [
"Monitor"
],
"severity": "Medium",
- "subcategory": "Hardware",
- "text": "Relevant hardware alerting has been configured",
+ "subcategory": "Operational Excellence",
+ "text": "Configure and test alerts to notify you when specific tenants are experiencing issues or are exceeding their consumption limits.",
"waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "c0da5bbd-0f0d-4a26-98ec-38c9cc42b323",
- "services": [
- "VM"
- ],
- "severity": "Low",
- "subcategory": "VM Management - Resource Bridge",
- "text": "The Azure CLI has been installed on every node to enable RB management from WAC",
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Operational Excellence",
+ "text": "Organize your Azure resources for isolation and scale.",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "a8ecf23c-c048-4fa9-b87b-51ebfb409863",
- "services": [
- "VM"
- ],
- "severity": "Low",
- "subcategory": "VM Management - Resource Bridge",
- "text": "DHCP is available in the cluster to support Guest Configuration at VM deployment from Azure",
+ "category": "Operational Excellence",
+ "checklist": "Multitenant architecture",
+ "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Operational Excellence",
+ "text": "Avoid deployment and configuration antipatterns. Antipatterns include running separate versions of the solution for each tenant, hardcoding tenant-specific configurations or logic, and manual deployments.",
"waf": "Operations"
},
{
- "category": "Backup and Disaster Recovery",
- "checklist": "Azure Stack HCI Review",
- "guid": "074541e3-fe08-458a-8062-32d13dcc10c6",
- "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines",
- "services": [
- "Backup",
- "VM",
- "ASR"
- ],
+ "category": "Performance Efficiency",
+ "checklist": "Multitenant architecture",
+ "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency",
+ "services": [],
"severity": "High",
- "subcategory": "VM",
- "text": "Backups of HCI VMs have been configured using MABS or a third-party solution",
- "waf": "Operations"
+ "subcategory": "Performance Efficiency",
+ "text": "Review the Azure Well-Architected Performance Efficiency checklist, which is applicable to all workloads.",
+ "waf": "Performance"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "48f7ae57-1035-4101-8a38-fbe163d03e8a",
+ "category": "Performance Efficiency",
+ "checklist": "Multitenant architecture",
+ "guid": "18911c4c-934c-49a8-839a-60c092afce30",
+ "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor",
"services": [],
"severity": "High",
- "subcategory": "Cluster Configuration",
- "text": "Cluster configuration or a configuration script has been documented and maintained",
- "waf": "Operations"
+ "subcategory": "Performance Efficiency",
+ "text": "If you use shared infrastructure, plan for how you'll mitigate Noisy Neighbor concerns. Ensure that one tenant can't reduce the performance of the system for other tenants.",
+ "waf": "Performance"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "f2a6a19a-ffe6-444d-badb-cb336c8e7b50",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/witness",
+ "category": "Performance Efficiency",
+ "checklist": "Multitenant architecture",
+ "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Performance Efficiency",
+ "text": "Determine how you'll scale your compute, storage, networking, and other Azure resources to match the demands of your tenants.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Performance Efficiency",
+ "checklist": "Multitenant architecture",
+ "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization",
"services": [],
"severity": "High",
- "subcategory": "Cluster Configuration",
- "text": "A cluster witness has been configured for clusters with less than 5 nodes",
+ "subcategory": "Performance Efficiency",
+ "text": "Consider each Azure resource's scale limits. Organize your resources appropriately, in order to avoid resource organization antipatterns. For example, don't over-architect your solution to work within unrealistic scale requirements.",
+ "waf": "Performance"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Container Apps Review",
+ "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
+ "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
+ "service": "Container Apps",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Leverage Availability Zones if regionally applicable",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "a47339fe-62c5-44a0-bb83-3d46ef16292f",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/update-cluster",
+ "category": "BC and DR",
+ "checklist": "Container Apps Review",
+ "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
+ "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
+ "service": "Container Apps",
"services": [],
- "severity": "Medium",
- "subcategory": "Cluster Configuration",
- "text": "Cluster-Aware Updating has been configured for Windows and hardware updates (if available)",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Use more than one replica and enable Zone Redundancy.",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "7f1d6fe8-3079-44ea-8ea6-14494d1aa470",
- "link": "https://learn.microsoft.com/azure-stack/hci/deploy/validate",
+ "category": "BC and DR",
+ "checklist": "Container Apps Review",
+ "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [],
"severity": "High",
- "subcategory": "Cluster Configuration",
- "text": "Cluster validation has been run against the configured cluster",
+ "subcategory": "High Availability",
+ "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "81693af0-5638-4aa2-a153-1d6189df30a7",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits",
+ "category": "BC and DR",
+ "checklist": "Container Apps Review",
+ "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [
- "VM"
+ "TrafficManager",
+ "FrontDoor"
],
- "severity": "Medium",
- "subcategory": "Cluster Configuration",
- "text": "Azure Benefits has been enabled at the cluster and VM levels",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "8c967ee8-8170-4537-a28d-33431cd3632a",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-environment-checker",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
+ "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
+ "service": "Purview",
"services": [],
"severity": "Medium",
- "subcategory": "Cluster Configuration",
- "text": "The Environment Checker module has been run to validate the environment",
+ "subcategory": "Best Practices",
+ "text": "Leverage FTA Resillency Handbook",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "43ffbfab-766e-4950-a102-78b479136e4d",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "AzurePolicy"
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "Cluster Configuration",
- "text": "Group Policy inheritance on the HCI cluster and node Active Directory organizational unit has been blocked or applied policies have been evaluated for compatibility issues (usually WinRM and PowerShell execution policy)",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Disaster Recovery",
+ "text": "Plan for Data Center level outage",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "e6a3f3a7-4a7d-49e2-985a-6e39dd284027",
- "services": [],
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
+ "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
+ "services": [
+ "ASR"
+ ],
"severity": "Medium",
- "subcategory": "Cluster Configuration",
- "text": "WAC is on the latest release and configured to automatically upgrade extensions",
+ "subcategory": "Disaster Recovery",
+ "text": "Practice Failover for BCDR",
"waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "d1caa31f-cc26-42b2-b92f-2b667c0e6020",
- "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "Entra"
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Stretch Clustering",
- "text": "There is sub 5ms latency between each site if synchronous replication is being configured AAD",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Backup and Restore ",
+ "text": "Plan a backup strategy and take regular backups",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "3277558e-3155-4088-b49a-78594cb4ce1a",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
+ "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
+ "service": "Purview",
"services": [
- "Storage",
- "VNet"
+ "EventHubs"
],
- "severity": "High",
- "subcategory": "Stretch Clustering",
- "text": "Management, Replication and Storage networks excluded from stretched VLANs configurations, are routed, and in different subnets",
+ "severity": "Low",
+ "subcategory": "Purview Accounts Replications",
+ "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "baed6066-8531-44ba-bd94-38cbabbf4099",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
+ "link": "https://learn.microsoft.com/purview/deployment-best-practices",
+ "service": "Purview",
"services": [],
- "severity": "High",
- "subcategory": "Stretch Clustering",
- "text": "There is a plan detailed for site failure and recovery",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Data catalog",
+ "text": "Follow Purview accounts architectures and deployment best practices",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure Stack HCI Review",
- "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b4",
- "services": [
- "ACR"
- ],
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
+ "service": "Purview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Stretch Clustering",
- "text": "Separate vLANs and networks are used for each replication network across both sites",
+ "subcategory": "Data catalog",
+ "text": "Follow Collection Architectures and best practices",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b5",
- "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization",
- "services": [
- "Storage"
- ],
- "severity": "High",
- "subcategory": "Stretch Clustering",
- "text": "Use either a cloud witness or a file share witness in a third site for cluster quorum for clusters with less than 5 nodes",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
+ "service": "Purview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data catalog",
+ "text": "Follow Assest lifecycle best practices",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b6",
- "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
+ "service": "Purview",
"services": [],
- "severity": "High",
- "subcategory": "Stretch Clustering",
- "text": "When using data deduplication, only enable it on the primary/source volumes",
+ "severity": "Medium",
+ "subcategory": "Data catalog",
+ "text": "Follow automation best practices",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure Stack HCI Review",
- "guid": "ac527887-f6f4-40a3-b883-e04d704f013b",
- "link": "https://learn.microsoft.com/windows-server/storage/storage-replica/stretch-cluster-replication-using-shared-storage#provision-operating-system-features-roles-storage-and-network",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "Storage"
+ "Backup"
],
- "severity": "High",
- "subcategory": "Stretch Clustering",
- "text": "Storage backing log volumes must be faster (ideally) or at least as fast as capacity storage",
+ "severity": "Medium",
+ "subcategory": "Data catalog",
+ "text": "Follow Backup and Migration Best practices",
"waf": "Reliability"
},
{
- "category": "Backup and Disaster Recovery",
- "checklist": "Azure Stack HCI Review",
- "guid": "8ea49f70-1038-4283-b0c4-230165d3eabc",
- "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-site-recovery",
- "services": [
- "Backup",
- "ASR"
- ],
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
+ "service": "Purview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Azure Site Recovery has been considered for DR purposes",
- "waf": "Operations"
+ "subcategory": "Data catalog",
+ "text": "Follow Purview Glossary Best Practices",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Stack HCI Review",
- "guid": "03e65fdc-2628-4a1a-ba2e-a5174340ba52",
- "link": "https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
+ "link": "https://learn.microsoft.com/purview/concept-workflow",
+ "service": "Purview",
"services": [],
- "severity": "Medium",
- "subcategory": "Host",
- "text": "BitLocker has been enabled on CSVs for volume encryption, where appropriate",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Data catalog",
+ "text": "Leverage Workflows ",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Stack HCI Review",
- "guid": "9645d2e6-ba28-453c-b6d5-d9ef29fc34be",
- "link": "https://learn.microsoft.com/windows-server/storage/file-server/smb-security",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
+ "service": "Purview",
"services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "SMB encryption has been enabled, where appropriate",
- "waf": "Security"
+ "subcategory": "Data catalog",
+ "text": "Follow Purview Security Best Practices",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Stack HCI Review",
- "guid": "8f03437a-5068-4486-9a78-0402ce771298",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server",
- "services": [
- "Defender"
- ],
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
+ "service": "Purview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "Microsoft Defender Antivirus has been enabled on all nodes",
- "waf": "Security"
+ "subcategory": "Data Map",
+ "text": "Follow Purview Data Lineage Best Practices",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Stack HCI Review",
- "guid": "dba6b211-fc02-43b3-b7c8-f163c188332e",
- "link": "https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
+ "service": "Purview",
"services": [],
"severity": "Medium",
- "subcategory": "Host",
- "text": "Credential Guard has been configured, where appropriate",
- "waf": "Security"
+ "subcategory": "Data Map",
+ "text": "Follow Best Practices for Scanning Registered Sources",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
- "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
- "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
- "service": "ACR",
- "services": [
- "ACR"
- ],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Disable Azure Container Registry image export",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
+ "service": "Purview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Map",
+ "text": "Follow Classification Best Practices in Governance Portal",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
- "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
- "service": "ACR",
- "services": [
- "ACR",
- "AzurePolicy"
- ],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Enable Azure Policies for Azure Container Registry",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
+ "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
+ "service": "Purview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Map",
+ "text": "Perform Sensitivity Labelling in the Purview Data Map",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
- "guid": "d345293c-7639-4637-a551-c5c04e401955",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
- "service": "ACR",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
+ "link": "https://learn.microsoft.com/purview/concept-data-share",
+ "service": "Purview",
"services": [
- "ACR",
- "AKV"
+ "Storage"
],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Sign and Verify containers with notation (Notary v2)",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Data Sharing",
+ "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
- "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
- "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
- "service": "ACR",
- "services": [
- "ACR",
- "AKV"
- ],
- "severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Encrypt registry with a customer managed key",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Data Estate",
+ "text": "Leverage Data Estate Insights",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
- "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
- "services": [
- "ACR",
- "Entra",
- "RBAC"
- ],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Use Managed Identities to connect instead of Service Principals",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
+ "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
+ "service": "Purview",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Data Estate",
+ "text": "Use Data stewardship and Catalog adoption",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
- "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
- "services": [
- "ACR",
- "Entra",
- "RBAC"
- ],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Disable local authentication for management plane access",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Data Estate",
+ "text": "Use Inventory and Ownership",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
- "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
- "service": "ACR",
- "services": [
- "ACR",
- "Entra",
- "RBAC"
- ],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
+ "link": "https://learn.microsoft.com/purview/glossary-insights",
+ "service": "Purview",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Data Estate",
+ "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable anonymous pull/push access",
- "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
- "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
- "service": "ACR",
- "services": [
- "ACR",
- "Entra"
- ],
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
+ "link": "https://learn.microsoft.com/purview/compliance-manager",
+ "service": "Purview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Identity and Access Control",
- "text": "Disable Anonymous pull access",
- "waf": "Security"
+ "subcategory": "Data Quality ",
+ "text": "Generate assessment scores",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
- "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
- "service": "ACR",
- "services": [
- "ACR",
- "Entra"
- ],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Disable repository-scoped access tokens",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
+ "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
+ "service": "Purview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Quality ",
+ "text": "Profiling- get summaries of data content",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
- "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
- "service": "ACR",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
+ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
+ "service": "Purview",
"services": [
- "ACR",
- "Entra",
- "PrivateLink",
- "EventHubs"
+ "AzurePolicy"
],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Deploy images from a trusted environment",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Data Policy",
+ "text": "Follow Microsoft Purview Data Owner access policies",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
- "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
- "service": "ACR",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
+ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
+ "service": "Purview",
"services": [
- "ACR",
- "Entra",
"AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Identity and Access Control",
- "text": "Disable Azure ARM audience tokens for authentication",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Data Policy",
+ "text": "Follow Self-service access policies",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
- "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
- "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
- "service": "ACR",
+ "category": "Operations management",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
+ "link": "https://learn.microsoft.com/purview/concept-policies-devops",
+ "service": "Purview",
"services": [
- "ACR",
- "Monitor",
- "Entra"
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Logging and Monitoring",
- "text": "Enable diagnostics logging",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Data Policy",
+ "text": "Follow DevOps policies",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
- "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
+ "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
+ "service": "VMSS",
"services": [
- "ACR",
- "Firewall",
- "PrivateLink",
- "VNet"
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Network Security",
- "text": "Control inbound network access with Private Link",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "VM Scale Sets",
+ "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable public network access if inbound network access is secured using Private Link",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
+ "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
+ "service": "VM",
"services": [
- "ACR",
- "PrivateLink"
+ "Backup",
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Network Security",
- "text": "Disable Public Network access",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Virtual Machines",
+ "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only the ACR Premium SKU supports Private Link access",
- "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
+ "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "VM",
"services": [
- "ACR",
- "PrivateLink"
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Network Security",
- "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Virtual Machines",
+ "text": "Use Premium or Ultra disks for production VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
- "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
+ "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
+ "service": "VM",
"services": [
- "ACR",
- "Defender"
+ "VM"
],
- "severity": "Low",
- "subcategory": "Network Security",
- "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Virtual Machines",
+ "text": "Ensure Managed Disks are used for all VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
+ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
+ "service": "VM",
"services": [
- "ACR"
+ "SQL",
+ "Storage",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Vulnerability Management",
- "text": "Deploy validated container images",
- "waf": "Security"
+ "subcategory": "Virtual Machines",
+ "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
- "service": "ACR",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
+ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "VM",
"services": [
+ "Storage",
+ "VM",
"ACR"
],
- "severity": "High",
- "subcategory": "Vulnerability Management",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
- "waf": "Security"
- },
- {
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "65285269-440c-44be-9d3e-0844276d4bdc",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foudations-playbooks-ADB_v1.docx",
- "services": [],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Reference Databricks HA/DR playbook",
+ "severity": "Medium",
+ "subcategory": "Virtual Machines",
+ "text": "Leverage Availability Zones for your VMs in regions where they are supported",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "89d558b9-37d3-4974-b111-2dbd7aaf12e6",
- "link": "https://learn.microsoft.com/azure/databricks/security/secrets/secret-scopes",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
+ "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "VM",
"services": [
- "Backup"
+ "VM"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup Your Workspace Configuration including ARM templates and Secret Scopes",
+ "subcategory": "Virtual Machines",
+ "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
+ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "VM",
"services": [
- "ACR",
- "Backup"
+ "VM",
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "Backup",
- "text": "Share MetaData Across different Databricks Workspaces using Hive External Metastore",
+ "severity": "High",
+ "subcategory": "Virtual Machines",
+ "text": "Avoid running a production workload on a single VM",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "769e3969-0e78-428a-a936-657d03b0f466",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/disaster-recovery-strategy-in-azure-databricks-using-the-hive/ba-p/3684581",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
+ "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"services": [
- "Backup",
+ "VM",
+ "AVS",
"ASR"
],
- "severity": "Medium",
- "subcategory": "Backup",
- "text": "Plan Disaster Recovery Strategy in Databricks using the Hive External Metastore",
+ "severity": "High",
+ "subcategory": "Virtual Machines",
+ "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "4b1d944a-3598-437e-b79d-6c6d3a364a5b",
- "link": "https://www.databricks.com/blog/2021/04/20/attack-of-the-delta-clones-against-disaster-recovery-availability-complexity.html",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
+ "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
+ "service": "VM",
"services": [
- "Backup"
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup your data with deep and shallow clones",
+ "severity": "Low",
+ "subcategory": "Virtual Machines",
+ "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "description": "Download the blob using Secondary Endpoint in RAGRS Storage Account",
- "guid": "7abae48a-bd54-4cd7-ae2e-86768357c559",
- "link": "https://techcommunity.microsoft.com/t5/azure-paas-blog/download-the-blob-using-secondary-endpoint-in-ragrs-storage/ba-p/2403750",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
+ "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
+ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
+ "service": "VM",
"services": [
- "Storage",
- "Backup"
+ "ASR",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup your data to Azure Storage RA-GRS",
+ "subcategory": "Virtual Machines",
+ "text": "Increase quotas in DR region before testing failover with ASR",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "675c5ee8-5b85-49c7-944c-e3b1a28b875a",
- "link": "https://learn.microsoft.com/azure/databricks/dev-tools/index-ci-cd",
+ "category": "Compute",
+ "checklist": "Resiliency Review",
+ "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
+ "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
+ "service": "VM",
"services": [
- "Backup"
+ "VM"
],
- "severity": "High",
- "subcategory": "Backup",
- "text": "Backup your code with DevOps",
+ "severity": "Low",
+ "subcategory": "Virtual Machines",
+ "text": "Utilize Scheduled Events to prepare for VM maintenance",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "a1bf1038-9f03-4a4d-8ce4-63dbbbc8682a",
- "link": "https://learn.microsoft.com/azure/databricks/administration-guide/disaster-recovery",
+ "category": "Data",
+ "checklist": "Resiliency Review",
+ "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
+ "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"services": [
- "ASR"
+ "Storage"
],
- "severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Plan for Disaster recovery using Active/Active or Active/Passive Configuration",
+ "severity": "Medium",
+ "subcategory": "Storage Accounts",
+ "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "description": "Migration package to log all Databricks resources for backup and/or migrating to another Databricks workspace",
- "guid": "5abc92a4-eda1-4dae-8cc8-5c47c6b781cc",
- "link": "https://github.com/databrickslabs/migrate",
+ "category": "Data",
+ "checklist": "Resiliency Review",
+ "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
+ "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"services": [
- "Backup"
+ "Storage"
],
- "severity": "Medium",
- "subcategory": "Migration",
- "text": "Use Databricks Migration tools",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "DataBricks Review Checklist",
- "guid": "a0e6c465-89d5-458b-a37d-3974d1112dbd",
- "link": "https://github.com/databrickslabs/databricks-sync",
- "services": [],
"severity": "Low",
- "subcategory": "Migration",
- "text": "Use Databricks Sync",
+ "subcategory": "Storage Accounts",
+ "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "a96b96ad-8840-48f3-9273-4c876ba28021",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency",
+ "category": "Data",
+ "checklist": "Resiliency Review",
+ "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"services": [
- "DNS",
- "VNet"
+ "Storage"
],
- "severity": "High",
- "subcategory": "Azure Private DNS",
- "text": "Verify that Zones are linked to Vnets in multiple regions",
+ "severity": "Low",
+ "subcategory": "Storage Accounts",
+ "text": "Enable soft delete for Storage Account Containers",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "45901465-d38e-453f-accb-d969266acca2",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency",
+ "category": "Data",
+ "checklist": "Resiliency Review",
+ "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"services": [
- "DNS"
+ "Storage"
],
- "severity": "High",
- "subcategory": "Azure Private DNS",
- "text": "If different Zones are used between regions, verify a plan for making sure that Zones are up to date in a DR failover situation",
+ "severity": "Low",
+ "subcategory": "Storage Accounts",
+ "text": "Enable soft delete for blobs",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "74faa19b-f39d-495d-94c7-c8919ca1f6d5",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
+ "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "service": "Azure Backup",
"services": [
- "TrafficManager",
- "DNS",
- "ASR"
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Azure DNS",
- "text": "Plan for disaster recovery with Azure DNS and Traffic Manager",
+ "subcategory": "Backup",
+ "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "315ae524-ba34-4d45-a5e1-2139bd7bb012",
- "link": "https://learn.microsoft.com/azure/dns/private-resolver-reliability#availability-zones",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
+ "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
+ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
+ "service": "Azure Backup",
"services": [
- "DNS"
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Azure DNS Resolver",
- "text": "Enable availability zones with Private Resolver",
+ "severity": "Low",
+ "subcategory": "Backup",
+ "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "f7b95e06-e154-4e2a-a359-2828e6e20517",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "services": [
- "DNS",
- "ASR"
- ],
- "severity": "Medium",
- "subcategory": "Azure DNS Resolver",
- "text": "Plan for failover with Private Resolvers in a Disaster Recovery",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "2676ae46-691e-4883-9ad9-42223e138105",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph",
- "services": [
- "DNS",
- "VM"
- ],
- "severity": "Medium",
- "subcategory": "VM Based DNS Service",
- "text": "Follow VM Guidance for resillency of VM",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "DNS Review Checklist",
- "guid": "23081a94-1741-4583-9ff7-ad7c6d373316",
- "link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
+ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
+ "service": "Azure Backup",
"services": [
- "DNS",
- "Entra",
- "VM"
+ "Backup",
+ "Storage"
],
- "severity": "Medium",
- "subcategory": "VM Based DNS Service",
- "text": "IF AD based DNS, follow the Identity -> Windows Server AD path",
+ "severity": "Low",
+ "subcategory": "Backup",
+ "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
- "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
- "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
- "service": "ACR",
- "services": [
- "WAF",
- "ACR"
- ],
- "severity": "High",
- "text": "Disable Azure Container Registry image export",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
- "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
- "service": "ACR",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Clearly define your organization's business continuity and disaster recovery requirements for your Azure environment. This includes identifying the critical applications, data, and services that need to be protected, as well as specifying the desired recovery objectives and strategies.",
+ "guid": "72e52e36-11dd-458c-9a4b-1521e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-business-continuity-disaster-recovery",
"services": [
- "WAF",
- "ACR",
- "AzurePolicy"
+ "ASR"
],
"severity": "High",
- "text": "Enable Azure Policies for Azure Container Registry",
- "waf": "Security"
+ "subcategory": "Design",
+ "text": "Define business continuity and disaster recovery requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
- "guid": "d345293c-7639-4637-a551-c5c04e401955",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
- "service": "ACR",
- "services": [
- "WAF",
- "ACR",
- "AKV"
- ],
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Ensure that your Azure architectures are designed with a focus on reliability. Consider implementing fault-tolerant mechanisms, redundancy, and resiliency patterns to minimize the impact of failures and maximize the availability of your applications and services.",
+ "guid": "c2399c4d-7b67-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/architecture/reliability/architect",
+ "services": [],
"severity": "High",
- "text": "Sign and Verify containers with notation (Notary v2)",
- "waf": "Security"
+ "subcategory": "Design",
+ "text": "Implement reliability best practices in Azure architectures",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
- "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
- "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
- "service": "ACR",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "IaC configurations can play a role in your disaster recovery plan, particularly in situations where recovery time is not time-sensitive. In the event of infrastructure recreation in a second region, IaC can be used to reproduce the necessary infrastructure.",
+ "guid": "fe237de2-43b1-46c3-8d7a-a9b7570449aa",
+ "link": "https://learn.microsoft.com/azure/well-architected/devops/automation-infrastructure",
"services": [
- "WAF",
- "ACR",
- "AKV"
+ "ASR",
+ "RBAC"
],
"severity": "Medium",
- "text": "Encrypt registry with a customer managed key",
- "waf": "Security"
+ "subcategory": "DevOps",
+ "text": "Implement Infrastructure as Code (IaC) for Rapid Infrastructure Recovery",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
- "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "category": "General",
+ "checklist": "Resiliency Review",
+ "description": "Azure offers region pairs that are geographically separated and can be used for cross-region replication and disaster recovery. These region pairs provide redundancy and protection against regional or large-scale disasters.",
+ "guid": "dcb1f7d5-769a-4e56-aba3-8d4a85e2213d",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
"services": [
- "WAF",
- "ACR",
- "Entra",
- "RBAC"
+ "ASR"
],
- "severity": "High",
- "text": "Use Managed Identities to connect instead of Service Principals",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Multi-region",
+ "text": "Plan for cross-region recovery by leveraging region pairs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
- "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "By deploying an Application Gateway with a minimum instance count of two, you will have at least two instances available under normal circumstances. In the event that one of the instances encounters a problem, the other instance will handle the traffic while a new instance is being created. This approach significantly reduces the risk of service disruption and ensures a seamless experience for your users.",
+ "guid": "93c76286-37a5-451c-9b04-e4f1854387e5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant#autoscaling-and-high-availability",
"services": [
- "WAF",
- "RBAC"
+ "AppGW"
],
- "severity": "High",
- "text": "Disable local authentication for management plane access",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Application Gateways",
+ "text": "Deploy Application Gateways with a minimum instance count of 2 to avoid instance provisioning downtime",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
- "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "The v2 SKU offers several advantages and critical new features that enhance the availability and resilience of your application infrastructure. One notable feature supported by the v2 SKU is zone redundancy, which allows an Application Gateway deployment to span multiple Availability Zones.",
+ "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
"services": [
- "WAF",
- "ACR",
- "Entra",
- "RBAC"
+ "AppGW",
+ "Storage"
],
"severity": "High",
- "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
- "waf": "Security"
+ "subcategory": "Application Gateways",
+ "text": "Deploy Azure Application Gateway v2 for zone redundancy support",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Disable anonymous pull/push access",
- "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
- "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "Azure Front Door provides automatic failover capabilities, ensuring continuity in the event of a primary region becoming unavailable. However, during the failover process, there may be a brief period (typically 20-60 seconds) when clients cannot reach the application. It is essential to review the Azure Front Door service level agreement (SLA) to determine whether relying solely on Front Door meets your business requirements for high availability. ",
+ "guid": "97e31c67-d68c-4f6a-92a1-194956d697dc",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/multi-region#azure-front-door",
"services": [
- "WAF"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Disable Anonymous pull access",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Azure Front Door",
+ "text": "Consider a redundant traffic management solution in conjunction with Azure Front Door",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
- "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "By implementing Traffic Manager, you can configure it to continuously monitor the health of your application endpoints and automatically redirect traffic to an alternate endpoint when necessary. This automation minimizes downtime and provides a more seamless experience for your users during disaster recovery scenarios.",
+ "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a",
+ "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager",
"services": [
- "WAF",
- "Entra"
+ "TrafficManager",
+ "DNS",
+ "ASR",
+ "Monitor"
],
- "severity": "High",
- "text": "Disable repository-scoped access tokens",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "DNS",
+ "text": "Plan for automated failover using Traffic Manager for DNS Traffic",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
- "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
+ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
+ "service": "DNS",
"services": [
- "WAF",
+ "DNS",
"ACR",
- "PrivateLink",
- "EventHubs"
+ "ASR"
],
- "severity": "High",
- "text": "Deploy images from a trusted environment",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "DNS",
+ "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
- "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
+ "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
+ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
+ "service": "Data Gateways",
"services": [
- "WAF",
- "ACR",
- "Entra",
- "AzurePolicy"
+ "ACR"
],
"severity": "Medium",
- "text": "Disable Azure ARM audience tokens for authentication",
- "waf": "Security"
+ "subcategory": "Data Gateways",
+ "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
- "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
- "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "When using ExpressRoute, it's important to design for high availability by incorporating redundancy in both the partner and customer networks. This can include multiple ExpressRoute circuits, redundant connections from your network to Microsoft, and ensuring your on-premises network equipment has redundant connections.",
+ "guid": "c0e7c28d-c936-4657-802b-ff4564b0d934",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
"services": [
- "WAF",
- "ACR",
- "Monitor",
- "Entra"
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Enable diagnostics logging",
- "waf": "Security"
+ "subcategory": "ExpressRoute",
+ "text": "Ensure redundancy within both the partner network and customer network when utilizing ExpressRoute for high availability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
- "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "The primary circuit should handle regular traffic while the backup circuit stays ready to take over if the primary circuit fails. Utilize BGP attributes to influence routing and designate your primary and backup circuits effectively.",
+ "guid": "a359c373-e7dd-4616-83a3-64a907ebae48",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
"services": [
- "WAF",
- "Firewall",
- "PrivateLink",
- "VNet"
+ "Backup",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Control inbound network access with Private Link",
- "waf": "Security"
+ "subcategory": "ExpressRoute",
+ "text": "When using multiple ExpressRoute circuits ensure that routing allows for a primary and backup",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Disable public network access if inbound network access is secured using Private Link",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "S2S VPN connection can provide a cost-effective, resilient backup solution in the event of an ExpressRoute circuit failure. By using S2S VPN as a failover, you can maintain connectivity to your Azure resources without relying solely on ExpressRoute.",
+ "guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d",
+ "link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
"services": [
- "WAF",
- "PrivateLink"
+ "VPN",
+ "Backup",
+ "Cost",
+ "ExpressRoute"
],
- "severity": "Medium",
- "text": "Disable Public Network access",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "ExpressRoute",
+ "text": "Consider deploying site-to-site VPN as a backup for your ExpressRoute private peering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Only the ACR Premium SKU supports Private Link access",
- "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "Standard Load Balancer SKU offers an SLA of 99.99% and a higher level of service availability compared to the Basic Load Balancer SKU.",
+ "guid": "778468d5-5a78-45d6-be96-c96ad8844cf3",
+ "link": "https://learn.microsoft.com/azure/load-balancer/skus",
"services": [
- "WAF",
- "ACR",
- "PrivateLink"
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
- "waf": "Security"
+ "subcategory": "Load Balancers",
+ "text": "Leverage the Standard SKU for Load Balancers that handle traffic to production applications",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
- "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "By configuring the load balancer with a zone-redundant frontend, it can serve zonal resources in any zone with a single IP address. As long as at least one zone remains healthy within the region, the IP address associated with the frontend can survive one or more zone failures. It is recommended to have multiple zonal resources, such as virtual machines from different zones, in the backend pool of the load balancer. ",
+ "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
"services": [
- "WAF",
- "ACR",
- "Defender"
+ "VM",
+ "LoadBalancer"
],
"severity": "Low",
- "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
- "waf": "Security"
+ "subcategory": "Load Balancers",
+ "text": "For load balancers, consider using a zone-redundant frontend with multiple zonal resources in the backend",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "When designing health probes for your Azure Load Balancer, it is important to follow best practices to ensure reliable and accurate monitoring of your backend instances.",
+ "guid": "dccbd979-2a6b-4cca-8b5f-ea1ebf3dd95d",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview#design-guidance",
"services": [
- "WAF"
+ "Monitor",
+ "LoadBalancer"
],
- "severity": "Medium",
- "text": "Deploy validated container images",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Load Balancers",
+ "text": "Select the right protocol, appropriate intervals and timeouts, representative paths and probe responses when defining Load Balancer Health Probes",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
- "service": "ACR",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
+ "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"services": [
- "WAF"
+ "NVA"
],
"severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
- "waf": "Security"
+ "subcategory": "NVAs",
+ "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
- "service": "Azure Service Fabric",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "By deploying VPN Gateways in an active-active mode, you can distribute VPN traffic across multiple gateways, improving reliability and ensuring continuous connectivity in case of failures or maintenance.",
+ "guid": "927139b8-2110-42db-b6ea-f11e6f843e53",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
"services": [
- "WAF"
+ "VPN",
+ "ACR"
],
"severity": "Medium",
- "text": "Use Standard SKU for production scenarios.",
+ "subcategory": "VPN Gateways",
+ "text": "Deploy Azure VPN Gateways in an active-active mode to ensure high availability and redundancy for your VPN connections.",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
- "service": "Azure Service Fabric",
+ "category": "Network",
+ "checklist": "Resiliency Review",
+ "description": "Zone-redundant SKUs ensure that your VPN gateways are physically and logically separated within a region, providing resiliency and scalability. This deployment configuration safeguards your on-premises network connectivity to Azure from zone-level failures.",
+ "guid": "f4722d92-8c1b-41cd-921f-54b29b9de39a",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/about-zone-redundant-vnet-gateways",
"services": [
- "WAF",
- "VM"
+ "VPN"
],
"severity": "Medium",
- "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
+ "subcategory": "VPN Gateways",
+ "text": "Use zone-redundant SKUs when deploying VPN Gateways to enhance resilience and protect against zone-level failures",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
- "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "Define a resource group structure for placement of Azure Arc-enabled servers resources",
+ "guid": "585e1112-9bd7-4ba0-82f7-b94ef6e043d2",
"services": [
- "WAF",
- "ACR"
+ "Arc"
],
- "severity": "Medium",
- "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Capacity Planning",
+ "text": "One or more resource groups is required for onboarding servers into Azure",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "guid": "aa359271-8e6e-4205-8725-769e46691e88",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits",
"services": [
- "WAF",
- "APIM"
+ "Entra",
+ "Arc"
],
"severity": "Medium",
- "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
- "waf": "Reliability"
+ "subcategory": "Capacity Planning",
+ "text": "Take Azure Active Directory object limitations into account",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "The following resource providers needs to be registered: Microsoft.HybridCompute, Microsoft.GuestConfiguration, Microsoft.HybridConnectivity",
+ "guid": "deace4bb-1deb-44c6-9fc3-fc14eeaa3692",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-resource-providers",
"services": [
- "WAF"
+ "Subscriptions",
+ "Arc"
],
- "severity": "Medium",
- "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "General",
+ "text": "Has the Resource providers required been registered in all subscriptions",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
- "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
- "service": "Azure Service Fabric",
- "services": [
- "WAF",
- "VM"
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "Aligning with an existing or creating an Azure tagging strategy is recommended. Resource tags allow you to quickly locate it, automate operational tasks amd more. ",
+ "guid": "c6d37331-65c7-4acb-b44b-be609d79f2e8",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/",
+ "services": [
+ "Arc"
],
- "severity": "Medium",
- "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
+ "severity": "Low",
+ "subcategory": "General",
+ "text": "Has a tagging strategy for Azure Arc-enabled servers been defined",
"waf": "Cost"
},
{
- "checklist": "WAF checklist",
- "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "Installation of the connected machine agent is supported on most newer Windows and Linux operative systems, review the link to se the latest list",
+ "guid": "7778424c-5167-475c-9fa9-5b96ad88408e",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#supported-operating-systems",
"services": [
- "WAF",
- "VM"
+ "Arc"
],
- "severity": "Medium",
- "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "General",
+ "text": "What operating systems need to be Azure Arc-enabled",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "There are software requirements to the agent installation. Some might require a system reboot after installation, review to link",
+ "guid": "372734b8-76ba-428f-8145-901365d38e53",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#software-requirements",
"services": [
- "WAF"
+ "Arc"
],
- "severity": "Medium",
- "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "General",
+ "text": "Are required software installed on Windows and Linux servers to support the installation",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "guid": "d44c7c89-19ca-41f6-b521-5ae514ba34d4",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/?products=azure-arc®ions=all",
"services": [
- "WAF",
- "APIM",
- "VNet"
+ "Arc"
],
- "severity": "Medium",
- "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "General",
+ "text": "Make sure to use a supported Azure region",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
- "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "category": "Foundation",
+ "checklist": "Azure Arc Review",
+ "description": "The scope include organization into management groups, subscriptions, and resource groups.",
+ "guid": "f9ccbd86-8266-4abc-a264-f9a19bf39d95",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/organize-inventory-servers#organize-resources-with-built-in-azure-hierarchies",
+ "services": [
+ "Subscriptions",
+ "Arc"
+ ],
+ "severity": "Low",
+ "subcategory": "Organization",
+ "text": "Define the structure for Azure management of resources",
+ "waf": "Performance"
+ },
+ {
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "Define RBAC rules to the servers / resource groups as required for servers management, the 'Azure Connected Machine Resource Administrator' or 'Hybrid Server Resource Administrator' role would be sufficient for management of the Azure Arc-enabled servers resources in Azure",
+ "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control",
"services": [
- "Storage",
- "VM",
- "WAF",
"Entra",
- "AKV"
+ "Arc",
+ "RBAC"
],
"severity": "Medium",
- "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
+ "subcategory": "Access",
+ "text": "Assign RBAC rights to Azure AD user/group access for managing Azure Arc-enabled servers",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "001cbb6f-d88d-4431-8434-d01333397776",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e",
+ "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad",
"services": [
- "WAF"
+ "AKV",
+ "Entra",
+ "Arc"
],
- "severity": "Medium",
- "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "severity": "Low",
+ "subcategory": "Access",
+ "text": "Consider using managed identities for applications to access Azure resources like Key Vault example in link",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "An Azure subscription must be parented to the same Azure AD tenant",
+ "guid": "35ac9322-23e1-4380-8523-081a94174158",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits",
"services": [
- "WAF",
- "ACR"
+ "Entra",
+ "Subscriptions",
+ "Arc"
],
- "severity": "Medium",
- "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Requirements",
+ "text": "An Azure Active Directory tenant must be available with at least one subscription",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
- "link": "",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "Users (or SPs) need the 'Azure Connected Machine Onboarding' or 'Contributor' role to onboarding of servers",
+ "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions",
"services": [
- "WAF"
+ "Entra",
+ "Arc",
+ "RBAC"
],
"severity": "Medium",
- "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "subcategory": "Requirements",
+ "text": "Define which users (AAD user/groups) has access to onboard Azure Arc-enabled servers",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
- "link": "",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "Ensure to only add the rights to users or groups that is required to perform their role",
+ "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale",
"services": [
- "WAF",
- "AKV"
+ "Entra",
+ "Arc",
+ "RBAC"
],
"severity": "Medium",
- "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
+ "subcategory": "Security",
+ "text": "Use the principle of least privileged",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "A service principle with the 'Azure Connected Machine Onboarding' role is required for at-scale onboarding of servers, consider more SP's if onboarding is done by different teams/decentralized management",
+ "guid": "ad88408e-3727-434b-a76b-a28f21459013",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale",
"services": [
- "WAF",
- "Entra"
+ "Entra",
+ "Arc",
+ "RBAC"
],
"severity": "Medium",
- "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
+ "subcategory": "Security",
+ "text": "How many Service Principals are needed for onboarding Arc-enabled servers into Azure",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
- "service": "Azure Service Fabric",
+ "category": "Identity",
+ "checklist": "Azure Arc Review",
+ "description": "Consider assigning the rights for the 'Azure Connected Machine Onboarding' role at the resource group level, to control the resource creation",
+ "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions",
"services": [
- "WAF"
+ "Entra",
+ "Arc",
+ "RBAC"
],
"severity": "Medium",
- "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "subcategory": "Security",
+ "text": "Limit the rights to onboard Azure Arc-enabled servers to the desired resource groups",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Plan for agent deployments at scale",
+ "guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment",
"services": [
- "WAF",
- "AppGW"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "Ensure you are using Application Gateway v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Management",
+ "text": "Define a strategy for agent provisioning",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Use Microsoft Update to ensure that the connected machine agent is always up-to-date",
+ "guid": "c78e1d76-6673-457c-9496-74c5ed85b859",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent",
"services": [
- "WAF",
- "LoadBalancer"
+ "Monitor",
+ "Arc"
],
- "severity": "Medium",
- "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Management",
+ "text": "Define a strategy for agent updates",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "WAF checklist",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Recommendation is to use Azure Policy, or another automation tool like Azure DevOps - important is to avoid configuration drift.",
+ "guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions",
"services": [
- "WAF",
- "LoadBalancer"
+ "Monitor",
+ "Arc",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
- "waf": "Security"
+ "subcategory": "Management",
+ "text": "Define a strategy for extension installation",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Use automatic upgrades where available and define an update strategy for all extensions not supporting automatic upgrades.",
+ "graph": "resources | where type =~ 'microsoft.hybridcompute/machines/extensions'| extend compliant = (properties.enableAutomaticUpgrade == 'true') | distinct id, compliant",
+ "guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal",
"services": [
- "WAF",
- "AppGW",
- "VNet"
+ "Monitor",
+ "Arc"
],
- "severity": "Medium",
- "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Management",
+ "text": "Define a strategy for extension updates",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Azure Automanage help implement Microsoft best-practices for servers management in Azure",
+ "guid": "7a927c39-74d1-4102-aac6-aae01e6a84de",
+ "link": "https://learn.microsoft.com/azure/automanage/automanage-arc",
"services": [
- "NVA",
- "WAF",
- "Entra",
- "AppGW",
- "Subscriptions",
- "VNet"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Management",
+ "text": "Consider using Azure Automanage to control settings and avoid configuration drift on servers",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
"services": [
- "WAF",
- "DDoS"
+ "Monitor",
+ "Arc"
],
- "severity": "Medium",
- "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Monitor for unresponsive agents",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected",
"services": [
- "WAF"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "Configure autoscaling with a minimum amount of instances of two.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Design a monitoring strategy to send metrics and logs to an Log Analytics workspace",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "guid": "92881b1c-d5d1-4e54-a296-59e3958fd782",
+ "link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide",
"services": [
- "WAF",
- "ACR",
- "AppGW"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "Deploy Application Gateway across Availability Zones",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Use notification in Activity logs to receive notification on unexpected changes to the resources",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "WAF checklist",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "guid": "89c93555-6d02-4bfe-9564-b0d834a34872",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor for compliance and operational monitoring",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "WAF checklist",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
"services": [
- "WAF",
- "TrafficManager"
+ "Monitor",
+ "Arc"
],
- "severity": "High",
- "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Create an alert to identify Azure Arc-enabled servers that aren't using the latest version of the Azure connected machine agent",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Arc Review",
+ "description": "Use Update Management in Azure Automation or the new Update Management Center (preview) functionality to ensure update management of servers",
+ "guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management",
"services": [
- "WAF",
- "AVD",
- "Entra"
+ "Monitor",
+ "Arc"
],
"severity": "Low",
- "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Security"
+ "subcategory": "Security",
+ "text": "Use Azure Arc-enabled servers to control software updates deployments to servers",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "The Connected Machine Agent will by default communicate with Azure services over public Internet connectivity using HTTPS (TCP port 443)",
+ "guid": "f6e043d2-aa35-4927-88e6-e2050725769e",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#details",
"services": [
- "WAF",
- "Entra"
+ "Arc"
],
- "severity": "Medium",
- "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Define a connectivity method from the server to Azure",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "The Connected Machine Agent can be configured to use a proxy server, it is recommended to define the proxy server address using 'azcmagent config set proxy.url' command on the local system.",
+ "guid": "46691e88-35ac-4932-823e-13800523081a",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#update-or-remove-proxy-settings",
"services": [
- "WAF",
- "LoadBalancer"
+ "Arc"
],
- "severity": "High",
- "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Is a proxy server a required for communication over the Public Internet",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "The Connected Machine Agent can use a Private Link for communication with Azure Services over an existing ExpressRoute or VPN connection",
+ "guid": "94174158-33ee-47ad-9c6d-3733165c7acb",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security",
"services": [
- "WAF",
- "AppGW"
+ "VPN",
+ "PrivateLink",
+ "Arc",
+ "ExpressRoute"
],
- "severity": "High",
- "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Is a private (not public Internet) connection required?",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "Firewall configuration might be required for the agent to communicate with Azure, use the link to see ServiceTags and/or URL's required",
+ "guid": "e44bbe60-9d79-4f2e-a777-8424c516775c",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#service-tags",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy"
+ "Arc"
],
"severity": "High",
- "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
+ "subcategory": "Networking",
+ "text": "Will Firewall configurations be needed in order to ensure communication with Azure Services?",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "Use available automation tool for the system in question to regularly update the Azure endpoints",
+ "guid": "6fa95b96-ad88-4408-b372-734b876ba28f",
+ "link": "https://www.microsoft.com/download/details.aspx?id=56519",
"services": [
- "WAF",
- "AppGW"
+ "Arc"
],
- "severity": "High",
- "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "severity": "Low",
+ "subcategory": "Networking",
+ "text": "Can the Firewall or Proxy rules be automated updated if Service Tags or IP addresses change",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "Configure Servers to use Transport Layer Security (TLS) version 1.2",
+ "guid": "21459013-65d3-48e5-9f9c-cbd868266abc",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#transport-layer-security-12-protocol",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy"
+ "Arc"
],
"severity": "High",
- "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
- "services": [
- "WAF",
- "AppGW"
- ],
- "severity": "Medium",
- "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
- "services": [
- "WAF",
- "AppGW"
- ],
- "severity": "Medium",
- "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "subcategory": "Networking",
+ "text": "Always use secure communication for Azure where possible",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
+ "category": "Networking",
+ "checklist": "Azure Arc Review",
+ "description": "All extensions (like log analytics etc.) have separate network requirements, be sure to include all in the network design.",
+ "guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method",
"services": [
- "WAF"
+ "PrivateLink",
+ "Monitor",
+ "Arc"
],
"severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "subcategory": "Networking",
+ "text": "Include communication for Azure Arc-enabled Servers extensions in the design (firewall/proxy/private link)",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "ac6aae01-e6a8-44de-9df4-7d2d92881b1c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/",
"services": [
- "WAF",
- "AppGW"
+ "AzurePolicy",
+ "Arc"
],
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "subcategory": "Management",
+ "text": "Use Azure Policy to implement a governance model for hybrid connected servers",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "5c2a3649-4b69-4bad-98aa-d53cc78e1d76",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
"services": [
- "WAF",
- "AppGW"
+ "Arc"
],
"severity": "Medium",
- "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
- "waf": "Security"
+ "subcategory": "Management",
+ "text": "Consider using Machine configurations for in guest OS configurations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "667357c4-4967-44c5-bd85-b859c7733be2",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/machine-configuration-create",
"services": [
- "WAF",
- "AppGW"
+ "AzurePolicy",
+ "Arc"
],
"severity": "Medium",
- "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
+ "subcategory": "Management",
+ "text": "Evaluate the need for custom Guest Configuration policies",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "49674c5e-d85b-4859-a773-3be2a1a27b77",
+ "link": "https://learn.microsoft.com/azure/automation/change-tracking/overview",
"services": [
- "WAF",
- "Sentinel",
- "AppGW"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
- "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "subcategory": "Monitoring",
+ "text": "Consider using change tracking for tracking changes made on the servers",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "d5d1e54a-2965-49e3-a58f-d78289c93555",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/data-residency",
"services": [
- "WAF",
- "AppGW"
+ "Arc"
],
"severity": "Medium",
- "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "subcategory": "Requirements",
+ "text": "Make sure to use an Azure region for storing the metadata approved by the organization",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "Arc"
],
"severity": "Medium",
- "text": "Use WAF Policies instead of the legacy WAF configuration.",
- "waf": "Operations"
+ "subcategory": "Secrets",
+ "text": "Use Azure Key Vault for certificate management on servers",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "description": "Consider using a short-lived Azure AD service principal client secrets.",
+ "guid": "6d02bfe4-564b-40d8-94a3-48726ee79d6b",
+ "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret",
"services": [
- "VPN",
- "WAF",
- "ExpressRoute",
- "AppGW",
- "VNet"
+ "AKV",
+ "Entra",
+ "Storage",
+ "Arc"
],
- "severity": "Medium",
- "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "What is the acceptable life time of the secret used by SP's",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "description": "A private key is saved to the disk, ensure this is protected using disk encryption",
+ "guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption",
"services": [
- "WAF"
+ "AKV",
+ "Arc"
],
- "severity": "High",
- "text": "You should encrypt traffic to the backend servers.",
+ "severity": "Medium",
+ "subcategory": "Secrets",
+ "text": "Secure the public key for Azure Arc-enabled Servers",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "description": "Local administrator is required to install the Connected Machine Agent on Windows and Linux systems",
+ "guid": "29659e39-58fd-4782-a9c9-35556d02bfe4",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-portal#install-manually",
"services": [
- "WAF"
+ "Arc"
],
"severity": "High",
- "text": "You should use a Web Application Firewall.",
+ "subcategory": "Security",
+ "text": "Ensure there is local administrator access for executing the agent installation",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "description": "Members of the local administrator group on Windows and users with root privileges on Linux, have permissions to manage the agent via command line.",
+ "guid": "564b0d83-4a34-4872-9ee7-9d6b5c2a3649",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#agent-security-and-permissions",
"services": [
- "WAF"
+ "Arc"
],
"severity": "Medium",
- "text": "Redirect HTTP to HTTPS",
+ "subcategory": "Security",
+ "text": "Limit the amount of users with local administrator rights to the servers",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication",
"services": [
- "WAF"
+ "Entra",
+ "Arc"
],
"severity": "Medium",
- "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
- "waf": "Operations"
+ "subcategory": "Security",
+ "text": "Consider using and restricting access to managed identities for applications.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "description": "Use Defender for Endpoint or another AV and EDR solution to protect endpoints",
+ "guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868",
+ "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started",
"services": [
- "WAF"
+ "Defender",
+ "Arc"
],
- "severity": "High",
- "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Enable Defender for Servers for all servers to secure hybrid workloads from threats",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "cbafe6c4-6589-4d45-9a92-7c3974d1102c",
"services": [
- "WAF"
+ "Arc"
],
- "severity": "Low",
- "text": "Create custom error pages to display a personalized user experience",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Define controls to detect security misconfigurations and track compliance",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
+ "category": "Security, Governance and Compliance",
+ "checklist": "Azure Arc Review",
+ "guid": "cbbbc868-195a-4bb9-8a4e-d90dae2cc84c",
+ "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#extension-allowlists-and-blocklists",
"services": [
- "WAF"
+ "Arc"
],
"severity": "Medium",
- "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "subcategory": "Security",
+ "text": "Use allow- or block-lists to control what extensions can be installed on the Azure Arc-enabled servers",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "FrontDoor"
+ "Storage"
],
"severity": "Medium",
- "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
- "waf": "Performance"
+ "subcategory": " Overview",
+ "text": "Consider the 'Azure security baseline for storage'",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "PrivateLink",
+ "Storage"
],
- "severity": "Medium",
- "text": "Use transport layer load balancing",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Consider using private endpoints for Azure Storage",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage",
+ "Subscriptions",
+ "RBAC"
],
"severity": "Medium",
- "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "subcategory": "Governance",
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "Entra"
+ "Defender",
+ "Storage"
],
- "severity": "Medium",
- "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "AppGW"
+ "Storage"
],
- "severity": "Low",
- "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
+ "severity": "Medium",
+ "subcategory": "Data Availability",
+ "text": "Enable 'soft delete' for blobs",
"waf": "Security"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "WAF checklist",
- "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
- "service": "PostgreSQL",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Leverage Flexible Server",
- "waf": "Reliability"
+ "subcategory": "Confidentiality",
+ "text": "Disable 'soft delete' for blobs",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "WAF checklist",
- "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
- "service": "PostgreSQL",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
- "waf": "Reliability"
+ "subcategory": "Data Availability",
+ "text": "Enable 'soft delete' for containers",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "WAF checklist",
- "guid": "31b67c67-be59-4519-8083-845d587cb391",
- "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
- "service": "PostgreSQL",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Leverage cross-region read replicas for BCDR",
- "waf": "Reliability"
+ "subcategory": "Confidentiality",
+ "text": "Disable 'soft delete' for containers",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
- "severity": "Medium",
- "text": "Leverage FTA HandBook for Cognitive Services",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Data Availability",
+ "text": "Enable resource locks on storage accounts",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "Backup"
+ "Storage",
+ "Subscriptions",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Backup Your Prompts",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Data Availability, Compliance",
+ "text": "Consider immutable blobs",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "ASR"
+ "Storage"
],
"severity": "High",
- "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
- "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "Backup"
+ "Storage"
],
- "severity": "Medium",
- "text": "Backup Your ChatGPT conversations",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
- "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "CI/CD for custom speech",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "3687a046-7a1f-4893-9bda-43324f248116",
- "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
- "service": "Cognitive Services",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
- "severity": "Low",
- "text": "Move a knowledge base using export-import",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage"
],
"severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "Use Microsoft Entra ID tokens for blob access",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage",
+ "RBAC"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity and Access Management",
+ "text": "Least privilege in IaM permissions",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "services": [
+ "Entra",
+ "Storage"
],
"severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "AKV",
+ "Entra",
+ "Storage",
+ "Monitor"
],
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "AppSvc"
+ "AKV",
+ "Storage",
+ "AzurePolicy",
+ "Monitor"
],
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "AKV",
+ "Entra",
+ "Storage",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "subcategory": "Identity and Access Management",
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Select the right Function hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider configuring an SAS expiration policy",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "AKV",
+ "Entra",
+ "Storage",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider linking SAS to a stored access policy",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "AKV",
+ "Storage"
],
"severity": "Medium",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "subcategory": "CI/CD",
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "AppSvc"
+ "Entra",
+ "Storage"
],
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "AppSvc"
+ "Entra",
+ "Storage",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "Strive for short validity periods for ad-hoc SAS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "WAF",
+ "Entra",
"Storage"
],
"severity": "Medium",
- "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "Apply a narrow scope to a SAS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage"
],
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
- "waf": "Operations"
+ "subcategory": "Identity and Access Management",
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage"
],
- "severity": "Medium",
- "text": "FTA Resiliency Playbook",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage",
+ "RBAC"
],
"severity": "High",
- "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Entra",
+ "Storage"
],
"severity": "Medium",
- "text": "Run multiple replicas of the database (>1 ) in Prod",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Management",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
- "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "ACR"
+ "Storage",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Leverage Multi-Region Writes",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Avoid overly broad CORS policies",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Span Cosmos account across two or more regions with multi-region writes",
- "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "ACR"
+ "Storage"
],
- "severity": "Medium",
- "text": "Distribute your data globally",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
- "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
- "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage"
],
- "severity": "High",
- "text": "Choose from several well-defined consistency models",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine which/if platform encryption should be used.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
- "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
- "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
- "service": "CosmosDB",
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "CosmosDB"
+ "Storage"
],
"severity": "Medium",
- "text": "Enable Service managed failover",
- "waf": "Reliability"
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine which/if client-side encryption should be used.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
- "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
- "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
- "service": "CosmosDB",
- "services": [
- "WAF",
- "CosmosDB",
- "Storage",
- "Backup"
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "services": [
+ "Entra",
+ "Storage"
],
- "severity": "Medium",
- "text": "Enable Automatic Backups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "severity": "High",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
+ "waf": "Security"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "services": [
+ "Storage"
+ ],
+ "severity": "High",
+ "subcategory": "Platform Version",
+ "text": "Leverage a storagev2 account type for better performance and reliability",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
- "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
- "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
- "service": "CosmosDB",
+ "category": "BC and DR",
+ "checklist": "Azure Storage Review Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "Backup"
+ "Storage"
],
- "severity": "Medium",
- "text": "Perform Periodic Backups",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "severity": "High",
+ "subcategory": "Availablity",
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
- "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
- "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
- "service": "CosmosDB",
+ "category": "BC and DR",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "CosmosDB",
- "Backup"
+ "Storage"
],
"severity": "Medium",
- "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "subcategory": "Failover",
+ "text": "For write operation after failover, use customer-Managed Failover ",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
+ "category": "Operations Management",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "EventHubs"
+ "Storage"
],
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Failover",
+ "text": "Understand Microsoft-Managed Failover details",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
+ "category": "Operations Management",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"services": [
- "WAF",
- "EventHubs"
+ "Storage"
],
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Security"
+ "subcategory": "Data Protection",
+ "text": "Enable Soft Delete",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "When you are creating a SQL Server on Azure VM, carefully consider the type of workload necessary. If you are migrating an existing environment, collect a performance baseline to determine your SQL Server on Azure VM requirements. If this is a new VM, then create your new SQL Server VM based on your vendor requirements.",
+ "guid": "1fc3fc14-eea6-4e69-b8d9-a3eec218e687",
+ "link": "https://learn.microsoft.com/sql/dma/dma-sku-recommend-sql-db?view=sql-server-ver16",
"services": [
- "TrafficManager",
- "AzurePolicy",
- "EventHubs",
- "WAF",
- "RBAC",
- "Entra"
+ "SQL",
+ "VM"
+ ],
+ "severity": "High",
+ "subcategory": "VM Size",
+ "text": "Collect the target workload's performance characteristics and use them to determine the appropriate VM size for your business.",
+ "waf": "Performance"
+ },
+ {
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "The memory optimized virtual machine sizes are a primary target for SQL Server VMs and the recommended choice by Microsoft. The memory optimized virtual machines offer stronger memory-to-CPU ratios and medium-to-large cache options.Consider Ebdsv5-series series first for most SQL Server workloads.",
+ "guid": "e04abe1f-8d39-4fda-9776-8424c116775c",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-vm-size?view=azuresql#memory-optimized",
+ "services": [
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "subcategory": "VM Size",
+ "text": "Use memory optimized virtual machine sizes for the best performance of SQL Server workloads.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "To find the most effective configuration for SQL Server workloads on an Azure VM, start by measuring the storage performance of your business application. Once storage requirements are known, select a virtual machine that supports the necessary IOPS and throughput with the appropriate memory-to-vCore ratio.",
+ "guid": "2ea55b56-ad48-4408-be72-734b476ba18f",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance#counters-to-measure-application-performance-requirements",
"services": [
+ "SQL",
"Storage",
- "VM",
- "EventHubs",
- "WAF",
- "Entra",
- "AKV"
+ "VM"
],
"severity": "Medium",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Determine storage bandwidth and latency requirements for SQL Server data, log, and tempdb files before choosing the disk type.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "This provides more dedicated disk IOPS and throughput on the disk level and also allows you to configure the Azure disk host caching setting for each disk to the optimal setting for that data type.",
+ "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "RBAC",
- "EventHubs"
+ "SQL",
+ "Storage"
],
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Place data, log, and tempdb files on separate drives",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Premium SSD is always recommend as a minimum for SQL Server in order to obtain better performance and lower latency. P30 and P40 are recommended because disk caching is not supported for disks 4 TiB and larger ( P50 and above) and they provide the optimal price to performance ratio",
+ "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "EventHubs",
- "Monitor",
- "VNet"
+ "SQL",
+ "Storage"
],
- "severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "For the data drive, use premium P30 and P40 or smaller disks to ensure the availability of cache support",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Log files have primarily write-heavy operations. Therefore, they do not benefit from the ReadOnly cache. Hence evaluate your price vs performance vs capacity and chose the right storage disk.",
+ "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "VNet",
- "PrivateLink",
- "EventHubs"
+ "Storage",
+ "SQL",
+ "Cost"
],
- "severity": "Medium",
- "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "For the log drive plan for capacity and test performance versus cost while evaluating the premium P30 - P80 disks",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Placing TempDB on the D drive can help performance. Consider the size required and always test performance.",
+ "guid": "12f70983-f630-4472-8ee6-9d6b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "EventHubs"
+ "Storage",
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Place tempdb on the local ephemeral SSD (default D:\\) drive for most SQL Server workloads that are not part of Failover Cluster Instance (FCI) after choosing the optimal VM size.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Striping Data and Log disk can increase bandwidth. Ensure that VM size also matches expected output",
+ "guid": "4b69bad3-4aad-45e8-a78e-1d76667313c4",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "VM"
],
- "severity": "Medium",
- "text": "Leverage FTA Resillency HandBook",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "Stripe multiple Azure data disks using Storage Spaces to increase I/O bandwidth",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Your storage caching policy varies depending on the type of SQL Server data files that are hosted on the drive.Enable Read-only caching for the disks hosting SQL Server data files.Reads from cache will be faster than the uncached reads from the data disk.Set the caching policy to None for disks hosting the transaction log. There is no performance benefit to enabling caching for the Transaction log disk.",
+ "guid": "05674b5e-985b-4859-a773-e7e261623b77",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "ACR",
- "EventHubs"
+ "SQL",
+ "Storage",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "subcategory": "Storage",
+ "text": "Set host caching to read-only for data file disks and none for log file disks.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Check that you storage is in the same region as your VM. For exaplme if your VM is in EAST US 2 ensure your storage is in East US 2.",
+ "guid": "5a917e1f-348e-4f35-9c27-d42e8bbac868",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "VM"
],
- "severity": "Medium",
- "text": "Use the Premium or Dedicated SKUs for predicable performance",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "Provision the storage account in the same region as the SQL Server VM",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "SQL Server uses extents to store data. These are 64KB in size. Therefore, on a SQL Server machine, the NTFS allocation unit size for hosting SQL database files should be 64 KB.",
+ "guid": "155abb91-63e9-4908-ae28-c84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
- "WAF",
- "ASR",
- "EventHubs"
+ "SQL",
+ "Storage"
],
"severity": "High",
- "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
- "waf": "Reliability"
+ "subcategory": "Storage",
+ "text": "Format your data disk to use 64 KB block size (allocation unit size) for all data files placed on a drive other than the temporary D:\\ drive",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "It is recommended that you determine BCDR needs and requirements ensuring that you are able to meet you SLAs of the environment.",
+ "guid": "8b9fe5c4-2049-4d41-9a92-3c3474d11028",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#azure-only-disaster-recovery-solutions",
"services": [
- "WAF",
- "ASR",
- "EventHubs"
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "For Business Critical Applications, use Active Active configuration",
+ "subcategory": "HADR",
+ "text": "Determine HA/DR requirements for each VM to be migrated.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "WAF checklist",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "When depoying High Availability you need to use availability sets or availability zones to avoid unexpected outages.",
+ "guid": "ac6aae01-e6a8-44de-9df4-3d1992481718",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#high-availability-nodes-in-an-availability-set",
"services": [
- "WAF",
- "EventHubs"
+ "SQL",
+ "VM"
],
- "severity": "Medium",
- "text": "Design Resilient Event Hubs",
+ "severity": "High",
+ "subcategory": "HADR",
+ "text": "Place your VMs in an availability set or different availability zones.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Prefered option when deploying an Availability Group. The recommended solution is to use multi-subnets when deploying Always on Availability Groups.",
+ "guid": "d5d1e5f6-2565-49d3-958f-d77249c93111",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "VM",
+ "LoadBalancer",
+ "VNet"
],
- "severity": "Low",
- "text": "If required for AKS Windows workloads HostProcess containers can be used",
+ "severity": "Medium",
+ "subcategory": "HADR",
+ "text": "Deploy your SQL Server VMs to multiple subnets whenever possible to avoid the dependency on an Azure Load Balancer or a distributed network name (DNN) to route traffic to your HADR solution. ( If one is implementing FCI or AG)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "High availability and disaster recovery (HADR) features, such as the Always On availability group and the failover cluster instance rely on underlying Windows Server Failover Cluster technology. Review the best practices for modifying your HADR settings to better support the cloud environment.",
+ "guid": "2d027fe4-12f7-4098-9f63-04722ee69d6b",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#hadr-configuration",
"services": [
- "WAF"
+ "SQL",
+ "ASR"
],
- "severity": "Low",
- "text": "Use KEDA if running event-driven workloads",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "HADR",
+ "text": "Change the cluster to less aggressive parameters to avoid unexpected outages from transient network failures or Azure platform maintenance. ( If one is implementing FCI or AG)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Ensure that quorum is set correct for the number of instances deployed.",
+ "guid": "5c2622f5-4b69-4bad-94aa-d5e8c78e1d76",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/hadr-cluster-best-practices?view=azuresql-vm&tabs=windows2012#quorum-voting",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "Low",
- "text": "Use Dapr to ease microservice development",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "HADR",
+ "text": "Configure cluster quorum voting to use 3 or more odd number of votes. Don't assign votes to DR regions. ( If one is implementing FCI or AG)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "On Azure virtual machines, clusters use a load balancer to hold an IP address that needs to be on one cluster node at a time. In this solution, the load balancer holds the IP address for the virtual network name (VNN) listener for the Always On availability group when the SQL Server VMs are in a single subnet.",
+ "guid": "667313c4-0567-44b5-b985-b859c773e7e2",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "VM",
+ "LoadBalancer",
+ "VNet"
],
"severity": "High",
- "text": "Use the SLA-backed AKS offering",
+ "subcategory": "HADR",
+ "text": "When using the virtual network name (VNN) and Azure Load Balancer to connect to your HADR solution, specify MultiSubnetFailover = true in the connection string, even if your cluster only spans one subnet. ( If one is implementing FCI or AG)",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "SQL Server, Azure SQL Database, and Azure SQL Managed Instance support row and page compression for rowstore tables and indexes, and support columnstore and columnstore archival compression for columnstore tables and indexes.",
+ "guid": "61623b77-5a91-47e1-b348-ef354c27d42e",
+ "link": "https://learn.microsoft.com/sql/relational-databases/data-compression/data-compression?view=sql-server-ver16",
"services": [
- "WAF",
- "Cost"
+ "SQL",
+ "Storage"
],
"severity": "Low",
- "text": "Use Disruption Budgets in your pod and deployment definitions",
- "waf": "Reliability"
+ "subcategory": "SQL Server",
+ "text": "Enable database page compression where appropriate.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "By default, data and log files are initialized to overwrite any existing data left on the disk from previously deleted files. Data and log files are first initialized by zeroing the files (filling with zeros).In SQL Server, for data files only, instant file initialization (IFI) allows for faster execution of the previously mentioned file operations, since it reclaims used disk space without filling that space with zeros. Instead, disk content is overwritten as new data is written to the files.",
+ "guid": "8bbac868-155a-4bb9-863e-9908ae28c84c",
+ "link": "https://learn.microsoft.com/sql/relational-databases/databases/database-instant-file-initialization?view=sql-server-ver16",
"services": [
- "WAF",
- "ACR"
+ "SQL",
+ "Storage"
],
"severity": "High",
- "text": "If using a private registry, configure region replication to store images in multiple regions",
- "waf": "Reliability"
+ "subcategory": "SQL Server",
+ "text": "Enable instant file initialization for data files.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Recommended for best performance and availability migrate all databases to data and log disks",
+ "guid": "33b6b780-8b9f-4e5c-9204-9d413a923c34",
+ "link": "https://learn.microsoft.com/sql/relational-databases/databases/move-database-files?view=sql-server-ver16",
"services": [
- "WAF",
- "Cost"
+ "SQL"
],
- "severity": "Low",
- "text": "Use an external application such as kubecost to allocate costs to different users",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "SQL Server",
+ "text": "Move all databases to data disks, including system databases.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "b824546c-e1ae-4e34-93ae-c8239248725d",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#sql-server-features",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "VM"
],
"severity": "Low",
- "text": "Use scale down mode to delete/deallocate nodes",
- "waf": "Cost"
+ "subcategory": "SQL Server",
+ "text": "Move SQL Server error log and trace file directories to data disks.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "d68c5b5c-2925-4394-a69a-9d2799c42bb6",
+ "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options#use-",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "VM"
],
- "severity": "Medium",
- "text": "When required use multi-instance partitioning GPU on AKS Clusters",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "SQL Server",
+ "text": "Set max SQL Server memory limit to leave enough memory for the Operating System.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "8d1d7555-6246-4b43-a563-b4dc74a748b6",
+ "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows",
"services": [
- "WAF"
+ "SQL",
+ "VM"
],
- "severity": "Low",
- "text": "If running a Dev/Test cluster use NodePool Start/Stop",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "SQL Server",
+ "text": "Enable lock pages in memory.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "633ad2a0-916a-4664-a8fa-d0e278ee293c",
+ "link": "https://learn.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store",
"services": [
- "WAF",
- "AKS",
- "AzurePolicy"
+ "SQL",
+ "VM"
],
- "severity": "Medium",
- "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "SQL Server",
+ "text": "Enable Query Store on all production SQL Server databases following best practices.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "1bc352ba-aab7-4571-a49a-b8093dc9ec9d",
+ "link": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server",
"services": [
- "WAF"
+ "SQL",
+ "VM"
],
- "severity": "Medium",
- "text": "Separate applications from the control plane with user/system node pools",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "SQL Server",
+ "text": "Ensure that all tempdb best practices are followed.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "1bb73b36-a5a6-47fb-a9ed-5b35478c3479",
+ "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
"services": [
- "WAF"
+ "SQL",
+ "VM"
],
- "severity": "Low",
- "text": "Add taint to your system nodepool to make it dedicated",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "SQL Server",
+ "text": "Schedule SQL Server Agent jobs to run DBCC CHECKDB, index reorganize, index rebuild, and update statistics jobs.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
+ "guid": "816b2863-cffe-41ca-a599-ef0d5a73dd4c",
+ "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
"services": [
- "WAF",
- "ACR"
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "Use a private registry for your images, such as ACR",
- "waf": "Security"
+ "subcategory": "SQL Server",
+ "text": "Limit autogrowth of the database and Disable autoshrink",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "WAF checklist",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Constrained vCPU virtual machines (VMs) are a type of VM where the vCPU count can be constrained to a half or a quarter of the original VM size. This allows customers to reduce the cost of software licensing while maintaining the same memory, storage, and I/O bandwidth",
+ "guid": "e36c1c81-770a-4fbc-9c0d-43918648d285",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/constrained-vcpu",
"services": [
- "WAF"
+ "Storage",
+ "SQL",
+ "Cost",
+ "VM"
],
- "severity": "Medium",
- "text": "Scan your images for vulnerabilities",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Cost Optimization",
+ "text": "Optimize SQL Server License cost with Constrained vCPU VM's",
+ "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Azure Hybrid Benefit allows you to exchange your existing licenses for discounted rates on Azure SQL Database and Azure SQL Managed Instance. Y",
+ "guid": "7ed67178-b824-4546-ae1a-ee3453aec823",
+ "link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/",
"services": [
- "WAF"
+ "SQL",
+ "Cost"
],
- "severity": "High",
- "text": "Define app separation requirements (namespace/nodepool/cluster)",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Cost Optimization",
+ "text": "Leverage Azure Hybrid benefit to maximize the value of your on premises licenses in the cloud",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "The SQL Server IaaS Agent extension (SqlIaasExtension) runs on SQL Server on Azure Windows Virtual Machines (VMs) to automate management and administration tasks.",
+ "guid": "9248725d-d68c-45b5-a292-5394a69a9d27",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql-vm&tabs=azure-cli",
"services": [
- "WAF",
- "AKV"
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
- "waf": "Security"
+ "subcategory": "Azure",
+ "text": "Register with the SQL IaaS Agent Extension to unlock a number of feature benefits.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Accelerated Networking provides consistent ultra-low network latency via Azure's in-house programmable hardware and technologies",
+ "guid": "99c42bb6-8d1d-4755-9624-6b438563b4dc",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
"services": [
- "WAF"
+ "SQL",
+ "VM"
],
"severity": "High",
- "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
- "waf": "Security"
+ "subcategory": "Azure",
+ "text": "Ensure Accelerated Networking is enabled on the virtual machine.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "category": "SQL Server on Azure VM",
+ "checklist": "SQL Migration Review",
+ "description": "Microsoft Defender detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases on the SQL server.",
+ "guid": "74a748b6-633a-4d2a-8916-a66498fad0e2",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls",
"services": [
- "WAF"
+ "Defender",
+ "SQL",
+ "VM"
],
- "severity": "Medium",
- "text": "If required add Key Management Service etcd encryption",
+ "severity": "High",
+ "subcategory": "Azure",
+ "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture of your virtual machine deployment.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "There are some PaaS limitations that are introduced in SQL Managed Instance and some behavior changes compared to SQL Server. It is important to review and understand these differences.",
+ "guid": "78ee293c-1bc3-452b-aaab-7571849ab809",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server?view=azuresql",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "EventHubs"
],
- "severity": "Low",
- "text": "If required consider using Confidential Compute for AKS",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Review the major differences between SQL Server and Managed Instance",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. It is important to review these limits.",
+ "guid": "3dc9ec9d-1bb7-43b3-9a5a-67fba9ed5b35",
+ "link": "https://docs.microsoft.com/azure/azure-sql/managed-instance/resource-limits",
"services": [
- "WAF",
- "Defender"
+ "SQL"
],
- "severity": "Medium",
- "text": "Consider using Defender for Containers",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Review capacity limits for SQL MI",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "The instance settings between managed instance and your source SQL Server can be different . It is important to review those differences that can impact performance.",
+ "guid": "8bc178bd-c5a0-46ca-9144-351e19dd3442",
+ "link": "https://medium.com/azure-sqldb-managed-instance/compare-environment-settings-on-sql-server-and-azure-sql-that-may-impact-performance-e90c21fa9b08",
"services": [
- "WAF",
- "Entra"
+ "SQL"
],
"severity": "High",
- "text": "Use managed identities instead of Service Principals",
- "waf": "Security"
+ "subcategory": "Pre Migration",
+ "text": "Compare instance settings on SQL Server and Azure SQL MI that may impact performance",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Assess on-premises SQL Server instance(s) migrating to Azure SQL Managed Instance. The assessment workflow helps you to detect issues that block the migration itself and also partially supported and unsupported features",
+ "guid": "9eb72281-37a1-451c-9bb4-e4f1814287d5",
+ "link": "https://docs.microsoft.com/azure/dms/ads-sku-recommend",
"services": [
- "WAF",
- "Entra"
+ "SQL"
],
- "severity": "Medium",
- "text": "Integrate authentication with AAD (using the managed integration)",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Run Data Migration assistant or Azure Data Studio Migration Extension to detect compatibility issues that can impact database functionality on Managed Instance",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "The SKU recommendation feature can evaluate the source SQL Server performance and utilization characteristics to recommend a right-sized Azure SQL Managed Instance to assist with your migration journey.",
+ "guid": "ca8c26c9-b32a-4b5b-afc6-898a135e3378",
+ "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "Medium",
- "text": "Limit access to admin kubeconfig (get-credentials --admin)",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Select the right compute resources for your workload by leveraging the SKU recommendation tools.",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Review Unsupported Features, Migration Blockers and Breaking Changes for each database from the Assessment",
+ "guid": "97e31c67-d68c-4b69-82ac-19f906d697c8",
+ "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend",
"services": [
- "WAF",
- "Entra",
- "RBAC"
+ "SQL"
],
- "severity": "Medium",
- "text": "Integrate authorization with AAD RBAC",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Review and address the issues highlighted in DMA/Azure Data Studio",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "The SQL Managed Instance default DNS zone .database.windows.net can be changed with your own. However, the managed instance hostname part of its FQDN should remain the same.",
+ "guid": "eaded26b-dd18-46f0-ac25-1b999a68af87",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/frequently-asked-questions-faq?view=azuresql-mi#can-a-managed-instance-have-the-same-name-as-a-sql-server-on-premises-instance",
"services": [
- "WAF",
- "AKS",
- "RBAC"
+ "SQL",
+ "DNS"
],
"severity": "High",
- "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
- "waf": "Security"
+ "subcategory": "Pre Migration",
+ "text": "Plan for connection string changes as changing a managed instance name is not supported",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "There are addional requirements in configuring a vnet and subnet hosting the managed instance.",
+ "guid": "c9a7f821-b8eb-48c0-aa77-e25e4d5aeaa8",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-existing-add-subnet?view=azuresql-mi",
"services": [
- "WAF",
- "Entra"
+ "SQL",
+ "VNet"
],
"severity": "Medium",
- "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
- "waf": "Security"
+ "subcategory": "Pre Migration",
+ "text": "Review managed instance VNet requirements",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Though it's possible to deploy managed instances to a subnet with a number of IP addresses that's less than the output of the subnet formula, always consider using bigger subnets instead. Using a bigger subnet can help avoid future issues stemming from a lack of IP addresses, such as the inability to create additional instances within the subnet or scale existing instances.",
+ "guid": "dc4e2436-bb33-46d7-85f1-7960eee0b9b5",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-subnet-determine-size?view=azuresql-mi",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "VNet"
],
- "severity": "Medium",
- "text": "For AKS non-interactive logins use kubelogin (preview)",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Deployment",
+ "text": "Ensure managed instance subnet has sufficient IP addresses available",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. SQL Managed Instance can be deployed on multiple hardware configurations.",
+ "guid": "c8defc4d-721d-431d-850f-b707ae9eab40",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/resource-limits?view=azuresql-mi#service-tier-characteristics",
"services": [
- "WAF",
- "AKS"
+ "SQL"
],
- "severity": "Medium",
- "text": "Disable AKS local accounts",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Plan between General Purpose and Business Critical tiers of MI",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "The auto-failover groups feature allows you to manage the replication and failover of user databases in a managed instance to a managed instance in another Azure region. Auto-failover groups are designed to simplify deployment and management of geo-replicated databases at scale.",
+ "guid": "ed329079-8bc1-478b-bc5a-06ca7144351e",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-sql-mi?view=azuresql-mi&tabs=azure-powershell",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "Low",
- "text": "Configure if required Just-in-time cluster access",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Pre Migration",
+ "text": "Based on your RPO/RTO's , determine if Auto failover Group needs to be implemented. If so, plan for the deployment attributes of the second instance.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "There are multiple ways to connect your application to the managed instance. Review and understand the pros and cons and decide on the best approach for your application.",
+ "guid": "5d226886-d30b-466c-97be-595190f83845",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi",
"services": [
- "WAF",
- "AKS",
- "Entra"
+ "SQL"
],
"severity": "Low",
- "text": "Configure if required AAD conditional access for AKS",
- "waf": "Security"
+ "subcategory": "Pre Migration",
+ "text": "Review the Connectivity Design between Database and Application, test & validate it",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Compare migration options to choose the path that's appropriate to your business needs.",
+ "guid": "c586cb29-1ec1-46a1-b076-ef9f141acdce",
+ "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview?view=azuresql-mi#migration-tools",
"services": [
- "WAF",
- "AKS"
+ "SQL"
],
- "severity": "Low",
- "text": "If required for Windows AKS workloads configure gMSA ",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Pre Migration",
+ "text": "Plan for the Migration Method. Depending on the DB Size and Application downtime window, select the preferred Migration Method.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "After you verify that data is the same on both source and target, you can cut over from the source to the target environment. It's important to plan the cutover process with business / application teams to ensure minimal interruption during cutover doesn't affect business continuity.",
+ "guid": "579377bc-db37-451a-a2ac-1fad66e15d4d",
+ "link": "https://learn.microsoft.com/azure/dms/tutorial-sql-server-managed-instance-online#performing-migration-cutover",
"services": [
- "WAF",
- "Entra"
+ "SQL"
],
"severity": "Medium",
- "text": "For finer control consider using a managed Kubelet Identity",
- "waf": "Security"
+ "subcategory": "Pre Migration",
+ "text": "Plan the cutover process with business / application teams to ensure minimal interruption during cutover and it does not affect business continuity.",
+ "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "A time zone of a managed instance can be set during instance creation only. The default time zone is UTC",
+ "guid": "4a2adb1c-3d23-426a-b225-ca44e1695fdd",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/timezones-overview?view=azuresql#set-a-time-zone",
"services": [
- "WAF",
- "ACR",
- "AppGW"
+ "SQL"
],
- "severity": "Medium",
- "text": "If using AGIC, do not share an AppGW across clusters",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Deployment",
+ "text": "Ensure you customize your time zone setting at the instance creation time. One cannot change it later.",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Server-level collation in Azure SQL Managed Instance can be specified when the instance is created and cannot be changed later.Default server-level collation is SQL_Latin1_General_CP1_CI_AS.",
+ "guid": "deace4cb-1deb-44c6-90c3-fc14eebb3693",
+ "link": "https://learn.microsoft.com/sql/relational-databases/collations/set-or-change-the-server-collation?view=sql-server-ver16",
"services": [
- "WAF",
- "AKS"
+ "SQL"
],
"severity": "High",
- "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
- "waf": "Reliability"
+ "subcategory": "Deployment",
+ "text": "Ensure you select the right collation setting at the instance creation time. One cannot change it later",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "When you're migrating a database protected by Transparent Data Encryption (TDE) to Azure SQL Managed Instance using the native restore option, the corresponding certificate from the SQL Server instance needs to be migrated before database restore.",
+ "guid": "829e3eec-2183-4687-a007-7a2b5945bda4",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/tde-certificate-migrate?view=azuresql-mi&tabs=azure-powershell",
"services": [
- "WAF"
+ "SQL",
+ "VM"
],
"severity": "Medium",
- "text": "For Windows workloads use Accelerated Networking",
- "waf": "Performance"
+ "subcategory": "Deployment",
+ "text": "For TDE Enabled Database, corresponding certificate from the on-premises or Azure VM SQL Server needs to be migrated before database restore",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "System databases can be restored only from backups that are created on the version of SQL Server that the server instance is currently running. This is not the case when you are migrating to SQL Managed Instance.Azure PowerShell and DBATools PowerShell libraries enable you to easily script and automate and customize all parts of the migration process.",
+ "guid": "3334fdf9-1c23-4418-8b65-275269440b4b",
+ "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide?view=azuresql-mi#backup-and-restore",
"services": [
- "WAF",
- "LoadBalancer"
+ "SQL",
+ "Backup"
],
- "severity": "High",
- "text": "Use the standard ALB (as opposed to the basic one)",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Migration",
+ "text": "Restore of system databases is not supported. To migrate instance-level objects (stored in master or msdb databases), we recommend to script them out and run T-SQL scripts on the destination instance.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "When using migration options that continuously replicate / sync data changes from source to the target, the source data and schema can change and drift from the target. During data sync, ensure that all changes on the source are captured and applied to the target during the migration process.",
+ "guid": "e3d3e084-3276-4d4b-bc01-5bcf219e4a1e",
"services": [
- "WAF",
- "VNet"
+ "SQL"
],
- "severity": "Medium",
- "text": "If using Azure CNI, consider using different Subnets for NodePools",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Migration",
+ "text": "Ensure that all changes on the source are captured and applied to the target during the migration process.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Ensure that the application is able to succesffuly connect to the managed instance post migration of the databases.",
+ "guid": "b5887952-5d22-4688-9d30-b66c57be5951",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi",
"services": [
- "WAF",
- "PrivateLink",
- "VNet"
+ "SQL"
],
"severity": "Medium",
- "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
- "waf": "Security"
+ "subcategory": "Migration",
+ "text": "Test Application Connectivity to MI and Databases",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "High availability is a fundamental part of SQL Managed Instance platform that works transparently for your database applications. Failovers from primary to secondary nodes in case of node degradation or fault detection, or during regular monthly software updates are an expected occurrence for all applications using SQL Managed Instance in Azure.",
+ "guid": "90f83845-c586-4cb2-a1ec-16a1d076ef9f",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/user-initiated-failover?view=azuresql",
"services": [
- "WAF"
+ "SQL"
],
"severity": "High",
- "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "subcategory": "Post Migration",
+ "text": "Consider executing a manual failover on SQL Managed Instance to test for fault and failover resiliency.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Ensuring that your applications are failover resilient prior to deploying to production will help mitigate the risk of application faults in production and will contribute to application availability for your customers.",
+ "guid": "141acdce-5793-477b-adb3-751ab2ac1fad",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-configure-sql-mi?view=azuresql&tabs=azure-portal#test-failover",
"services": [
- "WAF",
- "VNet"
+ "SQL",
+ "EventHubs",
+ "LoadBalancer"
],
"severity": "High",
- "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
- "waf": "Performance"
+ "subcategory": "Post Migration",
+ "text": "If failover groups have been implemented, Test Manual Failover and Failback and test application connectivity behavior during failover/failback",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "This provides more dedicated disk IOPS and throughput",
+ "guid": "aa359272-8e6e-4205-8726-76ae46691e88",
+ "link": "https://techcommunity.microsoft.com/t5/azure-sql-blog/storage-performance-best-practices-and-considerations-for-azure/ba-p/305525",
"services": [
- "WAF"
+ "SQL",
+ "Storage"
],
"severity": "High",
- "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "subcategory": "Post Migration",
+ "text": "Optimize Storage Performance for General Purpose Managed Instance",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "Many organizations have policies that require that certificates or encryption keys be created and managed internally. If your organization has a similar policy, this architecture might apply to you. If your customers require internal management of these items, the architecture also might apply to you.",
+ "guid": "35ad9422-23e1-4381-8523-081a94174158",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk",
"services": [
- "WAF",
- "AKS",
- "VNet"
+ "AKV",
+ "SQL",
+ "AzurePolicy",
+ "Backup"
],
"severity": "Low",
- "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
+ "subcategory": "Post Migration",
+ "text": "Enable Customer managed TDE for taking your own copy only full backups",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "The maintenance window feature provides you with the ability to onboard Azure SQL resource to prescheduled time blocks outside of business hours.",
+ "guid": "33ef7ad7-c6d3-4733-865c-7acbe44bbe60",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/planned-maintenance?view=azuresql",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "High",
- "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Post Migration",
+ "text": "Plan for Azure maintenance events",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "By using the long-term retention (LTR) feature, you can store specified SQL Database and SQL Managed Instance full backups in Azure Blob storage with configured redundancy for up to 10 years.",
+ "guid": "9d89f2e8-7778-4424-b516-785c6fa96b96",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi",
"services": [
- "WAF"
+ "Storage",
+ "SQL",
+ "ARS",
+ "Backup"
],
"severity": "Low",
- "text": "If required add your own CNI plugin",
- "waf": "Security"
+ "subcategory": "Post Migration",
+ "text": "Configure Long Term backup retention, view backups and restore from backups",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "By using Azure Hybrid Benefit, you can achieve cost savings, modernise and maintain a flexible hybrid environment while optimising business applications.",
+ "guid": "ad88408f-3727-434c-a76b-a28021459014",
+ "link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview",
"services": [
- "WAF",
- "AKS"
+ "SQL",
+ "Cost"
],
"severity": "Low",
- "text": "If required configure Public IP per node in AKS",
- "waf": "Performance"
+ "subcategory": "Post Migration",
+ "text": "Take advantage of Azure Hybrid Benefit and Azure Reservations where applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "category": "SQL Managed Instance",
+ "checklist": "SQL Migration Review",
+ "description": "If you don't have threat protection Advanced Threat Protection is part of the Microsoft Defender for SQL offering, which is a unified package for advanced SQL security capabilities.",
+ "guid": "65d38e53-f9cc-4bd8-9926-6acca274faa1",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-overview?view=azuresql",
"services": [
- "WAF"
+ "Defender",
+ "SQL"
],
"severity": "Medium",
- "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
- "waf": "Reliability"
+ "subcategory": "Post Migration",
+ "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
+ "category": "Automation",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP"
],
- "severity": "Low",
- "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "ACSS",
+ "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
+ "category": "Automation",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP"
],
"severity": "Medium",
- "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
- "waf": "Reliability"
+ "subcategory": "SDAF",
+ "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"services": [
- "WAF",
- "NVA"
+ "SAP",
+ "ASR",
+ "Backup"
],
- "severity": "High",
- "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Backup and restore",
+ "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR",
+ "Backup"
],
"severity": "Medium",
- "text": "If using a public API endpoint, restrict the IP addresses that can access it",
- "waf": "Security"
+ "subcategory": "Disaster recovery",
+ "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "Backup",
+ "SAP",
+ "ASR"
],
"severity": "High",
- "text": "Use private clusters if your requirements mandate it",
- "waf": "Security"
+ "subcategory": "Disaster recovery",
+ "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS",
- "AzurePolicy"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
- "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
- "waf": "Security"
+ "subcategory": "Disaster recovery",
+ "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS",
- "AzurePolicy"
+ "VPN",
+ "SAP",
+ "ASR",
+ "ExpressRoute"
],
"severity": "High",
- "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
- "waf": "Security"
+ "subcategory": "Disaster recovery",
+ "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS",
- "AzurePolicy"
+ "AKV",
+ "SAP",
+ "ACR",
+ "ASR"
],
- "severity": "High",
- "text": "Use Kubernetes network policies to increase intra-cluster security",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Disaster recovery",
+ "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR",
+ "VNet"
],
- "severity": "High",
- "text": "Use a WAF for web workloads (UIs or APIs)",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Disaster recovery",
+ "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
"services": [
- "WAF",
- "DDoS",
- "AKS",
- "VNet"
+ "SAP",
+ "Storage",
+ "ASR"
],
- "severity": "Medium",
- "text": "Use DDoS Standard in the AKS Virtual Network",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Disaster recovery",
+ "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR"
],
- "severity": "Low",
- "text": "If required add company HTTP Proxy",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Disaster recovery",
+ "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR",
+ "VNet"
],
- "severity": "Medium",
- "text": "Consider using a service mesh for advanced microservice communication management",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Disaster recovery",
+ "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor"
+ "SAP",
+ "Entra",
+ "VM",
+ "ASR"
],
"severity": "High",
- "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
- "waf": "Operations"
+ "subcategory": "Disaster recovery",
+ "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra"
+ "SAP",
+ "ASR"
],
- "severity": "Low",
- "text": "Check regularly Azure Advisor for recommendations on your cluster",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "ASR"
],
- "severity": "Low",
- "text": "Enable AKS auto-certificate rotation",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Storage",
+ "VM",
+ "ASR"
],
"severity": "High",
- "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
- "waf": "Operations"
+ "subcategory": "High availability",
+ "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Storage",
+ "ASR"
],
"severity": "High",
- "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
- "waf": "Operations"
+ "subcategory": "High availability",
+ "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR"
],
"severity": "High",
- "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
- "waf": "Operations"
+ "subcategory": "High availability",
+ "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR",
+ "LoadBalancer"
],
- "severity": "Low",
- "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "ASR",
+ "LoadBalancer"
],
- "severity": "Low",
- "text": "Consider using AKS command invoke on private clusters",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Make sure the Floating IP is enabled on the Load balancer",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ASR"
],
- "severity": "Low",
- "text": "For planned events consider using Node Auto Drain",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "VM",
+ "ASR"
],
"severity": "High",
- "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
- "waf": "Operations"
+ "subcategory": "High availability",
+ "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "VM",
+ "SAP",
+ "ASR",
+ "Entra",
+ "RBAC"
],
- "severity": "Low",
- "text": "Use custom Node RG (aka 'Infra RG') name",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
- "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
- "waf": "Operations"
+ "subcategory": "High availability",
+ "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "ASR"
],
- "severity": "Low",
- "text": "Taint Windows nodes",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "ASR"
],
- "severity": "Low",
- "text": "Keep windows containers patch level in sync with host patch level",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "description": "Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor"
+ "SAP",
+ "ACR",
+ "ASR"
],
- "severity": "Low",
- "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "ASR"
],
- "severity": "Low",
- "text": "If required use nodePool snapshots",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "High availability",
+ "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "VM",
+ "ASR"
],
- "severity": "Low",
- "text": "Consider spot node pools for non time-sensitive workloads",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "High availability",
+ "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Storage",
+ "VM",
+ "ASR"
],
- "severity": "Low",
- "text": "Consider AKS virtual node for quick bursting",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "High availability",
+ "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor"
+ "SAP",
+ "ASR"
],
- "severity": "High",
- "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "High availability",
+ "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Storage",
+ "ASR"
],
"severity": "High",
- "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
- "services": [
- "WAF",
- "Monitor"
- ],
- "severity": "Medium",
- "text": "Monitor CPU and memory utilization of the nodes",
- "waf": "Operations"
+ "subcategory": "Storage",
+ "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor"
+ "SAP",
+ "Storage",
+ "ASR"
],
- "severity": "Medium",
- "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
"services": [
+ "SAP",
"Storage",
- "ServiceBus",
- "EventHubs",
- "WAF",
- "Monitor"
+ "ASR"
],
- "severity": "Medium",
- "text": "Monitor OS disk queue depth in nodes",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "NVA",
- "LoadBalancer"
+ "SAP",
+ "Storage",
+ "ASR"
],
- "severity": "Medium",
- "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "category": "Cost Optimization",
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Cost"
],
"severity": "Medium",
- "text": "Subscribe to resource health notifications for your AKS cluster",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Automate SAP System Start-Stop to manage costs.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "category": "Cost Optimization",
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
- "WAF"
+ "Storage",
+ "SAP",
+ "Cost",
+ "VM"
],
- "severity": "High",
- "text": "Configure requests and limits in your pod specs",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": " ",
+ "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "category": "Cost Optimization",
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
- "WAF"
+ "Storage",
+ "SAP",
+ "Cost",
+ "VM"
],
- "severity": "Medium",
- "text": "Enforce resource quotas for namespaces",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": " ",
+ "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"services": [
- "WAF",
- "Subscriptions"
+ "SAP",
+ "Entra",
+ "Subscriptions",
+ "RBAC"
],
"severity": "High",
- "text": "Ensure your subscription has enough quota to scale out your nodepools",
- "waf": "Operations"
+ "subcategory": "Identity",
+ "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
- "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra"
],
- "severity": "High",
- "text": "Configure Liveness and Readiness probes for all deployments",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra"
],
"severity": "Medium",
- "text": "Use the Cluster Autoscaler",
- "waf": "Performance"
+ "subcategory": "Identity",
+ "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "Customize node configuration for AKS node pools",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra"
],
"severity": "Medium",
- "text": "Use the Horizontal Pod Autoscaler when required",
- "waf": "Performance"
+ "subcategory": "Identity",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra"
],
- "severity": "High",
- "text": "Consider an appropriate node size, not too large or too small",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "AKV",
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "AKV",
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "Consider subscribing to EventGrid Events for AKS automation",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "For long running operation on an AKS cluster consider event termination",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Implement SSO to SAP HANA",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra"
],
- "severity": "High",
- "text": "Use ephemeral OS disks",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS"
+ "SAP",
+ "Entra"
],
- "severity": "High",
- "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
"services": [
- "WAF",
- "AKS",
- "Storage"
+ "SAP",
+ "Entra"
],
- "severity": "Low",
- "text": "For hyper performance storage option use Ultra Disks on AKS",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
"services": [
- "WAF",
- "SQL",
- "Storage"
+ "SAP",
+ "Entra"
],
"severity": "Medium",
- "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
- "waf": "Performance"
+ "subcategory": "Identity",
+ "text": "Implement SSO to SAP BTP",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "category": "Identity and Access",
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
"services": [
- "WAF",
- "Storage"
+ "SAP",
+ "Entra"
],
"severity": "Medium",
- "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
- "waf": "Performance"
+ "subcategory": "Identity",
+ "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "description": "Keep your management group hierarchy reasonably flat, no more than four.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"services": [
- "WAF",
- "Storage"
+ "SAP",
+ "AzurePolicy",
+ "Subscriptions"
],
"severity": "Medium",
- "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
- "waf": "Performance"
+ "subcategory": "Subscriptions",
+ "text": "enforce existing Management Group policies to SAP Subscriptions",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
- "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "Leverage FTA Resillency Handbook",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
- "text": "Plan for Data Center level outage",
- "waf": "Reliability"
+ "subcategory": "Subscriptions",
+ "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
- "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "Practice Failover for BCDR",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"services": [
- "WAF",
- "Backup"
+ "SAP",
+ "Subscriptions"
],
- "severity": "High",
- "text": "Plan a backup strategy and take regular backups",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Subscriptions",
+ "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
- "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
"services": [
- "WAF",
- "EventHubs"
+ "SAP",
+ "VM",
+ "Subscriptions"
],
- "severity": "Low",
- "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
- "link": "https://learn.microsoft.com/purview/deployment-best-practices",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "Follow Purview accounts architectures and deployment best practices",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
- "service": "Purview",
+ "category": "Management Group and Subscriptions",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Cost",
+ "Subscriptions",
+ "TrafficManager"
],
"severity": "Medium",
- "text": "Follow Collection Architectures and best practices",
- "waf": "Reliability"
+ "subcategory": "Subscriptions",
+ "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor",
+ "Backup"
],
- "severity": "Medium",
- "text": "Follow Assest lifecycle best practices",
+ "severity": "High",
+ "subcategory": "BCDR",
+ "text": "Help protect your HANA database by using the Azure Backup service.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"services": [
- "WAF"
+ "Monitor",
+ "VM",
+ "Storage",
+ "SAP",
+ "Entra"
],
"severity": "Medium",
- "text": "Follow automation best practices",
+ "subcategory": "BCDR",
+ "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"services": [
- "WAF",
- "Backup"
+ "SAP",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Follow Backup and Migration Best practices",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Management",
+ "text": "Ensure time-zone matches between the operating system and the SAP system.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "Monitor"
],
"severity": "Medium",
- "text": "Follow Purview Glossary Best Practices",
+ "subcategory": "Management",
+ "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
- "link": "https://learn.microsoft.com/purview/concept-workflow",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Cost",
+ "Monitor"
],
"severity": "Low",
- "text": "Leverage Workflows ",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "Monitor"
],
"severity": "Medium",
- "text": "Follow Purview Security Best Practices",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "Monitor"
],
"severity": "Medium",
- "text": "Follow Purview Data Lineage Best Practices",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Follow Best Practices for Scanning Registered Sources",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor",
+ "SQL"
],
"severity": "Medium",
- "text": "Follow Classification Best Practices in Governance Portal",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
- "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Entra",
+ "VM",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Perform Sensitivity Labelling in the Purview Data Map",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
- "link": "https://learn.microsoft.com/purview/concept-data-share",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
"services": [
- "WAF",
- "Storage"
+ "SAP",
+ "AzurePolicy",
+ "Monitor"
],
- "severity": "Low",
- "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "NetworkWatcher",
+ "SAP",
+ "Monitor"
],
- "severity": "Low",
- "text": "Leverage Data Estate Insights",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
- "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "Monitor"
],
- "severity": "Low",
- "text": "Use Data stewardship and Catalog adoption",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor",
+ "Subscriptions"
],
- "severity": "Low",
- "text": "Use Inventory and Ownership",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
- "link": "https://learn.microsoft.com/purview/glossary-insights",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"services": [
- "WAF"
+ "Monitor",
+ "SAP",
+ "Storage",
+ "ASR"
],
- "severity": "Low",
- "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
- "link": "https://learn.microsoft.com/purview/compliance-manager",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "Sentinel",
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
- "text": "Generate assessment scores",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
- "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "text": "Profiling- get summaries of data content",
- "waf": "Reliability"
+ "subcategory": "Monitoring",
+ "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
- "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
"services": [
- "WAF",
- "AzurePolicy"
+ "SAP",
+ "VM",
+ "Monitor"
],
"severity": "Low",
- "text": "Follow Microsoft Purview Data Owner access policies",
- "waf": "Reliability"
+ "subcategory": "Performance",
+ "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
- "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"services": [
- "WAF",
- "AzurePolicy"
- ],
- "severity": "Low",
- "text": "Follow Self-service access policies",
+ "SAP",
+ "Monitor",
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Performance",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "WAF checklist",
- "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
- "link": "https://learn.microsoft.com/purview/concept-policies-devops",
- "service": "Purview",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"services": [
- "WAF",
- "AzurePolicy"
+ "SAP",
+ "Storage",
+ "Monitor"
],
- "severity": "Low",
- "text": "Follow DevOps policies",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Performance",
+ "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "WAF checklist",
- "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
- "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
- "service": "Container Apps",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor"
],
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Performance",
+ "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "WAF checklist",
- "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
- "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
- "service": "Container Apps",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Storage",
+ "Monitor"
],
- "severity": "High",
- "text": "Use more than one replica and enable Zone Redundancy.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Performance",
+ "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "WAF checklist",
- "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor",
+ "SQL"
],
- "severity": "High",
- "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Performance",
+ "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "WAF checklist",
- "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "category": "Management and Monitoring",
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
- "WAF",
- "TrafficManager",
- "FrontDoor"
+ "SAP",
+ "Monitor",
+ "ASR"
],
"severity": "High",
- "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
- "waf": "Reliability"
+ "subcategory": "Reliability",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra"
+ "AppGW",
+ "SAP",
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
- "waf": "Reliability"
+ "subcategory": "App delivery",
+ "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "DNS"
],
"severity": "Medium",
- "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
- "waf": "Reliability"
+ "subcategory": "DNS",
+ "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "DNS",
+ "VNet"
],
"severity": "Medium",
- "text": "Custom brand assets should be hosted on a CDN",
- "waf": "Performance"
+ "subcategory": "DNS",
+ "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ACR",
+ "VNet"
],
- "severity": "Low",
- "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"services": [
- "WAF",
- "VM"
+ "NVA",
+ "SAP"
],
- "severity": "Medium",
- "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "ACR",
+ "VWAN"
],
"severity": "Medium",
- "text": "Don't replicate! Replication can create issues with directory synchronization",
- "waf": "Reliability"
+ "subcategory": "Hybrid",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"services": [
- "WAF"
+ "NVA",
+ "SAP",
+ "VNet"
],
"severity": "Medium",
- "text": "Have active-active for multi-regions",
- "waf": "Reliability"
+ "subcategory": "Hybrid",
+ "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra"
+ "NVA",
+ "SAP",
+ "VWAN",
+ "VNet"
],
"severity": "Medium",
- "text": "Add Azure AD Domain service stamps to additional regions and locations",
- "waf": "Reliability"
+ "subcategory": "Hybrid",
+ "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "VNet"
],
- "severity": "Medium",
- "text": "Use Replica Sets for DR",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Public IP assignment to VM running SAP Workload is not recommended.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra",
- "Subscriptions"
+ "SAP",
+ "ASR",
+ "VNet"
],
"severity": "High",
- "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
- "waf": "Security"
+ "subcategory": "IP plan",
+ "text": "Consider reserving IP address on DR side when configuring ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Avoid using overlapping IP address ranges for production and DR sites.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Storage",
+ "VNet"
],
"severity": "Medium",
- "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
- "waf": "Security"
+ "subcategory": "IP plan",
+ "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Firewall"
],
- "severity": "High",
- "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"services": [
+ "AppGW",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "subcategory": "Internet",
+ "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
+ "AzurePolicy",
+ "FrontDoor",
+ "SAP",
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "subcategory": "Internet",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra"
+ "AzurePolicy",
+ "FrontDoor",
+ "SAP",
+ "AppGW",
+ "WAF"
],
- "severity": "High",
- "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS",
- "RBAC"
+ "AppGW",
+ "SAP",
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "text": "Has an RBAC model been created for use within VMware vSphere",
+ "subcategory": "Internet",
+ "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"services": [
- "WAF",
- "RBAC"
+ "SAP",
+ "ACR",
+ "VWAN"
],
"severity": "Medium",
- "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
- "waf": "Security"
+ "subcategory": "Internet",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS",
- "RBAC"
+ "VNet",
+ "Backup",
+ "Storage",
+ "PrivateLink",
+ "SAP",
+ "ACR"
],
- "severity": "High",
- "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"services": [
- "WAF",
- "RBAC"
+ "SAP",
+ "VM"
],
"severity": "High",
- "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
- "waf": "Security"
+ "subcategory": "Segmentation",
+ "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP",
+ "LoadBalancer"
],
- "severity": "High",
- "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"services": [
- "VPN",
- "WAF",
- "Monitor",
- "ExpressRoute",
- "NetworkWatcher"
+ "SAP",
+ "VM",
+ "VNet"
],
- "severity": "High",
- "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "VM",
- "WAF",
- "Monitor",
- "AVS",
- "ExpressRoute",
- "NetworkWatcher"
+ "SAP",
+ "VNet"
],
- "severity": "Medium",
- "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Segmentation",
+ "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "VM",
- "WAF",
- "Monitor",
- "AVS",
- "NetworkWatcher"
+ "SAP"
],
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
- "waf": "Operations"
+ "subcategory": "Segmentation",
+ "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "WAF",
- "ARS"
+ "SAP"
],
"severity": "High",
- "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
- "waf": "Operations"
+ "subcategory": "Segmentation",
+ "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra",
- "AVS",
- "RBAC"
+ "SAP",
+ "Cost",
+ "VNet"
],
"severity": "High",
- "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
- "waf": "Security"
+ "subcategory": "Segmentation",
+ "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra",
- "AVS",
- "RBAC"
+ "SAP",
+ "LoadBalancer"
],
"severity": "High",
- "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
- "waf": "Security"
+ "subcategory": "Segmentation",
+ "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "category": "Network Topology and Connectivity",
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra",
- "AVS"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
- "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
+ "subcategory": "Segmentation",
+ "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "Backup"
],
"severity": "High",
- "text": "Limit use of CloudAdmin account to emergency access only",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review SAP HANA database backups for Azure VMs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
- "WAF",
- "RBAC"
+ "SAP",
+ "Monitor",
+ "ASR"
],
"severity": "Medium",
- "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review Site Recovery built-in monitoring, where used for SAP.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "VM",
+ "Backup"
],
"severity": "Medium",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review Oracle Database in Azure Linux VM backup strategies.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"services": [
- "WAF",
- "Entra",
- "AVS",
- "VM"
+ "SAP",
+ "Storage",
+ "SQL"
],
- "severity": "High",
- "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "VM",
+ "Backup"
],
"severity": "Medium",
- "text": "Is East-West traffic filtering implemented within NSX-T",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review the use of Automated Backup v2 for Azure VMs.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "category": "Operational Excellence",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"services": [
- "WAF",
- "AppGW",
- "AVS",
- "Firewall"
+ "SAP"
],
"severity": "High",
- "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Enabling Write accelerator for M series when using premium disks(V1)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP"
],
- "severity": "High",
- "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Test availability zone latency.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS"
+ "SAP"
],
"severity": "Medium",
- "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Activate SAP EarlyWatch Alert for all SAP components.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"services": [
- "VPN",
- "WAF",
- "ExpressRoute",
- "DDoS",
- "VNet"
+ "SAP"
],
"severity": "Medium",
- "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP",
+ "Monitor",
+ "SQL"
],
"severity": "Medium",
- "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review SQL Server performance monitoring using CCMS.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS",
- "Defender"
+ "SAP",
+ "VM"
],
"severity": "Medium",
- "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
"services": [
- "WAF",
- "Arc",
- "AVS"
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
- "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Review SAP HANA studio alerts.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
+ "category": "Performant",
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
"services": [
- "WAF",
- "SQL",
- "AVS"
+ "SAP"
],
- "severity": "Low",
- "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
- "WAF",
- "AKV"
+ "SAP",
+ "VM"
],
- "severity": "Low",
- "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP"
],
"severity": "Medium",
- "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "subcategory": "Governance",
+ "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "SQL"
],
- "severity": "High",
- "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Governance",
+ "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy"
+ "SAP",
+ "SQL"
],
"severity": "High",
- "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
- "waf": "Reliability"
+ "subcategory": "Governance",
+ "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "WAF",
- "ASR"
+ "AKV",
+ "SQL",
+ "Storage",
+ "Backup",
+ "SAP"
],
"severity": "High",
- "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
- "waf": "Reliability"
+ "subcategory": "Secrets",
+ "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
"services": [
- "WAF"
+ "AKV",
+ "SAP",
+ "Storage"
],
"severity": "Medium",
- "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "waf": "Operations"
+ "subcategory": "Secrets",
+ "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "SAP"
],
- "severity": "Medium",
- "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "Use Azure Key Vault to store your secrets and credentials",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS",
- "Cost"
+ "AzurePolicy",
+ "AKV",
+ "Subscriptions",
+ "SAP",
+ "RBAC"
],
"severity": "Medium",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
- "waf": "Cost"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
- "services": [
- "WAF",
- "AVS",
- "Cost"
- ],
- "severity": "Low",
- "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
- "waf": "Cost"
+ "subcategory": "Secrets",
+ "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"services": [
- "WAF"
+ "AKV",
+ "SAP",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "subcategory": "Secrets",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
"services": [
- "WAF"
+ "AKV",
+ "SAP",
+ "AzurePolicy",
+ "RBAC"
],
"severity": "High",
- "text": "Ensure all required resource reside within the same Azure availability zone(s)",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
- "services": [
- "WAF",
- "AVS",
- "VM",
- "Defender"
- ],
- "severity": "Medium",
- "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "subcategory": "Secrets",
+ "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "WAF",
- "Arc",
- "AVS",
- "VM"
+ "AKV",
+ "Defender",
+ "SAP",
+ "Storage"
],
- "severity": "Medium",
- "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "AKV",
+ "Defender",
+ "SAP",
+ "RBAC"
],
"severity": "High",
- "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "waf": "Operations"
+ "subcategory": "Secrets",
+ "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS",
- "VM"
+ "AKV",
+ "SAP"
],
- "severity": "Medium",
- "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Secrets",
+ "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"services": [
- "AzurePolicy",
- "VM",
- "WAF",
- "AVS",
- "Backup"
+ "AKV",
+ "SAP"
],
"severity": "Medium",
- "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "waf": "Operations"
+ "subcategory": "Secrets",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS",
- "Defender"
+ "AKV",
+ "SAP"
],
- "severity": "Medium",
- "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
"services": [
- "WAF",
- "Defender"
+ "AKV",
+ "SAP"
],
- "severity": "Medium",
- "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
"services": [
- "WAF",
- "AVS"
+ "SAP",
+ "Subscriptions",
+ "RBAC"
],
"severity": "High",
- "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "subcategory": "Security",
+ "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"services": [
- "WAF"
+ "NVA",
+ "SAP",
+ "PrivateLink"
],
"severity": "High",
- "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "subcategory": "Security",
+ "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "Storage",
+ "VM"
],
- "severity": "Medium",
- "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS"
+ "Defender",
+ "SAP"
],
- "severity": "High",
- "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS"
+ "SAP",
+ "VNet"
],
"severity": "High",
- "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "waf": "Operations"
+ "subcategory": "Security",
+ "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "WAF",
- "Monitor",
- "AVS"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
+ "category": "Security, Governance and Compliance",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"services": [
- "WAF",
+ "AKV",
+ "SAP",
"Monitor"
],
- "severity": "High",
- "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS",
- "Storage"
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "High Availability",
+ "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
+ "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS"
+ "AppSvc",
+ "Backup",
+ "ASR"
],
- "severity": "Low",
- "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
+ "service": "App Services",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy",
- "VM"
+ "AppSvc",
+ "ACR"
],
"severity": "High",
- "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
- "waf": "Operations"
+ "subcategory": "High Availability",
+ "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Monitor"
],
"severity": "Medium",
- "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
- "waf": "Operations"
+ "subcategory": "Monitoring",
+ "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
+ "service": "App Services",
"services": [
- "WAF",
- "Storage",
+ "AppSvc",
"Backup"
],
- "severity": "Medium",
- "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
- "services": [
- "WAF",
- "Arc",
- "AVS"
- ],
- "severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Multi-tenant service",
+ "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
"services": [
- "WAF",
- "Monitor",
- "AVS"
+ "AppSvc",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS"
+ "AppSvc",
+ "ASR"
],
- "severity": "Medium",
- "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "High Availability",
+ "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
+ "service": "App Services",
"services": [
- "WAF",
- "Monitor",
- "AVS",
- "AzurePolicy"
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "category": "BC and DR",
+ "checklist": "Azure App Service Review",
+ "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS",
- "Defender"
+ "AppSvc"
],
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "WAF",
- "Backup"
+ "AppSvc",
+ "Monitor"
],
"severity": "Medium",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
+ "subcategory": "Monitoring",
+ "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Monitor"
],
"severity": "Medium",
- "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
+ "subcategory": "Monitoring",
+ "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"services": [
- "WAF",
- "ASR"
+ "AppSvc",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
+ "severity": "Low",
+ "subcategory": "Monitoring",
+ "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "AKV"
],
"severity": "High",
- "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
- "waf": "Reliability"
+ "subcategory": "Data Protection",
+ "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "WAF",
- "ASR"
+ "AppSvc",
+ "Entra",
+ "AKV"
],
- "severity": "Medium",
- "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Data Protection",
+ "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Entra",
+ "AKV"
],
"severity": "High",
- "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
- "waf": "Reliability"
+ "subcategory": "Data Protection",
+ "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"services": [
- "WAF",
- "ExpressRoute",
- "AVS",
- "NVA"
+ "AppSvc",
+ "Subscriptions"
],
"severity": "Medium",
- "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
- "waf": "Reliability"
+ "subcategory": "Data Protection",
+ "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
"services": [
- "WAF",
- "Backup"
+ "AppSvc",
+ "TrafficManager"
],
"severity": "Medium",
- "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
- "waf": "Reliability"
+ "subcategory": "Data Protection",
+ "text": "Do not store sensitive data on local disk",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS",
- "Backup"
+ "AppSvc",
+ "Entra",
+ "ACR"
],
"severity": "Medium",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
- "waf": "Reliability"
+ "subcategory": "Identity and Access Control",
+ "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"services": [
- "WAF",
- "Backup"
+ "AppSvc",
+ "Entra"
],
- "severity": "Medium",
- "text": "Deploy your backup solution outside of vSan, on Azure native components",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Deploy code to App Service from a trusted and secure environment.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS"
+ "AppSvc",
+ "Entra"
],
- "severity": "Low",
- "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Entra",
+ "AKV"
],
- "severity": "Low",
- "text": "For manual deployments, all configuration and deployments must be documented",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS"
+ "AppSvc",
+ "Entra",
+ "ACR"
],
- "severity": "Low",
- "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Pull container images from Azure Container Registry using a Managed Identity.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Entra",
+ "Monitor"
],
- "severity": "Low",
- "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Logging and Monitoring",
+ "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Entra",
+ "Monitor"
],
- "severity": "Low",
- "text": "For automated deployments, request or reserve quota prior to starting the deployment",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Logging and Monitoring",
+ "text": "Send App Service activity logs to Log Analytics",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"services": [
- "WAF",
- "AzurePolicy"
+ "AppSvc",
+ "Monitor",
+ "Firewall",
+ "VNet",
+ "NVA"
],
- "severity": "Low",
- "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Network Security",
+ "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
"services": [
- "WAF",
- "AKV"
+ "AppSvc",
+ "Firewall",
+ "VNet",
+ "NVA",
+ "Storage",
+ "PrivateLink"
],
"severity": "Low",
- "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "waf": "Operations"
+ "subcategory": "Network Security",
+ "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
- "WAF",
- "AKV",
- "ExpressRoute",
- "AVS"
+ "AppSvc",
+ "PrivateLink"
],
- "severity": "Low",
- "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS"
+ "AppSvc",
+ "Monitor",
+ "FrontDoor",
+ "AppGW",
+ "WAF"
],
- "severity": "Low",
- "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Use a Web Application Firewall (WAF) in front of App Service.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
+ "AppSvc",
+ "PrivateLink",
"WAF"
],
- "severity": "Low",
- "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS",
- "Subscriptions"
+ "AppSvc",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "waf": "Performance"
+ "subcategory": "Network Security",
+ "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy"
+ "AppSvc",
+ "WAF"
],
- "severity": "Medium",
- "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Storage"
],
- "severity": "Medium",
- "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Network Security",
+ "text": "Turn off remote debugging in production environments.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc",
+ "Defender"
],
"severity": "Medium",
- "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "waf": "Performance"
+ "subcategory": "Network Security",
+ "text": "Enable Defender for Cloud - Defender for App Service",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"services": [
+ "AppSvc",
+ "EventHubs",
+ "VNet",
+ "NVA",
+ "AppGW",
"WAF",
- "Monitor"
+ "DDoS"
],
"severity": "Medium",
- "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "waf": "Operations"
+ "subcategory": "Network Security",
+ "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"services": [
- "WAF",
- "VM"
+ "AppSvc",
+ "PrivateLink",
+ "ACR",
+ "VNet"
],
- "severity": "High",
- "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Network Security",
+ "text": "Pull container images over a Virtual Network from Azure Container Registry.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc"
],
- "severity": "High",
- "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Penetration Testing",
+ "text": "Conduct a penetration test on the web application.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"services": [
- "WAF",
- "VPN"
+ "AppSvc"
],
"severity": "Medium",
- "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
- "waf": "Performance"
+ "subcategory": "Vulnerability Management",
+ "text": "Deploy validated and vulnerability-scanned code.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "category": "Security",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc"
],
- "severity": "Medium",
- "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Vulnerability Management",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
+ "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
+ "service": "App Services",
"services": [
- "WAF"
+ "AppSvc"
],
"severity": "Medium",
- "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
+ "subcategory": "High Availability",
+ "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "category": "Operations",
+ "checklist": "Azure App Service Review",
+ "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
+ "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
+ "service": "App Services",
"services": [
- "WAF",
- "AVS",
- "VM",
- "Storage"
+ "AppSvc",
+ "Monitor"
],
"severity": "Medium",
- "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
+ "subcategory": "Monitoring",
+ "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
+ "category": "Governance and Security",
+ "checklist": "Azure App Service Review",
+ "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
+ "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "App Services",
"services": [
- "WAF",
- "ExpressRoute",
- "Storage"
+ "AppSvc",
+ "Backup",
+ "ACR",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Compliance",
+ "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
+ "waf": "Governance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "category": "Cost Governance",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
+ "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/",
+ "service": "App Services",
"services": [
- "WAF",
- "ExpressRoute",
- "Storage"
+ "AppSvc",
+ "Cost",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Cost Monitoring",
+ "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
+ "category": "Cost Governance",
+ "checklist": "Azure App Service Review",
+ "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
+ "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
+ "service": "App Services",
"services": [
- "WAF",
- "ASR"
+ "AppSvc",
+ "Storage",
+ "Cost",
+ "ARS"
],
- "severity": "High",
- "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Cost Optimization",
+ "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "d7e47431-76c8-4bdb-b55b-ce619e8a03f9",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli",
"services": [
- "WAF"
+ "Entra",
+ "RBAC"
],
"severity": "High",
- "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Create a service principal and its role assignments before creating the ARO clusters.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "7879424d-6267-486d-90b9-6c97be985190",
+ "link": "https://learn.microsoft.com/azure/openshift/configure-azure-ad-ui",
"services": [
- "WAF",
- "ExpressRoute"
+ "Entra"
],
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Use AAD to authenticate users in your ARO cluster.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "adfec5f9-a82d-46e9-a8d1-5a0c7fed5d15",
+ "link": "https://docs.openshift.com/container-platform/4.14/authentication/remove-kubeadmin.html",
"services": [
- "WAF",
- "ExpressRoute"
+ "Entra"
],
- "severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "When using AAD authentication, remove kubeadmin user from the cluster.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "WAF checklist",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "483835c9-86bb-4291-8155-a11475e39f54",
+ "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html",
"services": [
- "WAF"
+ "Entra",
+ "RBAC"
],
"severity": "High",
- "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Define OpenShift projects to restrict RBAC privilege and isolate workloads in your cluster.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "WAF checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "0acccd97-9376-4bcd-a375-0ab2ab039da6",
+ "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html",
"services": [
- "WAF",
- "ACR"
+ "Entra",
+ "RBAC"
],
- "severity": "High",
- "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Define the required RBAC roles in OpenShift are scoped to either a project or a cluster.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "WAF checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "d54d7c89-29db-4107-b532-5ae625ca44e4",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
"services": [
- "WAF",
- "Storage"
+ "AKV",
+ "Entra"
],
"severity": "Medium",
- "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Minimize the number of users who have administrator rights and secrets access.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "WAF checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "685e2223-ace8-4bb1-8307-ca5f16f154e3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
"services": [
- "WAF",
- "Storage"
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Use Privileged Identity Management in AAD for ARO users with privileged roles.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "WAF checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "aa369282-9e7e-4216-8836-87af467a1f89",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
"services": [
+ "Firewall",
+ "VNet",
+ "Subscriptions",
+ "Entra",
"WAF",
- "ASR"
+ "DDoS"
],
- "severity": "Medium",
- "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "DDoS",
+ "text": "Use Azure DDoS Network/IP Protection to protect the virtual network you use for the ARO cluster unless you use Azure Firewall or WAF in a centralized subscription",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "35bda433-24f1-4481-8533-182aa5174269",
+ "link": "https://docs.openshift.com/container-platform/4.13/networking/routes/secured-routes.html",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Encryption",
+ "text": "All web applications you configure to use an ingress should use TLS encryption and shouldn't allow access over unencrypted HTTP.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "44008ae7-d7e4-4743-876c-8bdbf55bce61",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
- "waf": "Reliability"
+ "subcategory": "Internet",
+ "text": "Use Azure Front Door with WAF to securely publish ARO applications to the internet, especially in multi-region environments.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Use zone redundant pipelines in regions that support Availability Zones",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
- "services": [
- "WAF",
- "Backup"
- ],
- "severity": "Medium",
- "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "9e8a03f9-7879-4424-b626-786d60b96c97",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door",
"services": [
- "WAF",
- "VM"
+ "PrivateLink",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
- "waf": "Reliability"
+ "subcategory": "Internet",
+ "text": "If exposing an app on ARO with Azure Front Door, use private link to connect Front Door with the ARO router.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "be985190-4838-435c-a86b-b2912155a114",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress",
"services": [
- "WAF",
- "VNet"
+ "NVA",
+ "AzurePolicy",
+ "Firewall"
],
"severity": "Medium",
- "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "WAF checklist",
- "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
- "services": [
- "WAF",
- "AKV"
- ],
- "severity": "Low",
- "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
- "waf": "Reliability"
+ "subcategory": "Internet",
+ "text": "If your security policy requires you to inspect all outbound internet traffic that's generated in the ARO cluster, secure egress network traffic by using Azure Firewall or an NVA.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "75e39f54-0acc-4cd9-9937-6bcda3750ab2",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-create-private-cluster-4x",
"services": [
- "WAF",
- "ServiceBus"
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "severity": "High",
+ "subcategory": "Private access",
+ "text": "If your security policy requires you to use a private IP address for the OpenShift API, deploy a private ARO cluster.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "category": "Network topology and connectivity",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
"services": [
- "WAF",
- "ServiceBus"
+ "PrivateLink",
+ "ACR"
],
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "subcategory": "Private access",
+ "text": "Use Azure Private Link to secure network connections to managed Azure services, including to Azure Container Registry.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "25ca44e4-685e-4222-9ace-8bb12307ca5f",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-enable-arc-enabled-clusters",
"services": [
- "TrafficManager",
- "ServiceBus",
- "AzurePolicy",
- "WAF",
- "RBAC",
- "Entra"
+ "Monitor"
],
- "severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Establish a monitoring process using the inbuilt Prometheus, OpenShift Logging or Container Insights integration.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
- "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
- "service": "Service Bus",
- "services": [
- "WAF",
- "ServiceBus",
- "Entra"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "16f154e3-aa36-4928-89e7-e216183687af",
+ "link": "https://docs.openshift.com/container-platform/4.13/cicd/pipelines/understanding-openshift-pipelines.html",
+ "services": [],
"severity": "Medium",
- "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "subcategory": "Operations",
+ "text": "Automate the application delivery process through DevOps practices and CI/CD solutions, such as Pipelines/GitOps provided by OpenShift.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
- "services": [
- "Storage",
- "ServiceBus",
- "WAF",
- "RBAC",
- "Subscriptions"
- ],
- "severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "467a1f89-35bd-4a43-924f-14811533182a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/design-principles/managed-services",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Operations",
+ "text": "Whenever possible, remove the service state from inside containers. Instead, use an Azure platform as a service (PaaS) that supports multiregion replication.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "1b7da8cf-aa66-4e15-b4d5-ada97dc3e232",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-storageclass",
"services": [
- "WAF",
- "ServiceBus",
- "Monitor",
- "VNet"
+ "Storage"
],
- "severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Operations",
+ "text": "Use RWX storage with inbuilt Azure Files storage class.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
- "services": [
- "WAF",
- "ServiceBus",
- "PrivateLink",
- "VNet"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "6bb235c7-05e1-4696-bded-fa8a4c8cdec4",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/clusters/nodes-cluster-limit-ranges.html",
+ "services": [],
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "subcategory": "Performance",
+ "text": "Use pod requests and limits to manage the compute resources within a cluster.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "WAF checklist",
- "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
- "services": [
- "WAF",
- "ServiceBus"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "c620c30c-14ee-4b7f-9ae8-d9b3fec228e7",
+ "link": "https://docs.openshift.com/container-platform/4.13/applications/quotas/quotas-setting-per-project.html",
+ "services": [],
"severity": "Medium",
- "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "subcategory": "Performance",
+ "text": "Enforce resource quotas on projects.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "87ab177a-db59-4f6b-a613-334fd09dc234",
+ "link": "https://docs.openshift.com/container-platform/4.13/machine_management/applying-autoscaling.html",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Performance",
+ "text": "Define ClusterAutoScaler and MachineAutoScaler to scale machines when your cluster runs out of resources to support more deployments.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "19db6128-1269-4040-a4ba-4d3e0804276d",
+ "link": "https://learn.microsoft.com/azure/openshift/support-policies-v4#supported-virtual-machine-sizes",
"services": [
- "WAF"
+ "VM"
],
"severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "subcategory": "Reliability",
+ "text": "Use virtual machine sizes that are large enough to contain multiple container instances so you get the benefits of increased density, but not so large that your cluster can't handle the workload of a failing node.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "services": [
- "WAF"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "4b98b15c-8b31-4aa5-aceb-58889135e227",
+ "link": "https://docs.openshift.com/container-platform/4.13/machine_management/deploying-machine-health-checks.html",
+ "services": [],
"severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "subcategory": "Reliability",
+ "text": "Deploy machine health checks to automatically repair damaged machines in a machine pool.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "896d31b6-6c67-4ba5-a119-c08e8f5d587c",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-metric-alerts",
"services": [
- "WAF"
+ "Monitor"
],
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "subcategory": "Reliability",
+ "text": "Use an alerting system to provide notifications when things need direct action: Container Insights metric alerts or in-built Alerting UI.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "services": [
- "WAF",
- "AppSvc"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "7e9ced16-acd1-476e-b9b2-41a998a57ae7",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview#availability-zones",
+ "services": [],
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "subcategory": "Reliability",
+ "text": "Ensure that the cluster is created in a region that supports AZs and create a machine set for each AZ.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "7b997e71-1b7d-4a8c-baa6-6e15d4d5ada9",
+ "link": "https://docs.openshift.com/container-platform/4.13/machine_management/creating-infrastructure-machinesets.html",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Reliability",
+ "text": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "7dc3e232-6bb2-435c-905e-1696fdedfa8a",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup#create-a-backup-with-velero-to-include-snapshots",
"services": [
- "WAF",
- "Storage"
+ "Backup"
],
"severity": "Medium",
- "text": "Consider the 'Azure security baseline for storage'",
- "waf": "Security"
+ "subcategory": "Reliability",
+ "text": "Create application backup and plan for restore and include persistent volumes in the backup.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "PrivateLink",
- "Storage"
- ],
- "severity": "High",
- "text": "Consider using private endpoints for Azure Storage",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "81c12318-1a64-4174-8583-3fb4ae3c2df7",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-priority.html",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Reliability",
+ "text": "Use pod priorities, so that in case of limited resources the most critical pods will run.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "43166c3b-cbe0-45bb-b209-d4a0da577784",
+ "link": "https://docs.openshift.com/container-platform/4.13/architecture/admission-plug-ins.html",
"services": [
- "WAF",
- "Storage",
- "Subscriptions",
- "RBAC"
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "Regulate cluster functions using admission plug-ins, which are commonly used to enforce security policy, resource limitations, or configuration requirements.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "24d21678-5d2f-4a56-a56a-d48408fe8273",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
"services": [
- "WAF",
- "Storage",
- "Defender"
+ "ACR"
],
- "severity": "High",
- "text": "Enable Microsoft Defender for all of your storage accounts",
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "Store your container images in Azure Container Registry and geo-replicate the registry to each region.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Storage"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "4c486ba2-80dc-4059-8cf7-5ee8e1309ccc",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-vertical-autoscaler.html",
+ "services": [],
"severity": "Medium",
- "text": "Enable 'soft delete' for blobs",
- "waf": "Security"
+ "subcategory": "Workload",
+ "text": "Optimize the CPU and memory request values, and maximize the efficiency of the cluster resources using vertical pod autoscaler.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "d579366b-cda2-4750-aa1a-bfe9d55d14c3",
+ "link": "https://docs.openshift.com/container-platform/4.13/applications/application-health.html",
"services": [
- "WAF",
- "Storage"
+ "Monitor"
],
"severity": "Medium",
- "text": "Disable 'soft delete' for blobs",
- "waf": "Security"
+ "subcategory": "Workload",
+ "text": "Add health probes to your pods to monitor application health. Make sure pods contain livenessProbe and readinessProbe. Use Startup probes to determine the point at which the application has started up.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Enable 'soft delete' for containers",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "c4929cb1-b3d1-4325-ae12-4ba34d0685ed",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-autoscaling.html",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Workload",
+ "text": "Scale pods to meet demand using horizontal pod autoscaler.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "dce9be3b-b0dd-4b3b-95fb-2ec14eeaa359",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-configuring.html#nodes-pods-pod-distruption-about_nodes-pods-configuring",
"services": [
- "WAF",
- "Storage"
+ "Cost"
],
"severity": "Medium",
- "text": "Disable 'soft delete' for containers",
- "waf": "Security"
+ "subcategory": "Workload",
+ "text": "Use disruption budgets to ensure the required number of pod replicas exist to handle expected application load.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Storage"
- ],
- "severity": "High",
- "text": "Enable resource locks on storage accounts",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Subscriptions",
- "Storage",
- "AzurePolicy"
- ],
- "severity": "High",
- "text": "Consider immutable blobs",
- "waf": "Security"
+ "category": "Operations management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "2829e2ed-b217-4367-9aff-6791b4935ada",
+ "link": "https://docs.openshift.com/container-platform/4.13/nodes/scheduling/nodes-scheduler-pod-topology-spread-constraints.html",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Workload",
+ "text": "Use pod topology constraints to automatically schedule pods on nodes throughout the cluster.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Storage"
- ],
- "severity": "High",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "waf": "Security"
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "fea1dbf3-dd95-4d48-a7c8-91dcb1f7d575",
+ "link": "https://learn.microsoft.com/azure/openshift/intro-openshift#service-level-agreement",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Availablity",
+ "text": "Leverage Current ARO SLA - 99.95 into BCDR planning",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Storage"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "b95e06e1-58e2-4ea3-a92c-2de6e2065b3a",
+ "link": "https://www.redhat.com/rhdc/managed-files/pa-getting-started-azure-openshift-ebook-f20686-201911-en_0.pdf",
+ "services": [],
"severity": "High",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
- "waf": "Security"
+ "subcategory": "Cluster Design",
+ "text": "Run user workloads on the worker nodes, not the control plane nodes",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "description": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines",
+ "guid": "76af4a69-1e88-439a-ba46-667e13c10567",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets",
"services": [
- "WAF",
- "Storage"
+ "AKS",
+ "VNet"
],
"severity": "Medium",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
- "waf": "Security"
+ "subcategory": "Cluster Design",
+ "text": "Isolate workloads into worker nodes running in individual subnets as needed",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "785c6fe9-6c96-4ad8-a44c-f3b2b38c886b",
+ "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup",
"services": [
- "WAF",
- "Storage"
+ "Backup"
],
- "severity": "High",
- "text": "Enforce the latest TLS version for a storage account",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Backup a cluster state for stateful workload scenarios to a paired region",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "a2c02149-9014-4a5d-9ce5-74dccbd9792a",
+ "link": "https://access.redhat.com/documentation/red_hat_openshift_container_storage/4.4/html/deploying_and_managing_openshift_container_storage_on_microsoft_azure/deploying-openshift-container-storage-on-microsoft-azure_rhocs",
"services": [
- "WAF",
- "Entra",
- "Storage"
+ "Storage",
+ "ACR"
],
- "severity": "High",
- "text": "Use Microsoft Entra ID tokens for blob access",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Data Store",
+ "text": "If container storage is required, ensure availability across regions if needed: Using RWX storage with inbuilt Azure Files storage class. Using CSI Drivers for storage provisioning",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "RBAC"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "6bcca2b4-fea1-4dbf-9dd9-5d48c7c891dc",
+ "link": "https://docs.openshift.com/aro/3/dev_guide/persistent_volumes.html",
+ "services": [],
"severity": "Medium",
- "text": "Least privilege in IaM permissions",
- "waf": "Security"
+ "subcategory": "Data Store",
+ "text": "Whenever possible, move state out of containers and into external databases that support multi-region replication. Avoid Persistent Volumes",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Entra",
- "Storage"
- ],
+ "category": "Platform Automation",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "42324ece-81c1-4231-a1a6-417415833fb4",
+ "link": "https://docs.openshift.com/container-platform/4.13/applications/deployments/route-based-deployment-strategies.html",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Workload",
+ "text": "Consider blue/green or canary strategies to deploy new releases of application.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "ae3c2df7-4316-46c3-acbe-05bbe209d4a0",
+ "link": "https://docs.openshift.com/container-platform/4.13/cicd/gitops/understanding-openshift-gitops.html",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Workload",
+ "text": "Consider using Red Hat OpenShift GitOps. Red Hat OpenShift GitOps uses Argo CD to maintain cluster resources and support application CI/CD.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "da577784-24d2-4167-a5d2-fa56c56ad484",
+ "link": "https://learn.microsoft.com/azure/openshift/support-lifecycle",
+ "services": [],
"severity": "High",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "subcategory": "Control plane",
+ "text": "Keep your clusters on the latest OpenShift version to avoid potential security or upgrade issues.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8",
+ "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster",
"services": [
- "Storage",
- "WAF",
- "Monitor",
- "Entra",
- "AKV"
+ "AKS",
+ "Arc"
],
"severity": "High",
- "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
+ "subcategory": "Control plane",
+ "text": "Connect Azure Red Hat OpenShift clusters to Azure Arc-enabled Kubernetes.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "e1309ccc-d579-4366-acda-2750aa1abfe9",
+ "link": "https://docs.openshift.com/container-platform/4.10/security/encrypting-etcd.html",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Encryption",
+ "text": "For Azure Red Hat OpenShift 4 clusters, etcd data isn't encrypted by default, but it's recommended to enable etcd encryption to provide another layer of data security.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
"services": [
- "Storage",
- "AzurePolicy",
- "WAF",
- "Monitor",
- "AKV"
+ "Defender",
+ "AKS",
+ "Arc"
],
- "severity": "High",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "severity": "Medium",
+ "subcategory": "Posture",
+ "text": "Use Microsoft Defender for Containers supported via Arc-enabled Kubernetes to secure clusters, containers, and applications.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1",
+ "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider",
"services": [
- "WAF",
"AKV",
- "Storage",
- "AzurePolicy"
+ "AKS",
+ "Arc"
],
"severity": "Medium",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "subcategory": "Secrets",
+ "text": "For applications that require access to sensitive information, use a service principal and the AKV Secrets Provider with the extension for Arc-enabled Kubernetes clusters.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "4eeaa359-2829-4e2e-bb21-73676aff6791",
+ "link": "https://learn.microsoft.com/azure/aks/developer-best-practices-pod-security#secure-pod-access-to-resources",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Workload",
+ "text": "Secure pod access to resources. Provide the least number of permissions, and avoid using root or privileged escalation.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "b4935ada-4232-44ec-b81c-123181a64174",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes",
"services": [
- "WAF",
+ "Monitor",
"AzurePolicy"
],
"severity": "Medium",
- "text": "Consider configuring an SAS expiration policy",
+ "subcategory": "Workload",
+ "text": "Monitor and enforce configuration by using the Azure Policy Extension.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "15833fb4-ae3c-42df-9431-66c3bcbe05bb",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
"services": [
- "WAF",
- "AKV",
- "Storage",
- "AzurePolicy"
+ "Defender"
],
- "severity": "Medium",
- "text": "Consider linking SAS to a stored access policy",
+ "severity": "High",
+ "subcategory": "Workload",
+ "text": "Scan your images for vulnerabilities with Microsoft Defender or any other image scanning solution.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "category": "Security",
+ "checklist": "Azure Red Hat OpenShift",
+ "guid": "e209d4a0-da57-4778-924d-216785d2fa56",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
"services": [
- "WAF",
- "AKV",
- "Storage"
+ "ACR",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "severity": "Low",
+ "subcategory": "Workload",
+ "text": "Deploy a dedicated and private instance of Azure Container Registry to each landing zone subscription.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "9f519499-5820-4060-88fe-cab4538c9dd0",
+ "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements",
"services": [
- "WAF",
- "Entra",
"Storage"
],
- "severity": "High",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Physical",
+ "text": "All planned storage pools should use direct-attached storage (SATA, SAS, NVMe)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "f7c015e0-7d97-4283-b006-567afeb2b5ca",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/drive-symmetry-considerations#understand-capacity-imbalance",
"services": [
- "WAF",
"Storage",
- "AzurePolicy"
+ "ACR"
],
- "severity": "High",
- "text": "Strive for short validity periods for ad-hoc SAS",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Physical",
+ "text": "Disks are symmetrical across all nodes",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "f785b143-2c1e-4466-9baa-dde8ba4c7aaa",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity",
"services": [
- "WAF"
+ "Backup",
+ "Storage"
],
"severity": "Medium",
- "text": "Apply a narrow scope to a SAS",
- "waf": "Security"
+ "subcategory": "S2D",
+ "text": "Parity type disk redundancy should only be used for low I/O volumes (backup/archive)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8a705965-9840-43cc-93b3-06d089406bb4",
+ "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements#physical-deployments",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
- "waf": "Security"
+ "subcategory": "S2D",
+ "text": "Ensure there at least 2 capacity disks with available capacity in the Storage Pool",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "2a4f629a-d623-4610-a8e3-d6fd66057d8e",
+ "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/delimit-volume-allocation",
"services": [
- "WAF",
"Storage"
],
"severity": "Low",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
- "waf": "Security"
+ "subcategory": "S2D",
+ "text": "'Delimited allocation' has been considered to improve volume resiliency in a multi-node failure",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "960eb9be-1f0f-4fc1-9b31-fcf1cf9e34e6",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#choosing-how-many-volumes-to-create",
"services": [
- "WAF",
- "Entra",
- "Storage",
- "RBAC"
+ "Storage"
],
- "severity": "High",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "S2D",
+ "text": "CSVs are created in multiples of node count",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "859ba2b9-a3a8-4ca1-bb61-165effbf1c03",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/cache",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
- "waf": "Security"
+ "subcategory": "S2D",
+ "text": "If a cache tier is implemented, the number of capacity drives is a multiple of the number of cache drives",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "d8a65f05-db06-461d-81dc-7899ad3f8f1e",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#reserve-capacity",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy"
+ "Storage"
],
- "severity": "High",
- "text": "Avoid overly broad CORS policies",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "S2D",
+ "text": "A minimum of 1 type of each disk type per node has been factored as a reserve disk",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "description": "VMFleet is a tool that can be used to measure the performance of a storage subsystem, best used to baseline performance prior to workload deployment",
+ "guid": "9d138f1d-5363-476e-bbd7-acfa500bdc0c",
+ "link": "https://github.com/microsoft/diskspd/wiki/VMFleet",
"services": [
- "WAF",
"Storage"
],
- "severity": "High",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "S2D",
+ "text": "VMFleet has been run prior to workload deployment to baseline storage performance",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "13c12e2a-c938-4dd1-9223-507d5e17f9c5",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Determine which/if platform encryption should be used.",
- "waf": "Security"
+ "subcategory": "Host OS",
+ "text": "OS drives use a dedicated storage controller",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "category": "Storage",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "a631e7dc-8879-45bd-b0a7-e5927b805428",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-csv-cache",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Determine which/if client-side encryption should be used.",
- "waf": "Security"
+ "subcategory": "Host OS",
+ "text": "CSV in-memory read caching is enabled and properly configured",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "c062cd9a-f1db-4f83-aab3-9cb03f56c140",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements#switch-embedded-teaming-set",
"services": [
- "WAF",
- "Storage"
+ "ACR"
],
- "severity": "High",
- "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Host",
+ "text": "NICs are symmetrical across nodes",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "ea8054db-a558-4533-80c8-5d9cf447ba19",
"services": [
- "WAF",
"Storage"
],
"severity": "High",
- "text": "Leverage a storagev2 account type for better performance and reliability",
+ "subcategory": "Host",
+ "text": "Storage networking is redundant",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
- "services": [
- "WAF",
- "Storage"
- ],
- "severity": "High",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "15d976c5-e267-49a1-8b00-62010bfa5188",
+ "link": "https://learn.microsoft.com/azure-stack/hci/deploy/network-atc",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Host",
+ "text": "Host networking configuration is managed by Network ATC and intents are healthy",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "676c53ad-b29a-4de1-9d03-d7d2674405b8",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/network-hud-overview",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Host",
+ "text": "Network HUD has been configured",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8f6d58d9-6c1a-4ec1-b2d7-b2c6ba8f3949",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements",
"services": [
- "WAF"
+ "Storage",
+ "VNet"
],
"severity": "Medium",
- "text": "For write operation after failover, use customer-Managed Failover ",
+ "subcategory": "Host",
+ "text": "Storage NICs are assigned static IP addresses on separate subnets and VLANs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
- "services": [
- "WAF"
- ],
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "824e53ec-953e-40c2-a6b8-52970b5b0f74",
+ "link": "https://learn.microsoft.com/azure-stack/hci/plan/two-node-switched-converged",
+ "services": [],
"severity": "Medium",
- "text": "Understand Microsoft-Managed Failover details",
+ "subcategory": "Host",
+ "text": "For switchless designs, dual link full mesh connectivity has been implemented",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "dbc85d0e-0ebd-4589-a789-0fa8ceb1d0f0",
+ "link": "https://learn.microsoft.com/azure-stack/hci/concepts/physical-network-requirements#using-switchless",
"services": [
- "WAF"
+ "Storage"
],
"severity": "Medium",
- "text": "Enable Soft Delete",
+ "subcategory": "Host",
+ "text": "If the cluster is made up of more than 3 nodes, a switched storage network has been implemented",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "603c6d71-59d2-419c-a312-8edc6e799c6a",
"services": [
- "WAF"
+ "Storage"
],
+ "severity": "High",
+ "subcategory": "Host",
+ "text": "RDMA is enabled on the Storage networking",
+ "waf": "Performance"
+ },
+ {
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "9e260eae-bca1-4827-a259-76ee63fda8d6",
+ "link": "https://github.com/microsoft/SDN/blob/master/Diagnostics/Test-Rdma.ps1",
+ "services": [],
"severity": "Medium",
- "text": "Follow reliability support recommendations in Azure Bot Service",
- "waf": "Reliability"
+ "subcategory": "Host",
+ "text": "Test-RDMA.ps1 has been run to validate the RDMA configuration",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "description": "This ensures that Management traffic is not exposed to the VM traffic",
+ "guid": "abc85d0e-0ebd-4589-a777-0fa8ceb1d0f0",
+ "link": "",
"services": [
- "WAF"
+ "VM"
],
"severity": "Medium",
- "text": "Deploying bots with local data residency and regional compliance",
- "waf": "Reliability"
+ "subcategory": "Host",
+ "text": "If a VMSwitch is shared for Compute and Management traffic, require that Management traffic is tagged with a VLAN ID",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "description": "This ensures you have at least 3 NCs active at all times during NC upgrades.",
+ "guid": "eb36f5f4-0fa7-4a2c-85f3-1b1c7c7817c0",
"services": [
- "WAF"
+ "VM"
],
"severity": "Medium",
- "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "subcategory": "SDN",
+ "text": "There are at least 3 Network Controller VMs deployed",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8bc78c85-6028-4a43-af2d-082a0a344909",
+ "link": "https://learn.microsoft.com/windows-server/networking/sdn/manage/update-backup-restore",
"services": [
- "WAF"
+ "Backup"
],
- "severity": "Medium",
- "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "SDN",
+ "text": "Backups of SDN infrastructure are configured and tested",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "51eaa4b6-b9a7-43e1-a7dc-634d3107bc6d",
"services": [
- "WAF",
- "TrafficManager",
- "FrontDoor"
+ "Monitor"
],
"severity": "Medium",
- "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
- "waf": "Reliability"
+ "subcategory": "Cluster",
+ "text": "SCOM Managed Instance has been considered for more complex monitoring and alerting scenarios",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "831f5aca-99ef-41e7-8263-9509f5093b43",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/setup-hci-system-alerts",
"services": [
- "WAF",
- "ACR"
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": "Cluster",
+ "text": "Alerts have been configured for the cluster, either using Azure Monitor, SCOM, or a third-party solution",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "f95d0e7e-9f61-476d-bf65-59f2454d1d39",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later",
+ "services": [
+ "Monitor"
],
"severity": "Medium",
- "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
- "waf": "Reliability"
+ "subcategory": "Cluster",
+ "text": "Insights has been enabled at the cluster level and all nodes are reporting data",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "f4250fcb-ff53-40c9-b304-3560464fd90c",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later",
"services": [
- "WAF"
+ "Monitor"
],
"severity": "Medium",
- "text": "Use more than 1 app instance for your apps",
- "waf": "Reliability"
+ "subcategory": "Cluster",
+ "text": "Azure Monitoring Agent has been deployed to hosts and an appropriate Data Collection Rule has been configured",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "6143af1d-0d1a-4163-b1c9-662f7459bb98",
"services": [
- "WAF",
"Monitor"
],
"severity": "Medium",
- "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
- "waf": "Reliability"
+ "subcategory": "Hardware",
+ "text": "Relevant hardware monitoring has been configured",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
+ "category": "Management and Monitoring",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "9cbdf225-549a-41cf-9c97-794766a6f2b0",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/health-service-overview",
"services": [
- "WAF"
+ "Monitor"
],
"severity": "Medium",
- "text": "Set up autoscaling in Spring Cloud Gateway",
- "waf": "Reliability"
+ "subcategory": "Hardware",
+ "text": "Relevant hardware alerting has been configured",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "c0da5bbd-0f0d-4a26-98ec-38c9cc42b323",
"services": [
- "WAF"
+ "VM"
],
"severity": "Low",
- "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
- "waf": "Reliability"
+ "subcategory": "VM Management - Resource Bridge",
+ "text": "The Azure CLI has been installed on every node to enable RB management from WAC",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "WAF checklist",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "a8ecf23c-c048-4fa9-b87b-51ebfb409863",
"services": [
- "WAF"
+ "VM"
],
- "severity": "Medium",
- "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "VM Management - Resource Bridge",
+ "text": "DHCP is available in the cluster to support Guest Configuration at VM deployment from Azure",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
+ "category": "Backup and Disaster Recovery",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "074541e3-fe08-458a-8062-32d13dcc10c6",
+ "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines",
"services": [
- "WAF"
+ "Backup",
+ "VM",
+ "ASR"
],
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
- "waf": "Reliability"
+ "subcategory": "VM",
+ "text": "Backups of HCI VMs have been configured using MABS or a third-party solution",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF"
- ],
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "48f7ae57-1035-4101-8a38-fbe163d03e8a",
+ "services": [],
"severity": "High",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
+ "subcategory": "Cluster Configuration",
+ "text": "Cluster configuration or a configuration script has been documented and maintained",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF"
- ],
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "f2a6a19a-ffe6-444d-badb-cb336c8e7b50",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/witness",
+ "services": [],
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "subcategory": "Cluster Configuration",
+ "text": "A cluster witness has been configured for clusters with less than 5 nodes",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF",
- "AppSvc"
- ],
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "a47339fe-62c5-44a0-bb83-3d46ef16292f",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/update-cluster",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Cluster Configuration",
+ "text": "Cluster-Aware Updating has been configured for Windows and hardware updates (if available)",
+ "waf": "Operations"
+ },
+ {
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "7f1d6fe8-3079-44ea-8ea6-14494d1aa470",
+ "link": "https://learn.microsoft.com/azure-stack/hci/deploy/validate",
+ "services": [],
"severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "subcategory": "Cluster Configuration",
+ "text": "Cluster validation has been run against the configured cluster",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "81693af0-5638-4aa2-a153-1d6189df30a7",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits",
"services": [
- "WAF",
- "ASR"
+ "VM"
],
"severity": "Medium",
- "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "subcategory": "Cluster Configuration",
+ "text": "Azure Benefits has been enabled at the cluster and VM levels",
+ "waf": "Cost"
+ },
+ {
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8c967ee8-8170-4537-a28d-33431cd3632a",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-environment-checker",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Cluster Configuration",
+ "text": "The Environment Checker module has been run to validate the environment",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "43ffbfab-766e-4950-a102-78b479136e4d",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits",
"services": [
- "WAF",
- "Entra"
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "subcategory": "Cluster Configuration",
+ "text": "Group Policy inheritance on the HCI cluster and node Active Directory organizational unit has been blocked or applied policies have been evaluated for compatibility issues (usually WinRM and PowerShell execution policy)",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "e6a3f3a7-4a7d-49e2-985a-6e39dd284027",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Cluster Configuration",
+ "text": "WAC is on the latest release and configured to automatically upgrade extensions",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "d1caa31f-cc26-42b2-b92f-2b667c0e6020",
+ "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr",
"services": [
- "WAF",
"Entra"
],
- "severity": "Low",
- "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Stretch Clustering",
+ "text": "There is sub 5ms latency between each site if synchronous replication is being configured AAD",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "3277558e-3155-4088-b49a-78594cb4ce1a",
"services": [
- "WAF"
+ "Storage",
+ "VNet"
],
"severity": "High",
- "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
- "waf": "Operations"
+ "subcategory": "Stretch Clustering",
+ "text": "Management, Replication and Storage networks excluded from stretched VLANs configurations, are routed, and in different subnets",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
- "services": [
- "WAF"
- ],
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "baed6066-8531-44ba-bd94-38cbabbf4099",
+ "services": [],
"severity": "High",
- "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "Cost"
+ "subcategory": "Stretch Clustering",
+ "text": "There is a plan detailed for site failure and recovery",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
+ "category": "Networking",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b4",
"services": [
- "WAF",
- "ACR",
- "RBAC",
- "Subscriptions"
- ],
- "severity": "High",
- "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
- },
- {
- "checklist": "WAF checklist",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
- "services": [
- "WAF"
+ "ACR"
],
"severity": "Medium",
- "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "subcategory": "Stretch Clustering",
+ "text": "Separate vLANs and networks are used for each replication network across both sites",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b5",
+ "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization",
"services": [
- "WAF",
- "Entra"
+ "Storage"
],
- "severity": "Medium",
- "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Stretch Clustering",
+ "text": "Use either a cloud witness or a file share witness in a third site for cluster quorum for clusters with less than 5 nodes",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
- "services": [
- "WAF",
- "Entra",
- "AzurePolicy"
- ],
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b6",
+ "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization",
+ "services": [],
"severity": "High",
- "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "subcategory": "Stretch Clustering",
+ "text": "When using data deduplication, only enable it on the primary/source volumes",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "category": "Operations",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "ac527887-f6f4-40a3-b883-e04d704f013b",
+ "link": "https://learn.microsoft.com/windows-server/storage/storage-replica/stretch-cluster-replication-using-shared-storage#provision-operating-system-features-roles-storage-and-network",
"services": [
- "WAF"
+ "Storage"
],
"severity": "High",
- "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "Security"
+ "subcategory": "Stretch Clustering",
+ "text": "Storage backing log volumes must be faster (ideally) or at least as fast as capacity storage",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
+ "category": "Backup and Disaster Recovery",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8ea49f70-1038-4283-b0c4-230165d3eabc",
+ "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-site-recovery",
"services": [
- "WAF",
- "Entra"
+ "Backup",
+ "ASR"
],
"severity": "Medium",
- "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "subcategory": "Disaster Recovery",
+ "text": "Azure Site Recovery has been considered for DR purposes",
+ "waf": "Operations"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "03e65fdc-2628-4a1a-ba2e-a5174340ba52",
+ "link": "https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Host",
+ "text": "BitLocker has been enabled on CSVs for volume encryption, where appropriate",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "services": [
- "WAF",
- "Entra"
- ],
+ "category": "Security",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "9645d2e6-ba28-453c-b6d5-d9ef29fc34be",
+ "link": "https://learn.microsoft.com/windows-server/storage/file-server/smb-security",
+ "services": [],
"severity": "Medium",
- "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "subcategory": "Host",
+ "text": "SMB encryption has been enabled, where appropriate",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "category": "Security",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "8f03437a-5068-4486-9a78-0402ce771298",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server",
"services": [
- "WAF",
- "Entra"
+ "Defender"
],
"severity": "Medium",
- "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "Reliability"
+ "subcategory": "Host",
+ "text": "Microsoft Defender Antivirus has been enabled on all nodes",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
- "services": [
- "WAF",
- "Monitor",
- "Entra"
- ],
+ "category": "Security",
+ "checklist": "Azure Stack HCI Review",
+ "guid": "dba6b211-fc02-43b3-b7c8-f163c188332e",
+ "link": "https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage",
+ "services": [],
"severity": "Medium",
- "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "subcategory": "Host",
+ "text": "Credential Guard has been configured, where appropriate",
"waf": "Security"
},
{
- "ammp": true,
- "checklist": "WAF checklist",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
- "services": [
- "WAF",
- "Entra"
- ],
+ "category": "BC and DR",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
+ "services": [],
"severity": "High",
- "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
- "services": [
- "WAF",
- "Entra",
- "RBAC"
- ],
- "severity": "Medium",
- "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Security"
+ "category": "BC and DR",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
- "services": [
- "WAF",
- "Entra"
- ],
- "severity": "Medium",
- "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Security"
+ "category": "BC and DR",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "category": "BC and DR",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"services": [
- "WAF",
- "VNet"
+ "AppSvc"
],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Application Deployment",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
+ "services": [],
"severity": "Medium",
- "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "subcategory": "CI/CD",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
- "services": [
- "VPN",
- "DNS",
- "NVA",
- "Firewall",
- "WAF",
- "ExpressRoute",
- "Entra",
- "VNet"
- ],
+ "category": "BC and DR",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
+ "services": [],
"severity": "High",
- "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Cost"
+ "subcategory": "High Availability",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
- "services": [
- "WAF",
- "DDoS"
- ],
+ "category": "BC and DR",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
+ "services": [],
"severity": "High",
- "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
- "services": [
- "WAF",
- "NVA"
- ],
- "severity": "Medium",
- "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "category": "BC and DR",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Learn how to trigger a manual failover.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "services": [
- "WAF",
- "ExpressRoute",
- "ARS",
- "VPN"
- ],
- "severity": "Low",
- "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Security"
+ "category": "BC and DR",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Learn how to fail back after a failover.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
- "services": [
- "WAF",
- "ARS",
- "VNet"
- ],
- "severity": "Low",
- "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Security"
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availablity",
+ "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
- "services": [
- "WAF",
- "ACR",
- "VNet"
- ],
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "services": [],
"severity": "Medium",
- "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
- "waf": "Performance"
+ "subcategory": "High Availablity",
+ "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
- "services": [
- "WAF",
- "Monitor"
- ],
- "severity": "Medium",
- "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Operations"
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availablity",
+ "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"services": [
- "WAF",
- "ExpressRoute",
- "VNet"
+ "ACR"
],
"severity": "Medium",
- "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "subcategory": "Georeplication",
+ "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"services": [
- "WAF",
- "Storage"
+ "ACR"
],
"severity": "Medium",
- "text": "Limit the number of routes per route table to 400.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "subcategory": "Georeplication",
+ "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"services": [
- "WAF",
- "VNet"
+ "TrafficManager"
],
- "severity": "High",
- "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "severity": "Medium",
+ "subcategory": "Georeplication",
+ "text": "Use Azure Traffic Manager to coordinate requests",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "category": "Operations Management",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"services": [
- "WAF",
- "LoadBalancer"
+ "Backup",
+ "Storage",
+ "ASR"
],
"severity": "High",
- "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
+ "subcategory": "Disaster Recovery",
+ "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
- "services": [
- "WAF",
- "LoadBalancer"
- ],
- "severity": "High",
- "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
+ "category": "Operations management",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "High Availablity",
+ "text": "Follow reliability support recommendations in Azure Bot Service",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
- "services": [
- "WAF",
- "ExpressRoute"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
+ "services": [],
"severity": "Medium",
- "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "subcategory": "High Availablity",
+ "text": "Deploying bots with local data residency and regional compliance",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
- "services": [
- "WAF",
- "ExpressRoute",
- "VPN"
- ],
+ "category": "Operations management",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
+ "services": [],
"severity": "Medium",
- "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Security"
+ "subcategory": "High Availablity",
+ "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
"services": [
- "WAF",
- "ACR"
+ "Cost",
+ "Monitor"
],
- "severity": "High",
- "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Azure Monitor - enforce data collection rules",
+ "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
"services": [
- "WAF"
+ "Backup",
+ "Cost"
],
"severity": "Medium",
- "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "subcategory": "Backup",
+ "text": "check backup instances with the underlying datasource not found",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
"services": [
- "WAF",
- "VNet"
+ "Cost"
],
- "severity": "High",
- "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Delete/archive",
+ "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "659d3958-fd77-4289-a835-556df2bfe456",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "WAF",
- "ASR"
+ "Cost"
],
- "severity": "High",
- "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Delete/archive",
+ "text": "Consider snooze and stop technique (snooze a service after x days, stop after 2x, delete/deallocate after 3x)",
+ "waf": "Cost"
},
{
- "checklist": "WAF checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "WAF",
- "ACR"
+ "Storage",
+ "Backup",
+ "Cost"
],
- "severity": "High",
- "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Delete/archive",
+ "text": "Delete or archive unused resources (old backups, logs, storage accounts, etc...)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
"services": [
- "WAF",
- "DNS"
+ "Storage",
+ "Backup",
+ "Cost",
+ "ASR"
],
"severity": "Medium",
- "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operations"
+ "subcategory": "Delete/archive",
+ "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
"services": [
- "WAF",
- "ACR",
- "DNS"
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "Security"
+ "subcategory": "Log Analytics retention for workspaces",
+ "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
"services": [
- "WAF",
- "DNS"
+ "Storage",
+ "Cost",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Policy",
+ "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "59bb91a3-ed90-4cae-8cc8-4c37b6b780cb",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
"services": [
- "WAF",
- "DNS",
- "VM",
- "VNet"
+ "Cost"
],
- "severity": "High",
- "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Run orphaned resources workbook - delete or snooze ghost items",
+ "text": "https://github.com/dolevshor/azure-orphan-resources",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9fe5c464-89d4-457a-a27c-3874d0102cac",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
"services": [
- "WAF",
- "DNS"
+ "Cost"
],
"severity": "Medium",
- "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "subcategory": "Shutdown/deallocate",
+ "text": "Shutdown underutilized instances",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/analyze-unexpected-charges",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "WAF checklist",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
"services": [
- "WAF",
- "Bastion"
+ "Storage",
+ "Backup",
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Use Azure Bastion to securely connect to your network.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Security"
+ "subcategory": "stopped/deallocated VMs: check disks",
+ "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
"services": [
- "WAF",
- "Bastion",
- "VNet"
+ "Storage",
+ "Cost",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Use Azure Bastion in a subnet /26 or larger.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Security"
+ "subcategory": "storage accounts lifecycle policy",
+ "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "WAF checklist",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "category": "Cleanup",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "f2bfe456-3b0d-4834-a348-726de69c6b5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "WAF",
- "ACR",
- "FrontDoor",
- "AzurePolicy"
+ "Cost"
],
"severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Tagging",
+ "text": "Use specific tags for temporary items with 'delete by DATE' format - and automate monthly cleanup",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "WAF checklist",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "category": "DB/App tuning",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a26494b-69ba-4d37-aad5-3cc78e1d7666",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "Cost"
],
- "severity": "Low",
- "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "DB optimization",
+ "text": "Plan for db optimization with the intent of downsizing the related services (and improve performance)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "WAF checklist",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "category": "DB/APP tuning",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7357c449-674b-45ed-a5a8-59c7733be2a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "WAF",
- "VNet"
+ "Cost"
],
- "severity": "High",
- "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "App modernization",
+ "text": "Modernizing the app towards a microservices architecture will have the effect of letting the app scale according to the single service and not the entire stack",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "category": "DB/APP tuning",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a27b765a-91be-41f3-a8ef-394c2bd463cb",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "WAF",
- "DDoS",
- "VNet"
+ "Storage",
+ "Cost",
+ "VM"
],
- "severity": "High",
- "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "DB optimization",
+ "text": "optimizing the DB queries will increase performance and allow better right-sizing of storage and VMs",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
+ "category": "DB/APP tuning",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "bac75819-59bb-491a-9ed9-0cae2cc84c37",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "WAF"
+ "Cost"
],
- "severity": "High",
- "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Demand shaping",
+ "text": "Using demand shaping on PaaS services will optimize costs and performances",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b6b780cb-9fe5-4c46-989d-457a927c3874",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
"services": [
- "WAF",
- "DDoS"
+ "Entra",
+ "Cost"
],
- "severity": "High",
- "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Advisor",
+ "text": "Start from the Azure Advisor page suggestions.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
"services": [
- "WAF",
- "AzurePolicy",
+ "Cost",
"VM"
],
- "severity": "High",
- "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Advisor",
+ "text": "Make sure advisor is configured for VM right sizing ",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "881a1bd5-d1e4-44a1-a659-d3958fd77289",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN",
- "Backup"
+ "Cost"
],
"severity": "Medium",
- "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "subcategory": "Automation",
+ "text": "Consider implementing IaC scripts or devops pipelines to match the cost governance process",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b835556d-f2bf-4e45-93b0-d834a348726d",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "Automation",
+ "text": "Set up cost alerts for applications that have variable costs (ideally for all of them)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e69c6b5c-2a26-4494-a69b-ad37aad53cc7",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN"
+ "Cost"
],
"severity": "Medium",
- "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "subcategory": "Automation",
+ "text": "Use Azure Automation: Automate repetitive tasks can help you save time and resources, reducing costs in the process. ",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8e1d7666-7357-4c44-a674-b5ed85a859c7",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "WAF",
- "ExpressRoute",
"Cost"
],
- "severity": "High",
- "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "severity": "Medium",
+ "subcategory": "Automation",
+ "text": "Run orphaned resources workbook",
"waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "733be2a1-a27b-4765-a91b-e1f388ef394c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
"services": [
- "WAF",
- "ExpressRoute",
+ "Storage",
"Cost"
],
- "severity": "High",
- "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "severity": "Medium",
+ "subcategory": "Baseline",
+ "text": "Try and establish a baseline of monthly spending and an acceptable saving target against the baseline (new services will not be optimized at this stage)",
"waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2bd463cb-bac7-4581-a59b-b91a3ed90cae",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "Baseline",
+ "text": "Establish a cost optimization baseline by using a policy that tags every new resource as #NEW",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2cc84c37-b6b7-480c-a9fe-5c46489d457a",
+ "link": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management-config",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost"
],
"severity": "Medium",
- "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "subcategory": "Baseline",
+ "text": "Organize resources to maximize cost insights and accountability",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "927c3874-d010-42ca-a6aa-e01e6a84de5d",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost"
],
"severity": "Medium",
- "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "subcategory": "Budgets",
+ "text": "Create budgets",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e36d1d92-881a-41bd-9d1e-44a19659d395",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
"services": [
- "WAF",
- "VPN"
+ "Cost"
],
"severity": "Medium",
- "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "subcategory": "Cost Analysis",
+ "text": "In cost analysis - use daily granularity, grouped by service name to analyze the spending of the past 3 months and identify the top 3 spenders",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "WAF checklist",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8fd77289-b835-4556-bf2b-fe4563b0d834",
+ "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
"services": [
- "WAF",
- "VPN"
+ "Cost"
],
"severity": "Medium",
- "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "subcategory": "Cost Analysis",
+ "text": "Check daily for cost spikes and anomalies (ideally with automatic billing exports)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a348726d-e69c-46b5-a2a2-6494b69bad37",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
"services": [
- "WAF",
- "ExpressRoute",
"Cost"
],
- "severity": "High",
- "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "severity": "Medium",
+ "subcategory": "Cost Analysis",
+ "text": "Automate cost retrieval for deep analysis or integration",
"waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "aad53cc7-8e1d-4766-9735-7c449674b5ed",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost",
+ "ACR"
],
"severity": "Medium",
- "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "subcategory": "Free services",
+ "text": "Take advantage of Azure free services: Azure offers a number of free services, such as DevOps, Azure Container Registry, and Azure Logic Apps, that can help you save costs on development and operations. ",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "96c96ad8-844c-4f3b-8b38-c886ba2c0214",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
"services": [
- "WAF",
- "Monitor",
- "ExpressRoute"
+ "Cost"
],
"severity": "Medium",
- "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "subcategory": "Tagging",
+ "text": "Tag shared resources",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
+ "category": "Process Administration",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "99014a5d-3ce5-474d-acbd-9792a6bcca2b",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
"services": [
- "WAF",
- "ACR",
- "Monitor",
- "NetworkWatcher"
+ "Cost"
],
"severity": "Medium",
- "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "subcategory": "Tagging",
+ "text": "Consider using tags to all services for cost allocation",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "category": "reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4fea1dbf-3dd9-45d4-ac7c-891dcb1f7d57",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost"
],
"severity": "Medium",
- "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "automation",
+ "text": "Consider Reservation automation to track and promptly react to changes",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "description": "check by searching the Meter Category Licenses in the Cost analysys",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN"
+ "AzurePolicy",
+ "SQL",
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL",
+ "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
"services": [
- "WAF",
- "Storage",
- "VNet"
+ "Cost",
+ "LoadBalancer"
],
- "severity": "High",
- "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Check Red Hat Licences if applicable",
+ "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a76af4a6-91e8-4839-ada4-6667e13c1056",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
"services": [
- "WAF",
- "ACR",
- "ExpressRoute"
+ "AppSvc",
+ "Cost"
],
- "severity": "High",
- "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Functions",
+ "text": "Saving plans will provide 17% on select app service plans",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "Planning",
+ "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
"services": [
- "WAF"
+ "ARS",
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "subcategory": "Reservations/savings plans",
+ "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a785c6fe-96c9-46ad-a844-cf3b2b38c886",
+ "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
"services": [
- "WAF",
- "ExpressRoute"
+ "Cost"
],
- "severity": "High",
- "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Reservations/savings plans",
+ "text": "Plan for Azure Savings Plans for all the workloads that are dynamic and need maximum flexibility",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ba2c0214-9901-44a5-b3ce-574dccbd9792",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
"services": [
- "WAF",
- "Monitor",
- "ExpressRoute",
- "VNet"
+ "Cost"
],
"severity": "Medium",
- "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "subcategory": "Reservations/savings plans",
+ "text": "Plan for Azure Reservations for all the workloads that are less dynamic and won't change much",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
"services": [
- "WAF",
- "ExpressRoute",
- "VNet"
+ "Storage",
+ "Cost"
],
"severity": "Medium",
- "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "subcategory": "Reserve storage",
+ "text": "Only larger disks can be reserved => 1 TiB -",
+ "waf": "Cost"
},
{
- "checklist": "WAF checklist",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
"services": [
- "WAF",
- "ACR"
+ "Cost",
+ "VM"
],
- "severity": "Low",
- "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Reserve VMs with normalized and rationalized sizes",
+ "text": "After the right-sizing optimization",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
"services": [
- "WAF",
- "Firewall"
+ "SQL",
+ "Cost",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "SQL Database AHUB",
+ "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
"services": [
- "ACR",
- "AzurePolicy",
- "Firewall",
- "WAF",
- "RBAC"
+ "SQL",
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "SQL Database Reservations",
+ "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e13c1056-75c1-4e94-9b45-9837ff7ae7c6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities",
"services": [
- "WAF",
- "Firewall"
+ "Cost"
],
- "severity": "Low",
- "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Tracking",
+ "text": "Make sure you Azure Reservations and Savings plans are close to 100% utilization or make the necessary changes to reach it.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
+ "category": "Reservations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3b475a5-c7ac-4be4-abbe-64dd89f2e877",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations",
"services": [
- "WAF",
- "DNS",
- "Firewall"
+ "Cost",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Tracking",
+ "text": "Make sure that your reservations usage is close to 100%. If not, either enforce an allowed SKU policy or exchange the reservation",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "78468d55-a785-4c6f-b96c-96ad8844cf3b",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review",
"services": [
- "WAF",
- "Firewall"
+ "Cost",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Use Azure Firewall Premium to enable additional security features.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automation",
+ "text": "Plan and enforce a On/Off policy for production services, where possible",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2b38c886-ba2c-4021-9990-14a5d3ce574d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
"services": [
- "WAF",
- "Firewall"
+ "Cost",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automation",
+ "text": "Plan and enforce a On-Demand policy with auto-shutdown for non-production services, where possible",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
"services": [
- "WAF",
- "Firewall"
+ "Cost",
+ "VM"
],
- "severity": "High",
- "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Autoscale",
+ "text": "Consider using a VMSS to match demand rather than flat sizing",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
"services": [
- "Storage",
- "NVA",
- "Firewall",
- "WAF",
- "VWAN",
- "VNet"
+ "AKS",
+ "Cost"
],
- "severity": "High",
- "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Autoscale",
+ "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "93665720-2bff-4456-9b0d-934a359c363e",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
"services": [
- "WAF",
- "Storage",
- "Firewall"
+ "Cost"
],
"severity": "Medium",
- "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "subcategory": "Autoscale",
+ "text": "Right-size PaaS service according to average use and accomodate spikes with auto or manual scaling",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7dd61623-a364-4a90-9eba-e38ead53cc7d",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"services": [
- "WAF",
- "AzurePolicy",
- "Firewall"
+ "Cost"
],
- "severity": "Important",
- "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Autoscale",
+ "text": "Plan for demand shaping where applicable",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e2e8aaab-3571-4549-ab91-53d89f89dc7b",
"services": [
- "WAF",
- "Firewall",
- "VNet"
+ "Cost"
],
- "severity": "High",
- "text": "Use a /26 prefix for your Azure Firewall subnets.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Autoscale",
+ "text": "Consider implementing a service re-scaling logic within the application",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/savings-plan/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
"services": [
- "WAF",
- "AzurePolicy"
+ "Backup",
+ "Cost"
],
"severity": "Medium",
- "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "Performance"
+ "subcategory": "Backup",
+ "text": "Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
"services": [
- "WAF",
- "Storage"
+ "Cost",
+ "LoadBalancer",
+ "VM"
],
"severity": "Medium",
- "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
- "waf": "Performance"
+ "subcategory": "Databricks",
+ "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
"services": [
- "WAF"
+ "Cost"
],
"severity": "Medium",
- "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "subcategory": "Functions",
+ "text": "Functions - Reuse connections",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
"services": [
- "WAF",
- "Monitor"
+ "Cost"
],
"severity": "Medium",
- "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "subcategory": "Functions",
+ "text": "Functions - Cache data locally",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
"services": [
- "WAF",
- "Firewall"
+ "Storage",
+ "Cost"
],
- "severity": "High",
- "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Functions",
+ "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
"services": [
- "WAF",
- "ServiceBus"
+ "Cost"
],
- "severity": "Low",
- "text": "Use web categories to allow or deny outbound access to specific topics.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Functions",
+ "text": "Functions - Keep your functions warm",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
"services": [
- "WAF"
+ "Cost"
],
"severity": "Medium",
- "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "Performance"
+ "subcategory": "Functions",
+ "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
"services": [
- "WAF",
- "DNS",
- "Firewall"
+ "Cost"
],
"severity": "Medium",
- "text": "Enable Azure Firewall DNS proxy configuration.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Security"
+ "subcategory": "Functions",
+ "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
"services": [
- "WAF",
- "Monitor",
- "Firewall"
+ "Cost"
],
- "severity": "High",
- "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Functions",
+ "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "df03a822-cd46-43cb-abc8-ac299ebc91a4",
+ "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
"services": [
- "WAF",
- "Backup"
+ "Cost"
],
- "severity": "Low",
- "text": "Implement backups for your firewall rules",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Evaluate your network topology against networking costs and where applicable reduce the egress and peering data",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
"services": [
- "WAF",
- "ACR",
- "Firewall"
+ "EventHubs",
+ "FrontDoor",
+ "Cost"
],
- "severity": "High",
- "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
"services": [
- "WAF",
- "DDoS",
- "Firewall",
- "VNet"
+ "AppSvc",
+ "FrontDoor",
+ "Cost"
],
- "severity": "High",
- "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "WAF checklist",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "f843e52f-4722-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
"services": [
- "WAF",
- "VNet"
+ "Cost"
],
- "severity": "High",
- "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Consider using free tiers where applicable for all non-production environments",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b9de39ac-0e7c-428d-a936-657202bff456",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
"services": [
- "WAF",
- "ExpressRoute",
- "PrivateLink"
+ "Cost"
],
"severity": "Medium",
- "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "subcategory": "Serverless",
+ "text": "Using serverless patterns for spikes can help keeping costs down",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
"services": [
- "WAF",
- "VNet"
+ "Storage",
+ "Cost"
],
- "severity": "High",
- "text": "Don't enable virtual network service endpoints by default on all subnets.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "Consider archiving tiers for less used data",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "WAF checklist",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
"services": [
- "DNS",
- "NVA",
- "Firewall",
- "WAF",
- "PrivateLink"
+ "Storage",
+ "Cost"
],
"severity": "Medium",
- "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN",
- "VNet"
+ "Storage",
+ "Cost"
],
- "severity": "High",
- "text": "Use at least a /27 prefix for your Gateway subnets.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "Consider using standard SSD rather than Premium or Ultra where possible",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
"services": [
- "WAF",
- "VNet"
+ "Storage",
+ "Cost"
],
- "severity": "High",
- "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
"services": [
- "WAF",
- "ACR",
- "VNet"
+ "Storage",
+ "Cost",
+ "ASR"
],
"severity": "Medium",
- "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "WAF checklist",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
"services": [
- "WAF",
- "Entra",
- "NVA",
- "VNet"
+ "Storage",
+ "Cost"
],
"severity": "Medium",
- "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Security"
+ "subcategory": "storage",
+ "text": "Storage accounts: check hot tier and/or GRS necessary",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
"services": [
- "WAF",
- "NetworkWatcher",
- "VNet"
+ "Storage",
+ "Cost"
],
"severity": "Medium",
- "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
"services": [
- "WAF",
- "VNet"
+ "EventHubs",
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "waf": "Reliability"
+ "subcategory": "Synapse",
+ "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
"services": [
- "WAF",
- "VWAN"
+ "Storage",
+ "Cost"
],
"severity": "Medium",
- "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "subcategory": "Synapse",
+ "text": "Export cost data to a storage account for additional data analysis.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
"services": [
- "WAF",
- "ACR",
- "VWAN"
+ "SQL",
+ "Cost"
],
"severity": "Medium",
- "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Performance"
+ "subcategory": "Synapse",
+ "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
"services": [
- "WAF",
- "Firewall"
+ "Cost"
],
"severity": "Medium",
- "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "Synapse",
+ "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
"services": [
- "WAF",
- "VWAN"
+ "Cost"
],
"severity": "Medium",
- "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "subcategory": "Synapse",
+ "text": "Create multiple Apache Spark pool definitions of various sizes.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
"services": [
- "WAF",
- "VWAN",
- "Monitor"
+ "Cost"
],
"severity": "Medium",
- "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "subcategory": "Synapse",
+ "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
"services": [
- "WAF",
- "VWAN"
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "subcategory": "VM",
+ "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN"
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "subcategory": "VM",
+ "text": "Right-sizing all VMs",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
"services": [
- "WAF",
- "VWAN"
+ "Cost",
+ "VM"
],
"severity": "Medium",
- "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "subcategory": "VM",
+ "text": "Swap VM sized with normalized and most recent sizes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
- "WAF"
+ "Cost",
+ "VM",
+ "Monitor"
],
- "severity": "High",
- "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "VM",
+ "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Right-sizing",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
- "WAF",
- "AzurePolicy"
+ "Cost",
+ "VM"
],
- "severity": "High",
- "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "VM",
+ "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "BC and DR",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
"services": [
- "WAF",
- "RBAC",
- "AzurePolicy"
+ "ACR"
],
- "severity": "Medium",
- "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "BC and DR",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"services": [
- "WAF",
- "Subscriptions",
- "AzurePolicy"
+ "Storage"
],
"severity": "Medium",
- "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "BC and DR",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"services": [
- "WAF",
- "AzurePolicy"
+ "Storage"
],
- "severity": "High",
- "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
+ "category": "BC and DR",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"services": [
- "WAF",
- "Subscriptions",
- "AzurePolicy"
+ "ASR"
],
- "severity": "Low",
- "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "FrontDoor"
],
- "severity": "High",
- "text": "Use built-in policies where possible to minimize operational overhead.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Front Door",
+ "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"services": [
- "AzurePolicy",
+ "FrontDoor",
"WAF",
- "RBAC",
- "Entra",
- "Subscriptions"
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "subcategory": "Front Door",
+ "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
"services": [
+ "AppGW",
+ "FrontDoor",
"WAF",
- "Subscriptions",
"AzurePolicy"
],
"severity": "Medium",
- "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "subcategory": "Front Door",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF",
"AzurePolicy"
],
- "severity": "Medium",
- "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
- "services": [
- "WAF",
- "Subscriptions",
- "AzurePolicy"
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
+ "services": [
+ "FrontDoor",
+ "TrafficManager",
+ "EventHubs"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Avoid placing Traffic Manager behind Front Door.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "WAF checklist",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Front Door",
+ "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
"services": [
- "AzurePolicy",
- "WAF",
- "Monitor",
- "RBAC",
- "Entra"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Operations"
+ "subcategory": "Front Door",
+ "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Front Door",
+ "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
"services": [
- "WAF",
- "ARS",
- "AzurePolicy",
- "Storage"
+ "AKV",
+ "FrontDoor",
+ "Cost"
],
"severity": "High",
- "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "subcategory": "Front Door",
+ "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor",
- "AzurePolicy",
- "VM"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "subcategory": "Front Door",
+ "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"services": [
- "WAF",
- "VM"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"services": [
- "WAF",
- "VM"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "subcategory": "Front Door",
+ "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "WAF checklist",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=~'Enabled') and (mode=~'Prevention')), enabledState, mode",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor",
- "NetworkWatcher"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use Network Watcher to proactively monitor traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use Azure Monitor Logs for insights and reporting.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF",
- "Monitor"
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Azure Monitor alerts for the generation of operational alerts.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
"services": [
- "WAF",
- "Backup"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Low",
- "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy",
- "VM"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "subcategory": "Front Door",
+ "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor",
- "AzurePolicy",
- "VM"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Monitor VM security configuration drift via Azure Policy.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "subcategory": "Front Door",
+ "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
"services": [
- "WAF",
- "ACR",
- "ASR",
- "VM"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "Operations"
+ "subcategory": "Front Door",
+ "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
"services": [
- "WAF",
- "Backup"
+ "FrontDoor"
+ ],
+ "severity": "Low",
+ "subcategory": "Front Door",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
+ "services": [
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Operations"
+ "subcategory": "Front Door",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "WAF checklist",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
+ "service": "Front Door",
"services": [
- "WAF",
- "AppGW",
- "FrontDoor"
+ "FrontDoor",
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "severity": "Medium",
+ "subcategory": "Front Door",
+ "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "WAF checklist",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "service": "Front Door",
"services": [
- "WAF",
"Sentinel",
- "AppGW",
- "FrontDoor"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "subcategory": "Front Door",
+ "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV"
+ "Backup",
+ "FrontDoor"
],
- "severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Front Door",
+ "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV",
- "AzurePolicy"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV",
- "RBAC",
- "Entra"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
"services": [
- "WAF"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": "Front Door",
+ "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"services": [
- "WAF"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Establish an automated process for key and certificate rotation.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Use caching for endpoints that support it.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV",
- "PrivateLink",
- "VNet"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Front Door",
+ "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV",
- "Monitor",
- "Entra"
+ "FrontDoor",
+ "Storage"
],
"severity": "Medium",
- "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
"services": [
- "WAF",
"AKV",
- "AzurePolicy"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Use wildcard TLS certificates when possible.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV"
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
"services": [
- "WAF",
- "ACR",
- "AKV",
- "ASR"
+ "FrontDoor",
+ "Storage"
],
"severity": "Medium",
- "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Use file compression when you're accessing downloadable content.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV"
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Front Door",
+ "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra"
+ "FrontDoor",
+ "TrafficManager",
+ "Storage"
],
"severity": "Medium",
- "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
- "waf": "Security"
+ "subcategory": "Front Door",
+ "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
"services": [
- "WAF",
- "Subscriptions",
- "Defender"
+ "AppSvc",
+ "FrontDoor"
],
"severity": "High",
- "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "subcategory": "Front Door",
+ "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
+ "category": "BCDR",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Ensure that your backups are protected against attacks. This should include encryption of the backups to protect against loss of confidentiality. For regular Azure service backup, backup data is automatically encrypted using Azure platform-managed keys. You can also choose to encrypt the backup using a customer-managed key. In this case, ensure this customer-managed key in the key vault is also in the backup scope.",
+ "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
"services": [
- "WAF",
- "Subscriptions",
- "Defender"
+ "AKV",
+ "SQL",
+ "Backup"
],
- "severity": "High",
- "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "severity": "Medium",
+ "subcategory": "Azure Key Vault",
+ "text": "Protect your backup data with encryption and store keys safely in Azure Key Vault",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
+ "category": "BCDR",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure SQL Database uses SQL Server technology to create full backups every week, differential backup every 12-24 hours, and transaction log backup every 5 to 10 minutes. By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region.",
+ "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
"services": [
- "WAF",
- "Subscriptions",
- "Defender"
+ "SQL",
+ "Storage",
+ "Backup"
],
- "severity": "High",
- "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Configure Azure SQL Database automated backups",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region. For SQL Database, the backup storage redundancy can be configured at the time of database creation or can be updated for an existing database; the changes made to an existing database apply to future backups only.",
+ "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "Backup"
],
- "severity": "High",
- "text": "Enable Endpoint Protection on IaaS Servers.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "severity": "Low",
+ "subcategory": "Backup",
+ "text": "Enable geo-redundant backup storage to protect against single region failure and data loss",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "category": "Code",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Malicious code can potentially circumvent security controls. Before deploying custom code to production, it is essential to review what's being deployed. Use a database tool like Azure Data Studio that supports source control. Implement tools and logic for code analysis, vulnerability and credential scanning.",
+ "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
"services": [
- "WAF",
- "Monitor",
- "Defender"
+ "SQL"
],
"severity": "Medium",
- "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "subcategory": "Source Control and Code Review",
+ "text": "Use Source Control systems to store, maintain and review application code deployed inside Azure SQLDB Database",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "category": "Data Discovery and Classification",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "In case of classification requirements Purview is the preferred option. Only use SQL Data Discovery & Classification in case Purview is not an option. Discover columns that potentially contain sensitive data. What is considered sensitive data heavily depends on the customer, compliance regulation, etc., and needs to be evaluated by the users in charge of that data. Classify the columns to use advanced sensitivity-based auditing and protection scenarios. Review results of automated discovery and finalize the classification if necessary.",
+ "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
"services": [
- "WAF",
- "Monitor",
- "Entra"
+ "SQL"
],
- "severity": "Medium",
- "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "severity": "Low",
+ "subcategory": "Data Discovery and Classification",
+ "text": "Plan and configure Data Discovery & Classification to protect the sensitive data",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
+ "category": "Data Masking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Usage of this feature is recommended only if column encryption is not an option and there is a specific requirement to preserve data types and formats. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.",
+ "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
"services": [
- "WAF",
- "ACR",
- "Entra"
+ "SQL"
],
- "severity": "High",
- "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "severity": "Low",
+ "subcategory": "Data Masking",
+ "text": "Use Data Masking to prevent unauthorized non-admin users data access if no encryption is possible",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
+ "category": "Defender",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "SQL Advanced Threat Detection (ATP) provides a layer of security that detects potential vulnerabilities and anomalous activity in databases such as SQL injection attacks and unusual behavior patterns. When a potential threat is detected Threat Detection sends an actionable real-time alert by email and in Microsoft Defender for Cloud, which includes clear investigation and remediation steps for the specific threat.",
+ "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
"services": [
- "WAF",
- "Entra"
+ "Defender",
+ "SQL",
+ "EventHubs"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "severity": "High",
+ "subcategory": "Advanced Threat Protection",
+ "text": "Review and complete Advanced Threat Protection (ATP) configuration",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
+ "category": "Defender",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Enable Microsoft Defender for Azure SQL at the subscription level to automatically onboard and protect all existing and future servers and databases. When you enable on the subscription level, all databases in Azure SQL Database and Azure SQL Managed Instance are protected. You can then disable them individually if you choose. If you want to manually manage which databases are protected, disable at the subscription level and enable each database that you want protected.",
+ "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
"services": [
- "WAF",
- "Entra"
+ "Defender",
+ "SQL",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "severity": "High",
+ "subcategory": "Defender for Azure SQL",
+ "text": "Enable Microsoft Defender for Azure SQL",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
+ "category": "Defender",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Microsoft Defender for Azure SQL ATP detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Alerts can be configured and generated and will be reported in the Defender for console.",
+ "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
"services": [
- "WAF",
- "Storage"
+ "Defender",
+ "SQL",
+ "Monitor"
],
"severity": "High",
- "text": "Enable secure transfer to storage accounts.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "subcategory": "Defender for Azure SQL",
+ "text": "Prepare a security response plan to promptly react to Microsoft Defender for Azure SQL alerts",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
+ "category": "Defender",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure SQLDB vulnerability assessment is a service that provides visibility into your security state. Vulnerability assessment includes actionable steps to resolve security issues and enhance your database security. It can help you to monitor a dynamic database environment where changes are difficult to track and improve your SQL security posture.",
+ "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
"services": [
- "WAF",
- "Storage"
+ "Defender",
+ "SQL",
+ "Monitor"
],
"severity": "High",
- "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "subcategory": "Vulnerability Assessment",
+ "text": "Configure Vulnerability Assessment (VA) findings and review recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
+ "category": "Defender",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL Databases. Vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. You can use the findings to remediate software vulnerabilities and disable findings.",
+ "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
"services": [
- "WAF",
- "AKV",
- "VM"
+ "Defender",
+ "SQL"
],
"severity": "High",
- "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "Operations"
+ "subcategory": "Vulnerability Assessment",
+ "text": "Regularly review of Vulnerability Assessment (VA) findings and recommendations and prepare a plan to fix",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
+ "category": "Encryption",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Always Encrypted with Secure Enclaves expands confidential computing capabilities of Always Encrypted by enabling in-place encryption and richer confidential queries. Always Encrypted with Secure Enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. Usage of this feature is recommended for the cases where you need to limit administrator access and need your queries to support more than equality matching of encrypted columns.",
+ "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "Low",
- "text": "Refer to baseline highly available zone-redundant web application architecture for best practices",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Always Encrypted",
+ "text": "If protecting sensitive PII data from admin users is a key requirement, but Column Encryption limitations cannot be tolerated, consider the adoption of Always Encrypted with Secure Enclaves",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "category": "Encryption",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "With Azure SQL Database, you can apply symmetric encryption to a column of data by using Transact-SQL. This approach is called column encryption, because you can use it to encrypt specific columns with different encryption keys. Doing so gives you more granular encryption capability than TDE, which encrypts data in pages. Using Always Encrypted to ensure sensitive data isn't exposed in plaintext in Azure SQL Database or SQL Managed Instance, even in memory/in use. Always Encrypted protects the data from Database Administrators (DBAs) and cloud admins (or bad actors who can impersonate high-privileged but unauthorized users) and gives you more control over who can access your data.",
+ "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
"services": [
- "WAF",
- "Backup"
+ "AKV",
+ "SQL",
+ "Storage"
],
- "severity": "Medium",
- "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Column Encryption",
+ "text": "To protect sensitive PII data from non-admin users in specific table columns, consider using Column Encryption",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
+ "category": "Encryption",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Enabled by default, Transparent data encryption (TDE) helps to protect the database files against information disclosure by performing real-time encryption and decryption of the database, associated backups, and transaction log files 'at rest', without requiring changes to the application.",
+ "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
"services": [
- "WAF"
+ "SQL",
+ "Storage",
+ "Backup"
],
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)",
- "waf": "Reliability"
+ "subcategory": "Transparent Data Encryption",
+ "text": "Ensure Transparent Data Encryption (TDE) is kept enabled",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "category": "Encryption",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "If separation of duties in the management of keys and data within the organization is required, leverage Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) for your Azure SQLDB and use Azure Key Vault to store (refer to its checklist). Leverage this feature when you have strict security requirements which cannot be met by the managed service keys.",
+ "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
"services": [
- "WAF"
+ "AKV",
+ "SQL"
],
"severity": "Medium",
- "text": "Implement health checks",
- "waf": "Reliability"
+ "subcategory": "Transparent Data Encryption",
+ "text": "Use customer-managed keys (CMK) in Azure Key Vault (AKV) if you need increased transparency and granular control over the TDE protection",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
+ "category": "Encryption",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The minimal Transport Layer Security (TLS) version setting allows customers to choose which version of TLS their SQL database uses. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.",
+ "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
"services": [
- "WAF",
- "AppSvc",
- "Backup"
+ "SQL"
],
"severity": "High",
- "text": "Refer to backup and restore best practices for Azure App Service",
- "waf": "Reliability"
+ "subcategory": "Transport Layer Security",
+ "text": "Enforce minimum TLS version to the latest available",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "category": "Identity",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Use Azure Active Directory (Azure AD) authentication for centralized identity management. Use SQL Authentication only if really necessary and document as exceptions.",
+ "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
"services": [
- "WAF",
- "AppSvc"
- ],
- "severity": "High",
- "text": "Implement Azure App Service reliability best practices",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc"
- ],
- "severity": "Low",
- "text": "Familiarize with how to move an App Service app to another region During a disaster",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc"
- ],
- "severity": "High",
- "text": "Familiarize with reliability support in Azure App Service",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc"
+ "SQL",
+ "Entra"
],
"severity": "Medium",
- "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan",
- "waf": "Reliability"
+ "subcategory": "Azure Active Directory",
+ "text": "Leverage Azure AD authentication for connections to Azure SQL Databases",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "category": "Identity",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Using Azure AD groups simplifies permission management and both the group owner, and the resource owner can add/remove members to/from the group. Create a separate group for Azure AD administrators for each logical server. Monitor Azure AD group membership changes using Azure AD audit activity reports.",
+ "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
"services": [
- "WAF",
- "AppSvc",
+ "SQL",
+ "Entra",
"Monitor"
],
"severity": "Medium",
- "text": "Monitor App Service instances using Health checks",
- "waf": "Reliability"
+ "subcategory": "Azure Active Directory",
+ "text": "Create a separate Azure AD group with two admin accounts for each Azure SQL Database logical server",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "category": "Identity",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Ensure that distinct system and user assigned managed identities, that are dedicated to the function, with least permissions assigned, are used for communication from Azure services and applications to the Azure SQLDB databases.",
+ "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
"services": [
- "WAF",
- "Monitor"
+ "SQL",
+ "Entra"
],
"severity": "Medium",
- "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests",
- "waf": "Reliability"
+ "subcategory": "Azure Active Directory",
+ "text": "Minimize the use of password-based authentication for applications",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
+ "category": "Identity",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "System or User assigned managed identities enable Azure SQLDB to authenticate to other cloud services (e.g. Azure Key Vault) without storing credentials in code. Once enabled, all necessary permissions can be granted via Azure role-based-access-control to the specific Azure SQLDB instance. Do not share user assigned managed identities across multiple services if not strictly required.",
+ "guid": "69891194-5074-4e30-8f69-4efc3c580900",
+ "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
"services": [
- "WAF",
- "Monitor"
+ "AKV",
+ "SQL",
+ "ACR",
+ "Entra",
+ "RBAC"
],
"severity": "Low",
- "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc",
- "AKV"
- ],
- "severity": "High",
- "text": "Use Key Vault to store secrets",
+ "subcategory": "Managed Identities",
+ "text": "Assign Azure SQL Database a managed identity for outbound resource access",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "category": "Identity",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Use an Azure AD integrated authentication that eliminates the use of passwords. Password-based authentication methods are a weaker form of authentication. Credentials can be compromised or mistakenly given away. Use single sign-on authentication using Windows credentials. Federate the on-premises AD domain with Azure AD and use integrated Windows authentication (for domain-joined machines with Azure AD).",
+ "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
"services": [
- "WAF",
- "AppSvc",
- "AKV",
+ "SQL",
"Entra"
],
- "severity": "High",
- "text": "Use Managed Identity to connect to Key Vault",
+ "severity": "Medium",
+ "subcategory": "Passwords",
+ "text": "Minimize the use of password-based authentication for users",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Store the App Service TLS certificate in Key Vault.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "category": "Ledger",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Confidential Ledger is one of the supported store, it can be used and supports automatic generation and storage of database digests. Azure Ledger provides advanced security features like Blockchain Ledger Proof and Confidential Hardware Enclaves. Use it only if advanced security features are required, otherwise revert to Azure storage.",
+ "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
"services": [
- "WAF",
- "AppSvc",
- "AKV"
+ "SQL",
+ "Storage"
],
- "severity": "High",
- "text": "Use Key Vault to store TLS certificate.",
+ "severity": "Medium",
+ "subcategory": "Database Digest",
+ "text": "Use Azure Confidential Ledger to store database digests only if advanced security features are required",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "category": "Ledger",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Blob Storage with Immutable Storage feature can be used and supports automatic generation and storage of database digests. To prevent tampering of your digest files, configure and lock a retention policy for your container.",
+ "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
"services": [
- "WAF",
- "AppSvc",
- "Subscriptions"
+ "SQL",
+ "Storage",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Isolate systems that process sensitive information",
+ "subcategory": "Database Digest",
+ "text": "If Azure storage account is used to store database digests, ensure security is properly configured",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "category": "Ledger",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Ledger provides a form of data integrity called forward integrity, which provides evidence of data tampering on data in your ledger tables. The database verification process takes as input one or more previously generated database digests. It then recomputes the hashes stored in the database ledger based on the current state of the ledger tables. If the computed hashes don't match the input digests, the verification fails. The failure indicates that the data has been tampered with. The verification process reports all inconsistencies that it detects.",
+ "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
"services": [
- "WAF",
- "TrafficManager",
- "AppSvc"
+ "SQL",
+ "Storage"
],
"severity": "Medium",
- "text": "Do not store sensitive data on local disk",
+ "subcategory": "Integrity",
+ "text": "Schedule the Ledger verification process regularly to verify data integrity",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "category": "Ledger",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The Ledger feature provides tamper-evidence capabilities in your database. You can cryptographically attest to other parties, such as auditors or other business parties, that your data hasn't been tampered with. Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators.",
+ "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
"services": [
- "WAF",
- "AppSvc",
- "Entra"
+ "SQL"
],
"severity": "Medium",
- "text": "Use an established Identity Provider for authentication",
+ "subcategory": "Ledger",
+ "text": "If cryptographic proof of data integrity is a critical requirement, Ledger feature should be considered",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
+ "category": "Ledger",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Depending on the type of tampering, there are cases where you can repair the ledger without losing data. In the article contained in the --More Info-- column, different scenarios and recovery techniques are described.",
+ "guid": "804fc554-6554-4842-91c1-713b32f99902",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
"services": [
- "WAF",
- "AppSvc"
+ "SQL"
],
- "severity": "High",
- "text": "Deploy from a trusted environment",
+ "severity": "Medium",
+ "subcategory": "Recovery",
+ "text": "Prepare a response plan to investigate and repair a database after a tampering event",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure SQL Database Auditing tracks database events and writes them to an audit log in your Azure storage account. Auditing helps you understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations as well as helps you meet regulatory compliance. By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to configure auditing for different types of actions and action groups using PowerShell.",
+ "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
"services": [
- "WAF",
- "Entra"
+ "SQL",
+ "Storage",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Disable basic authentication",
+ "severity": "Medium",
+ "subcategory": "Auditing",
+ "text": "Ensure that Azure SQL Database Auditing is enabled at the server level",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure SQL Database Auditing logs can be written to external storage accounts, Log Analytics workspace or Event Hub. Be sure to protect the target repository using backups and secured configuration. Use Azure SQL Database Managed Identity to access the storage and set an explicit retention period. Do not grant permissions to administrators to the audit log repository. Use a different target storage for --Enabling Auditing of Microsoft support operations--. ",
+ "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
"services": [
- "WAF",
- "AKV",
+ "EventHubs",
+ "Monitor",
+ "SQL",
+ "Storage",
+ "Backup",
"Entra"
],
- "severity": "High",
- "text": "Use Managed Identity to connect to resources",
+ "severity": "Low",
+ "subcategory": "Auditing",
+ "text": "Ensure that Azure SQL Database Auditing logs are backed up and secured in the selected repository type",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The Azure Monitor activity log is a platform log in Azure that provides insight into subscription-level events. The activity log includes information like when a resource is modified. It is recommended to send this activity log to the same external storage repository as the Azure SQL Database Audit Log (storage account, Log Analytics workspace, Event Hub).",
+ "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
"services": [
- "WAF",
- "ACR",
- "Entra"
+ "EventHubs",
+ "Monitor",
+ "SQL",
+ "Storage",
+ "Subscriptions"
],
- "severity": "High",
- "text": "Pull containers using a Managed Identity",
+ "severity": "Medium",
+ "subcategory": "Auditing",
+ "text": "Ensure that Azure SQL Database Activity Log is collected and integrated with Auditing logs",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR). Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
+ "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
"services": [
- "WAF",
- "AppSvc",
- "Monitor",
- "Entra"
+ "SQL",
+ "Monitor"
],
"severity": "Medium",
- "text": "Send App Service runtime logs to Log Analytics",
+ "subcategory": "SIEM/SOAR",
+ "text": "Ensure that Azure SQL Database Auditing logs are being presented in to your organizations SIEM/SOAR",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), which can be used to set up custom threat detections. Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
+ "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
"link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
"services": [
- "WAF",
- "AppSvc",
- "Monitor",
- "Entra"
+ "SQL",
+ "Monitor"
],
"severity": "Medium",
- "text": "Send App Service activity logs to Log Analytics",
+ "subcategory": "SIEM/SOAR",
+ "text": "Ensure that Azure SQL Database Activity Log data is presented in to your SIEM/SOAR",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "category": "Logging",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Security Operation Center (SOC) team should create an incident response plan (playbooks or manual responses) to investigate and mitigate tampering, malicious activities, and other anomalous behaviors.",
+ "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
"services": [
- "NVA",
- "Firewall",
- "WAF",
- "Monitor",
- "VNet"
+ "SQL",
+ "EventHubs"
],
"severity": "Medium",
- "text": "Outbound network access should be controlled",
+ "subcategory": "SIEM/SOAR",
+ "text": "Ensure that you have response plans for malicious or aberrant audit logging events",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "When you create a logical server from the Azure portal for Azure SQL Database, the result is a public endpoint that is visible and reachable over the public network (Public Access). You can then limit connectivity based on firewall rules and Service Endpoint. You can also configure private connectivity only limiting connections to internal networks using Private Endpoint (Private Access). Private Access using Private Endpoint should be the default unless a business case or performance/technical reason applies that cannot support it. Usage of Private Endpoints has performance implications that need to be considered and assessed.",
+ "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
"services": [
- "Storage",
- "NVA",
- "Firewall",
- "WAF",
"PrivateLink",
- "VNet"
+ "SQL"
],
- "severity": "Low",
- "text": "Ensure a stable IP for outbound communications towards internet addresses",
+ "severity": "High",
+ "subcategory": "Connectivity",
+ "text": "Review Public vs. Private Access connectivity methods and select the appropriate one for the workload",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "IMPORTANT: Connections to private endpoint only support Proxy as the connection policy. When using private endpoints connections are proxied via the Azure SQL Database gateway to the database nodes. Clients will not have a direct connection.",
+ "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
"services": [
- "WAF",
- "AppSvc",
- "PrivateLink"
+ "PrivateLink",
+ "SQL",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Inbound network access should be controlled",
+ "severity": "Low",
+ "subcategory": "Connectivity",
+ "text": "Keep default Azure SQL Database Connection Policy if not differently required and justified",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. If you select this option, make sure that your login and user permissions limit access to authorized users only. If not strictly required, keep this setting to OFF.",
+ "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
"services": [
- "AppSvc",
- "FrontDoor",
- "WAF",
- "Monitor",
- "AppGW"
+ "SQL",
+ "Subscriptions"
],
"severity": "High",
- "text": "Use a WAF in front of App Service",
+ "subcategory": "Connectivity",
+ "text": "Ensure Allow Azure Services and Resources to Access this Server setting is disabled in Azure SQL Database firewall",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure SQL Database has a new built-in feature that allows native integration with external REST endpoints. This means that integration of Azure SQL Database with Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management and in general any REST or even GraphQL endpoint. If not properly restricted, code inside an Azure SQL Database database could leverage this mechanism to exfiltrate data. If not strictly required, it is recommended to block or restrict this feature using Outbound Firewall Rules.",
+ "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
+ "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
"services": [
- "WAF",
- "PrivateLink"
+ "SQL",
+ "EventHubs",
+ "APIM"
],
- "severity": "High",
- "text": "Avoid for WAF to be bypassed",
+ "severity": "Medium",
+ "subcategory": "Outbound Control",
+ "text": "Block or restrict outbound REST API calls to external endpoints",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Set minimum TLS policy to 1.2 in App Service configuration.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Outbound firewall rules limit network traffic from the Azure SQL Database logical server to a customer defined list of Azure Storage accounts and Azure SQL Database logical servers. Any attempt to access storage accounts or databases not in this list is denied.",
+ "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
"services": [
- "WAF",
- "AppSvc",
- "AzurePolicy"
+ "SQL",
+ "Storage"
],
"severity": "Medium",
- "text": "Set minimum TLS policy to 1.2",
+ "subcategory": "Outbound Control",
+ "text": "If outbound network access is required, it is recommended to configure outbound networking restrictions using built-in Azure SQL Database control feature",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Private Endpoint is created inside a subnet in an Azure Virtual Network. Proper security configuration must be applied also to the containing network environment, including NSG/ASG, UDR, firewall, monitoring and auditing.",
+ "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
"services": [
- "WAF",
- "AppSvc"
+ "Monitor",
+ "Firewall",
+ "VNet",
+ "SQL",
+ "PrivateLink"
],
- "severity": "High",
- "text": "Use HTTPS only",
+ "severity": "Medium",
+ "subcategory": "Private Access",
+ "text": "If Private Access connectivity is used, ensure that you are using the Private Endpoint, Azure Virtual Network, Azure Firewall, and Azure Network Security Group checklists",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "When adding a Private Endpoint connection, public routing to your logical server isn't blocked by default. In the --Firewall and virtual networks-- pane, the setting --Deny public network access-- is not selected by default. To disable public network access, ensure that you select --Deny public network access--.",
+ "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
"services": [
- "WAF",
- "Storage"
+ "PrivateLink",
+ "SQL",
+ "VNet"
],
"severity": "High",
- "text": "Wildcards must not be used for CORS",
+ "subcategory": "Private Access",
+ "text": "If Private Endpoint (Private Access) is used, consider disabling Public Access connectivity",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Network Security Group (NSG) and Application Security Group (ASG) can be now applied to subnet containing Private Endpoints to restrict connections to Azure SQLDB based on internal source IP ranges.",
+ "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
"services": [
- "WAF"
+ "PrivateLink",
+ "SQL",
+ "VNet"
],
- "severity": "High",
- "text": "Turn off remote debugging",
+ "severity": "Medium",
+ "subcategory": "Private Access",
+ "text": "If Private Endpoint (Private Access) is used, apply NSG and eventually ASG to limit incoming source IP address ranges",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. Applications and tools that are in the same or peered virtual network in the same region could access it directly. Applications and tools that are in different region could use virtual-network-to-virtual-network connection or ExpressRoute circuit peering to establish connection. Customer should use Network Security Groups (NSG), and eventually internal firewalls, to restrict access over port 1433 only to resources that require access to a managed instance.",
+ "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
"services": [
- "WAF",
- "AppSvc",
- "Defender"
+ "ExpressRoute",
+ "SQL",
+ "VNet"
],
"severity": "Medium",
- "text": "Enable Defender for Cloud - Defender for App Service",
+ "subcategory": "Private Access",
+ "text": "Apply Network Security Groups (NSG) and firewall rules to restrict access to Azure SQL Managed Instance internal subnet",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Azure Virtual Network Service Endpoint is preferred solution if you want to establish a direct connection to the Azure SQL Database backend nodes using Redirect policy. This will allow access in high performance mode and is the recommended approach from a performance perspective.",
+ "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
"services": [
- "NVA",
- "EventHubs",
- "WAF",
- "DDoS",
- "AppGW",
+ "SQL",
+ "AzurePolicy",
"VNet"
],
- "severity": "Medium",
- "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "severity": "High",
+ "subcategory": "Public Access",
+ "text": "If Public Access connectivity is used, leverage Service Endpoint to restrict access from selected Azure Virtual Networks",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The Azure SQL Database firewall allows you to specify IP address ranges from which communications are accepted. This approach is fine for stable IP addresses that are outside the Azure private network.",
+ "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
"services": [
- "WAF",
- "ACR",
- "PrivateLink",
- "VNet"
+ "SQL",
+ "Storage"
],
"severity": "Medium",
- "text": "Pull containers over a Virtual Network",
+ "subcategory": "Public Access",
+ "text": "If Public Access connectivity is used, ensure that only specific known IPs are added to the firewall",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "We recommend that you use database-level IP firewall rules whenever possible. This practice enhances security and makes your database more portable. Use server-level IP firewall rules for administrators. Also use them when you have many databases that have the same access requirements, and you don't want to configure each database individually.",
+ "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
"services": [
- "WAF"
+ "SQL",
+ "Storage"
],
- "severity": "Medium",
- "text": "Conduct a penetration test",
+ "severity": "Low",
+ "subcategory": "Public Access",
+ "text": "If Public Access connectivity is used and controlled by Azure SQL Database firewall rules, use database-level over server-level IP rules",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. The Managed Instance public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. If company policy disallows the use of public endpoints, use Azure Policy to prevent enabling public endpoints in the first place.",
+ "guid": "b8435656-143e-41a8-9922-61d34edb751a",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
"services": [
- "WAF"
+ "SQL",
+ "AzurePolicy",
+ "VNet"
],
- "severity": "Medium",
- "text": "Deploy validated code",
+ "severity": "High",
+ "subcategory": "Public Access",
+ "text": "Do not enable Azure SQL Managed Instance public endpoint",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "WAF checklist",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "category": "Networking",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "A Managed Instance (SQL MI) public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. In this case, it is recommended to apply a Network Security Groups (NSG) to restrict access to port 3342 only to trusted source IP addresses.",
+ "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
+ "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
"services": [
- "WAF"
+ "SQL",
+ "VNet"
],
"severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "subcategory": "Public Access",
+ "text": "Restrict access if Azure SQL Managed Instance public endpoint is required",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "WAF checklist",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
+ "category": "Privileged Access",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Most operations, support, and troubleshooting performed by Microsoft personnel and sub-processors do not require access to customer data. In those rare circumstances where such access is required, Customer Lockbox for Microsoft Azure provides an interface for customers to review and approve or reject customer data access requests. In support scenarios where Microsoft needs to access customer data, Azure SQL Database supports Customer Lockbox to provide an interface for you to review and approve or reject customer data access requests.",
+ "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
"services": [
- "WAF"
+ "SQL"
],
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Lockbox",
+ "text": "Review and enable Customer Lockbox for Azure SQL Database access by Microsoft personnel",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "WAF checklist",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "category": "Privileged Access",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "The principle of least privilege states that users shouldn't have more privileges than needed to complete their tasks. High-privileged database and server users can perform many configuration and maintenance activities on the database and can also drop databases in Azure SQL instance. Tracking database owners and privileged accounts is important to avoid having excessive permission.",
+ "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
+ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
"services": [
- "WAF"
+ "SQL"
],
"severity": "Medium",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
+ "subcategory": "Permissions",
+ "text": "Ensure that users are assigned the minimum level of access necessarily to complete their job functions",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "WAF checklist",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
+ "category": "Privileged Access",
+ "checklist": "Azure SQLDB Security Checklist (Preview)",
+ "description": "Identities (both Users and SPNs) should be scoped to the least amount of access needed to perform the function. A higher number of tightly scoped SPNs should be used, instead of having one SPN with multiple sets of unrelated permissions. For example, if there are three external web applications hosted on-prem that make queries to the Azure SQL Database, they should not all use the same SPN for these activities. Instead, they should each have their own tightly scoped SPN.",
+ "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
"services": [
- "WAF"
+ "SQL",
+ "Entra"
],
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Permissions",
+ "text": "Ensure that distinct applications will be assigned different credentials with minimal permissions to access Azure SQL Database",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "WAF checklist",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "category": "Application Deployment",
+ "checklist": "Azure AKS Review",
+ "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "High",
- "text": "Learn how to trigger a manual failover.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Use canary or blue/green deployments",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "WAF checklist",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
+ "category": "Application Deployment",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "High",
- "text": "Learn how to fail back after a failover.",
+ "severity": "Low",
+ "subcategory": "Development",
+ "text": "If required for AKS Windows workloads HostProcess containers can be used",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
- "checklist": "WAF checklist",
- "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
- "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
- "service": "VMSS",
+ "category": "Application Deployment",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
"services": [
- "WAF",
- "VM"
+ "AKS"
],
"severity": "Low",
- "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
- "waf": "Reliability"
+ "subcategory": "Development",
+ "text": "Use KEDA if running event-driven workloads",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
- "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
- "service": "VM",
+ "category": "Application Deployment",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
"services": [
- "WAF",
- "Backup",
- "VM"
+ "AKS"
],
- "severity": "High",
- "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Development",
+ "text": "Use Dapr to ease microservice development",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
- "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "VM",
+ "category": "Application Deployment",
+ "checklist": "Azure AKS Review",
+ "guid": "3acbe04b-be20-49d3-afda-47778424d116",
+ "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
"services": [
- "WAF",
- "VM"
+ "AKS"
],
- "severity": "High",
- "text": "Use Premium or Ultra disks for production VMs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Infrastructure as Code",
+ "text": "Use automation through ARM/TF to create your Azure resources",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
- "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
"services": [
- "WAF",
- "VM"
+ "AKS",
+ "ASR"
],
"severity": "High",
- "text": "Ensure Managed Disks are used for all VMs",
+ "subcategory": "Disaster Recovery",
+ "text": "Schedule and perform DR tests regularly",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
- "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
"services": [
- "WAF",
- "SQL",
- "Storage",
- "VM"
+ "FrontDoor",
+ "TrafficManager",
+ "AKS",
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
+ "subcategory": "High Availability",
+ "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
- "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant",
+ "guid": "578a219a-46be-4b54-9350-24922634292b",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones",
"services": [
- "WAF",
- "ACR",
- "Storage",
- "VM"
+ "AKS"
],
"severity": "Medium",
- "text": "Leverage Availability Zones for your VMs in regions where they are supported",
+ "subcategory": "High Availability",
+ "text": "Use Availability Zones if they are supported in your Azure region",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
- "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"services": [
- "WAF",
- "VM"
+ "AKS"
],
- "severity": "Medium",
- "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Use the SLA-backed AKS offering",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
- "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "WAF",
- "ASR",
- "VM"
+ "Cost",
+ "AKS"
],
- "severity": "High",
- "text": "Avoid running a production workload on a single VM",
+ "severity": "Low",
+ "subcategory": "High Availability",
+ "text": "Use Disruption Budgets in your pod and deployment definitions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
- "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"services": [
- "WAF",
- "AVS",
- "ASR",
- "VM"
+ "AKS",
+ "ACR"
],
"severity": "High",
- "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
+ "subcategory": "High Availability",
+ "text": "If using a private registry, configure region replication to store images in multiple regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
- "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
"services": [
- "WAF"
+ "Storage",
+ "AKS",
+ "ASR"
],
- "severity": "Low",
- "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
+ "severity": "High",
+ "subcategory": "Disaster Recovery",
+ "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
- "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
- "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
- "service": "VM",
+ "category": "BC and DR",
+ "checklist": "Azure AKS Review",
+ "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
"services": [
- "WAF",
- "ASR",
- "VM"
+ "AKS"
],
- "severity": "Medium",
- "text": "Increase quotas in DR region before testing failover with ASR",
+ "severity": "High",
+ "subcategory": "Requirements",
+ "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
- "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
- "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
- "service": "VM",
+ "category": "Cost Governance",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
"services": [
- "WAF",
- "VM"
+ "Cost",
+ "AKS"
],
"severity": "Low",
- "text": "Utilize Scheduled Events to prepare for VM maintenance",
- "waf": "Reliability"
+ "subcategory": "Cost",
+ "text": "Use an external application such as kubecost to allocate costs to different users",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
- "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "category": "Cost Governance",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "Cost",
+ "AKS"
],
- "severity": "Medium",
- "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Cost",
+ "text": "Use scale down mode to delete/deallocate nodes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
- "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "category": "Cost Governance",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "Cost",
+ "AKS"
],
- "severity": "Low",
- "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Cost",
+ "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
- "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "category": "Cost Governance",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "Cost",
+ "AKS"
],
"severity": "Low",
- "text": "Enable soft delete for Storage Account Containers",
- "waf": "Reliability"
+ "subcategory": "Cost",
+ "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
- "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "AKS",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Enable soft delete for blobs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Compliance",
+ "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
- "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "service": "Azure Backup",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "WAF",
- "Backup"
+ "AKS"
],
"severity": "Medium",
- "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Separate applications from the control plane with user/system node pools",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
- "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
- "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
- "service": "Azure Backup",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "WAF",
- "Backup"
+ "AKS"
],
"severity": "Low",
- "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Add taint to your system nodepool to make it dedicated",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
- "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
- "service": "Azure Backup",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "Backup"
+ "AKS",
+ "ACR"
],
- "severity": "Low",
- "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Compliance",
+ "text": "Use a private registry for your images, such as ACR",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "WAF checklist",
- "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
- "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "service": "DNS",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"services": [
- "WAF",
- "ACR",
- "DNS",
- "ASR"
+ "AKS"
],
- "severity": "Low",
- "text": "Implement DNS Failover using Azure DNS Private Resolvers",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Compliance",
+ "text": "Scan your images for vulnerabilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.PowerBI/gateways",
- "checklist": "WAF checklist",
- "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
- "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
- "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
- "service": "Data Gateways",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "cc639637-a652-42ac-89e8-06965388e9de",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
"services": [
- "WAF",
- "ACR"
+ "Defender",
+ "AKS"
],
"severity": "Medium",
- "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Use Azure Security Center to detect security posture vulnerabilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
- "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
"services": [
- "WAF",
- "NVA"
+ "AKS"
],
- "severity": "High",
- "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "If required configure FIPS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "Backup"
+ "AKS"
],
"severity": "High",
- "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"services": [
- "WAF",
- "ACR",
- "AKV"
+ "AKV",
+ "AKS"
],
"severity": "Medium",
- "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
- "waf": "Reliability"
+ "subcategory": "Secrets",
+ "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV"
+ "AKV",
+ "AKS"
],
- "severity": "Medium",
- "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Secrets",
+ "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"services": [
- "WAF",
"AKV",
- "AzurePolicy"
+ "AKS"
],
"severity": "Medium",
- "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
- "waf": "Reliability"
+ "subcategory": "Secrets",
+ "text": "If required add Key Management Service etcd encryption",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
"services": [
- "Backup",
- "Storage",
- "WAF",
"AKV",
- "Subscriptions"
+ "AKS"
],
- "severity": "Medium",
- "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Secrets",
+ "text": "If required consider using Confidential Compute for AKS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "category": "Governance and Security",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV"
+ "AKV",
+ "Defender",
+ "AKS"
],
- "severity": "High",
- "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Secrets",
+ "text": "Consider using Defender for Containers",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV"
+ "Entra",
+ "AKS"
],
- "severity": "Low",
- "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Use managed identities instead of Service Principals",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "Backup"
+ "Entra",
+ "AKS"
],
- "severity": "Low",
- "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Integrate authentication with AAD (using the managed integration)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "Backup"
+ "Entra",
+ "AKS"
],
- "severity": "Low",
- "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Limit access to admin kubeconfig (get-credentials --admin)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "EventHubs"
+ "Entra",
+ "AKS",
+ "RBAC"
],
"severity": "Medium",
- "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Integrate authorization with AAD RBAC",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "WAF checklist",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
+ "Entra",
+ "AKS",
"RBAC"
],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
+ "services": [
+ "Entra",
+ "AKS"
+ ],
"severity": "Medium",
- "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
+ "subcategory": "Identity",
+ "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
- "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "Cost"
+ "Entra",
+ "AKS"
],
- "text": "Leverage External Tables and Continuous data export overview to reduce costs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "For AKS non-interactive logins use kubelogin (preview)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
- "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
- "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "Entra",
+ "AKS"
],
- "text": "To share data, explore Leader-follower cluster configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Disable AKS local accounts",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
- "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
- "WAF",
- "ASR"
+ "Entra",
+ "AKS"
],
- "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Identity",
+ "text": "Configure if required Just-in-time cluster access",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "RBAC"
+ "Entra",
+ "AKS"
],
- "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Identity",
+ "text": "Configure if required AAD conditional access for AKS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
"services": [
- "WAF"
+ "Entra",
+ "AKS"
],
- "text": "Ingest data into each cluster in parallel",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Identity",
+ "text": "If required for Windows AKS workloads configure gMSA ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
- "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
- "service": "Azure Data Explorer",
+ "category": "Identity and Access Management",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"services": [
- "WAF",
- "ACR"
+ "Entra",
+ "AKS"
],
- "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "For finer control consider using a managed Kubelet Identity",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
- "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
- "service": "Azure Data Explorer",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"services": [
- "WAF",
+ "AppGW",
+ "AKS",
"ACR"
],
- "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "severity": "Medium",
+ "subcategory": "Best practices",
+ "text": "If using AGIC, do not share an AppGW across clusters",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
- "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
- "service": "Azure Data Explorer",
- "services": [
- "WAF"
- ],
- "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
- "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
- "service": "Azure Data Explorer",
- "services": [
- "Storage",
- "AzurePolicy",
- "WAF",
- "Cost",
- "ASR"
- ],
- "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
- "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKS"
],
- "text": "Wrap DevOps and source control around all your code",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "severity": "High",
+ "subcategory": "Best practices",
+ "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
- "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Best practices",
+ "text": "For Windows workloads use Accelerated Networking",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "WAF checklist",
- "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS",
+ "LoadBalancer"
],
- "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "severity": "High",
+ "subcategory": "Best practices",
+ "text": "Use the standard ALB (as opposed to the basic one)",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "Operations"
- },
- {
- "checklist": "WAF checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS",
+ "VNet"
],
"severity": "Medium",
- "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
- "training": "https://github.com/Azure/sap-automation",
- "waf": "Operations"
+ "subcategory": "Best practices",
+ "text": "If using Azure CNI, consider using different Subnets for NodePools",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "Cost",
+ "PrivateLink",
+ "AKS",
+ "VNet"
],
"severity": "Medium",
- "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
- "waf": "Reliability"
+ "subcategory": "Cost",
+ "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
"services": [
- "WAF",
- "Backup"
+ "VPN",
+ "AKS"
],
"severity": "Medium",
- "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
+ "subcategory": "HA",
+ "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "Storage",
- "WAF",
- "SQL",
- "Backup",
- "SAP",
- "ASR"
+ "AKS"
],
"severity": "High",
- "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "subcategory": "IPAM",
+ "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS",
+ "VNet"
],
- "severity": "Medium",
- "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "IPAM",
+ "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "ExpressRoute",
- "VPN",
- "ASR"
+ "AKS"
],
"severity": "High",
- "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Reliability"
+ "subcategory": "IPAM",
+ "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
"services": [
- "WAF",
- "ACR",
- "AKV"
+ "AKS",
+ "VNet"
],
"severity": "Low",
- "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
- "waf": "Reliability"
+ "subcategory": "IPAM",
+ "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "ASR",
- "SAP",
- "VNet"
+ "AKS"
],
- "severity": "Medium",
- "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
+ "severity": "High",
+ "subcategory": "IPAM",
+ "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "SAP"
+ "AKS"
],
"severity": "Low",
- "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Reliability"
+ "subcategory": "Operations",
+ "text": "If required add your own CNI plugin",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "High",
- "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Operations",
+ "text": "If required configure Public IP per node in AKS",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"services": [
- "WAF",
- "VNet"
+ "AKS"
],
- "severity": "High",
- "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Scalability",
+ "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "ASR",
- "VM"
+ "AKS"
],
- "severity": "High",
- "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS"
],
- "severity": "High",
- "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Scalability",
+ "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
"waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "NVA",
+ "AKS"
],
"severity": "High",
- "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "VM"
+ "AKS"
],
- "severity": "High",
- "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "If using a public API endpoint, restrict the IP addresses that can access it",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "SAP"
+ "AKS"
],
"severity": "High",
- "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Use private clusters if your requirements mandate it",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP",
- "LoadBalancer"
+ "AKS",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "WAF",
- "LoadBalancer"
+ "AKS",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Make sure the Floating IP is enabled on the Load balancer",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Use Kubernetes network policies to increase intra-cluster security",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "High",
- "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Use a WAF for web workloads (UIs or APIs)",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP",
- "Entra",
- "VM"
+ "AKS",
+ "DDoS",
+ "VNet"
],
- "severity": "High",
- "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Use DDoS Standard in the AKS Virtual Network",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "services": [
- "WAF",
- "Entra",
- "RBAC",
- "VM"
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
+ "services": [
+ "AKS"
],
- "severity": "High",
- "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "If required add company HTTP Proxy",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
"severity": "Medium",
- "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Reliability"
+ "subcategory": "Security",
+ "text": "Consider using a service mesh for advanced microservice communication management",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"services": [
- "WAF",
- "VM"
+ "AKS",
+ "Monitor"
],
"severity": "High",
- "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Alerting",
+ "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
"services": [
- "WAF",
"Entra",
- "SAP"
+ "AKS"
],
- "severity": "High",
- "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Check regularly Azure Advisor for recommendations on your cluster",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
"services": [
- "WAF",
- "ACR",
- "SAP"
+ "AKS"
],
- "severity": "High",
- "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Enable AKS auto-certificate rotation",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "AKS"
],
"severity": "High",
- "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "VM"
+ "AKS"
],
- "severity": "Medium",
- "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Compliance",
+ "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "VM"
+ "AKS"
],
- "severity": "Medium",
- "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Compliance",
+ "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS"
],
- "severity": "Medium",
- "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage"
+ "AKS"
],
- "severity": "High",
- "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Consider using AKS command invoke on private clusters",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "SAP"
+ "AKS"
],
- "severity": "High",
- "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "For planned events consider using Node Auto Drain",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "ASR",
- "SAP"
+ "AKS"
],
"severity": "High",
- "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Reliability"
+ "subcategory": "Compliance",
+ "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "SAP"
+ "AKS"
],
- "severity": "High",
- "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Use custom Node RG (aka 'Infra RG') name",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP",
- "Cost"
+ "AKS"
],
"severity": "Medium",
- "text": "Automate SAP System Start-Stop to manage costs.",
- "waf": "Cost"
+ "subcategory": "Compliance",
+ "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
"services": [
- "Storage",
- "VM",
- "WAF",
- "Cost",
- "SAP"
+ "AKS"
],
"severity": "Low",
- "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
- "waf": "Cost"
+ "subcategory": "Compliance",
+ "text": "Taint Windows nodes",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
"services": [
- "Storage",
- "VM",
- "WAF",
- "Cost",
- "SAP"
+ "AKS"
],
"severity": "Low",
- "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
- "waf": "Cost"
+ "subcategory": "Compliance",
+ "text": "Keep windows containers patch level in sync with host patch level",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "description": "Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
"services": [
- "WAF",
- "RBAC",
- "Subscriptions"
+ "AKS",
+ "Monitor"
],
- "severity": "High",
- "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "AKS"
],
- "severity": "Medium",
- "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Compliance",
+ "text": "If required use nodePool snapshots",
+ "waf": "Cost"
},
{
- "checklist": "WAF checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "Cost",
+ "AKS"
],
- "severity": "Medium",
- "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Cost",
+ "text": "Consider spot node pools for non time-sensitive workloads",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "Cost",
+ "AKS"
],
- "severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Cost",
+ "text": "Consider AKS virtual node for quick bursting",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS",
+ "Monitor"
],
- "severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS",
+ "Monitor"
],
- "severity": "Medium",
- "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "SAP"
+ "AKS",
+ "Monitor"
],
"severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Monitor CPU and memory utilization of the nodes",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "SAP"
+ "AKS",
+ "Monitor"
],
"severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "Monitor",
+ "EventHubs",
+ "ServiceBus",
+ "AKS",
+ "Storage"
],
"severity": "Medium",
- "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Monitor OS disk queue depth in nodes",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Implement SSO to SAP HANA",
- "waf": "Security"
- },
- {
- "checklist": "WAF checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
- "services": [
- "WAF",
- "Entra",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
- "waf": "Security"
- },
- {
- "checklist": "WAF checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "NVA",
+ "AKS",
+ "LoadBalancer",
+ "Monitor"
],
"severity": "Medium",
- "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "AKS",
+ "Monitor"
],
"severity": "Medium",
- "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Subscribe to resource health notifications for your AKS cluster",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "AKS"
],
- "severity": "Medium",
- "text": "Implement SSO to SAP BTP",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Resources",
+ "text": "Configure requests and limits in your pod specs",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "AKS"
],
"severity": "Medium",
- "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
- "waf": "Security"
+ "subcategory": "Resources",
+ "text": "Enforce resource quotas for namespaces",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
"services": [
- "WAF",
- "Subscriptions",
- "AzurePolicy",
- "SAP"
+ "AKS",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "enforce existing Management Group policies to SAP Subscriptions",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "severity": "High",
+ "subcategory": "Resources",
+ "text": "Ensure your subscription has enough quota to scale out your nodepools",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
+ "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+ "service": "AKS",
"services": [
- "WAF",
- "Subscriptions",
- "SAP"
+ "AKS"
],
"severity": "High",
- "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "subcategory": "Resources",
+ "text": "Configure Liveness and Readiness probes for all deployments",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "WAF",
- "Subscriptions"
+ "AKS"
],
- "severity": "High",
- "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Scalability",
+ "text": "Use the Cluster Autoscaler",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
"services": [
- "WAF",
- "Subscriptions",
- "VM"
+ "AKS"
],
- "severity": "High",
- "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "Customize node configuration for AKS node pools",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "Low",
- "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Scalability",
+ "text": "Use the Horizontal Pod Autoscaler when required",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
"services": [
- "WAF",
- "Subscriptions",
- "VM"
+ "AKS"
],
"severity": "High",
- "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
- "waf": "Operations"
+ "subcategory": "Scalability",
+ "text": "Consider an appropriate node size, not too large or too small",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS"
],
- "severity": "High",
- "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
"services": [
- "WAF",
- "TrafficManager",
- "Cost"
+ "AKS"
],
- "severity": "Medium",
- "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
"services": [
- "WAF",
- "Backup"
+ "AKS"
],
- "severity": "High",
- "text": "Help protect your HANA database by using the Azure Backup service.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "For long running operation on an AKS cluster consider event termination",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "Storage",
- "VM"
+ "AKS"
],
- "severity": "Medium",
- "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "Storage",
+ "AKS"
],
"severity": "High",
- "text": "Ensure time-zone matches between the operating system and the SAP system.",
- "waf": "Operations"
+ "subcategory": "Storage",
+ "text": "Use ephemeral OS disks",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra"
+ "Storage",
+ "AKS"
],
- "severity": "Medium",
- "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Storage",
+ "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
"services": [
- "WAF",
- "Cost"
+ "Storage",
+ "AKS"
],
"severity": "Low",
- "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
- "waf": "Cost"
+ "subcategory": "Storage",
+ "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "SAP"
+ "Storage",
+ "SQL",
+ "AKS"
],
"severity": "Medium",
- "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
- "waf": "Operations"
+ "subcategory": "Storage",
+ "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
"services": [
- "WAF",
- "VM"
+ "Storage",
+ "AKS"
],
"severity": "Medium",
- "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "Operations"
+ "subcategory": "Storage",
+ "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
+ "category": "Operations",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"services": [
- "WAF",
- "SAP"
+ "Storage",
+ "AKS"
],
- "severity": "Low",
- "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
+ "waf": "Performance"
},
{
- "checklist": "WAF checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Implement branching policy in Azure DevOps",
+ "guid": "eda1dae2-cc85-4c47-a6b7-81cca0e6c465",
+ "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-policies-overview?view=azure-devops",
"services": [
- "WAF",
- "SQL",
- "Monitor",
- "SAP"
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "severity": "High",
+ "subcategory": "Branching Policy",
+ "text": "Branch Policies",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Understand branch strategy such as GitFlow or GitHub Flow",
+ "guid": "bc288bec-6a16-4ca7-8444-51e1add34529",
+ "link": "https://learn.microsoft.com/azure/devops/repos/git/git-branching-guidance?view=azure-devops",
"services": [
- "VM",
- "WAF",
- "Monitor",
- "Entra",
- "SAP"
+ "AzurePolicy"
],
"severity": "High",
- "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "subcategory": "Branching Policy",
+ "text": "Branching strategy",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Understand how teams work with git",
+ "guid": "ec723823-7a15-41c5-ab4e-401914387e5c",
+ "link": "https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow",
"services": [
- "WAF",
"AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "severity": "High",
+ "subcategory": "Branching Policy",
+ "text": "Understand GitFlow Branch Strategy",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Merge into higher branches after two or more reviewers in a PR",
+ "guid": "a9c26c9c-32ab-45bd-8c69-98a246e33899",
+ "link": "https://learn.microsoft.com/azure/devops/repos/git/review-pull-requests?view=azure-devops&tabs=browser",
"services": [
- "WAF",
- "Monitor",
- "NetworkWatcher",
- "SAP"
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "severity": "High",
+ "subcategory": "Branching Policy",
+ "text": "Pull Request Review",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Implement access control to the branches",
+ "guid": "7e41c77d-68cb-46a2-8ac1-9f916d697d8e",
+ "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-permissions?view=azure-devops",
"services": [
- "WAF",
- "SAP",
- "VM"
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "subcategory": "Branching Policy",
+ "text": "Access Control to the Branch",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "services": [
- "WAF",
- "Subscriptions",
- "SAP"
- ],
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Perform SAST code scan",
+ "guid": "adfd27bd-e187-401a-a252-baa9b68a088c",
+ "link": "https://devblogs.microsoft.com/devops/integrate-security-into-your-developer-workflow-with-github-advanced-security-for-azure-devops/",
+ "services": [],
"severity": "High",
- "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Performance"
- },
- {
- "checklist": "WAF checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
- "services": [
- "WAF",
- "Storage",
- "ASR"
- ],
- "severity": "Medium",
- "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Reliability"
- },
- {
- "checklist": "WAF checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP",
- "Monitor",
- "Sentinel"
- ],
- "severity": "Medium",
- "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "subcategory": "Security",
+ "text": "Code Scan",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
- "services": [
- "WAF",
- "Cost"
- ],
- "severity": "Medium",
- "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Understand TFVC as Code Repo",
+ "guid": "9a8f822b-8eb9-4d1b-a77f-26e5e6beba8e",
+ "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/what-is-tfvc?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Practice",
+ "text": "TFVC as Code Repository",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "services": [
- "WAF",
- "Monitor",
- "VM"
- ],
+ "category": "Version Control",
+ "checklist": "Azure DevOps",
+ "description": "Compare Git vs TFVC for your project",
+ "guid": "d4f3437b-c336-4d71-9f27-a71eee0b9b5d",
+ "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops",
+ "services": [],
"severity": "Low",
- "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
- "waf": "Performance"
+ "subcategory": "Practice",
+ "text": "Choose Right version control",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "services": [
- "WAF",
- "Monitor",
- "ASR",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Set up your team management",
+ "guid": "8defd5d7-21d4-41d2-900c-807bf9eab40f",
+ "link": "https://learn.microsoft.com/azure/devops/organizations/settings/manage-teams?view=azure-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Team Planning",
+ "text": "Configure your teams",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
- "services": [
- "WAF",
- "Storage",
- "SAP"
- ],
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Start scheduling sprints",
+ "guid": "9ed5b354-78d4-447a-a26c-2863c00f1cac",
+ "link": "https://learn.microsoft.com/azure/devops/boards/sprints/define-sprints?view=azure-devops",
+ "services": [],
"severity": "Medium",
- "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
- "waf": "Performance"
+ "subcategory": "Team Planning",
+ "text": "Configure your sprints",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP"
- ],
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Set up your work item heirarchy",
+ "guid": "699ef1d5-a83d-4e5d-b36c-1c81870a0bc5",
+ "link": "https://learn.microsoft.com/azure/devops/organizations/settings/work/customize-process-work-item-type?view=azure-devops",
+ "services": [],
"severity": "Low",
- "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
- "waf": "Performance"
+ "subcategory": "Team Planning",
+ "text": "Choose Work Item types",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
- "services": [
- "WAF",
- "Storage",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Performance"
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "WIT Processes available in Azure DevOps",
+ "guid": "c1e43a18-658d-4285-aed6-7179b825546d",
+ "link": "https://learn.microsoft.com/azure/devops/boards/work-items/guidance/choose-process?view=azure-devops&tabs=agile-process",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Team Planning",
+ "text": "Select a WIT Process",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
- "services": [
- "WAF",
- "SQL",
- "SAP"
- ],
- "severity": "Medium",
- "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Performance"
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Use Azure Boards with GitHub",
+ "guid": "f2aee455-3afc-4833-a248-726dd68c5b5c",
+ "link": "https://learn.microsoft.com/azure/devops/cross-service/github-integration?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Tool Integration",
+ "text": "GitHub Integration",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "services": [
- "WAF",
- "Monitor",
- "ASR",
- "SAP"
- ],
- "severity": "High",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Understand the methologies",
+ "guid": "2925394b-69b9-4d37-aac4-3bc68d1d7665",
+ "link": "https://www.atlassian.com/agile/scrum/agile-vs-scrum",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Process Planning",
+ "text": "Understand Agile Vs Scrum",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
- "services": [
- "WAF",
- "AppGW",
- "AzurePolicy"
- ],
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Create Dashboard and PowerBI reports",
+ "guid": "7246b448-564b-44dd-94a7-59c7633bd2a1",
+ "link": "https://learn.microsoft.com/azure/devops/report/dashboards/overview?view=azure-devops",
+ "services": [],
"severity": "Medium",
- "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
- "waf": "Security"
+ "subcategory": "Reporting",
+ "text": "Dashboard",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP",
- "DNS",
- "VM"
- ],
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Set up backlog",
+ "guid": "a27a764a-90be-40e3-98ee-293c1bd363ca",
+ "link": "https://learn.microsoft.com/azure/devops/boards/backlogs/set-up-your-backlog?view=azure-devops",
+ "services": [],
"severity": "Medium",
- "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "subcategory": "Reporting",
+ "text": "Refine your backlog",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "services": [
- "WAF",
- "DNS",
- "SAP",
- "VNet"
- ],
+ "category": "Azure Boards",
+ "checklist": "Azure DevOps",
+ "description": "Link your work items",
+ "guid": "aab75719-49ab-4919-9dc9-fc9d1bb84b37",
+ "link": "https://learn.microsoft.com/azure/devops/boards/queries/link-work-items-support-traceability?view=azure-devops&tabs=browser",
+ "services": [],
"severity": "Medium",
- "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "subcategory": "Reporting",
+ "text": "Visualize Relationships",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
- "services": [
- "WAF",
- "ACR",
- "SAP",
- "VNet"
- ],
- "severity": "Medium",
- "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "Reliability"
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "View the velocity report",
+ "guid": "b5a67fcb-9ed5-4b35-978d-447a826c2863",
+ "link": "https://learn.microsoft.com/azure/devops/report/dashboards/team-velocity?view=azure-devops&tabs=in-context",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Reporting",
+ "text": "Review Team Velocity",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "services": [
- "WAF",
- "NVA",
- "SAP"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Create your first pipeline",
+ "guid": "c00f1cac-699e-4f1d-9a83-de5de36c1c81",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=java%2Ctfs-2018-2%2Cbrowser",
+ "services": [],
"severity": "High",
- "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "Performance"
+ "subcategory": "Continuous Integration",
+ "text": "Set up pipeline",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
- "services": [
- "WAF",
- "ACR",
- "VWAN",
- "SAP"
- ],
- "severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Specify events that trigger pipelines",
+ "guid": "870a0bc5-c1e4-43a1-a658-d2858ed67179",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/build/triggers?view=azure-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Continuous Integration",
+ "text": "Set Build triggers",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
- "services": [
- "WAF",
- "NVA",
- "VNet"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Use YAML to create build pipeline",
+ "guid": "b825546d-f2ae-4e45-93af-c8339248726d",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/customize-pipeline?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Continuous Integration",
+ "text": "Customize YAML Pipeline",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Use classic GUI editor to set up pipeline",
+ "guid": "d68c5b5c-2925-4394-a69b-9d379ac43bc6",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/get-started/pipelines-get-started?view=azure-devops&source=recommendations#define-pipelines-using-the-classic-interface",
+ "services": [],
"severity": "Medium",
- "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "subcategory": "Continuous Integration",
+ "text": "Use GUI for pipeline",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
- "services": [
- "NVA",
- "WAF",
- "VWAN",
- "SAP",
- "VNet"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set up templates, parameters and expressions",
+ "guid": "8d1d7665-7246-4b44-a564-b4dd74a759c7",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/templates?view=azure-devops&pivots=templates-includes",
+ "services": [],
"severity": "Medium",
- "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "subcategory": "Continuous Integration",
+ "text": "Configure Templates",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP",
- "VM"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set up jobs, stages and dependencies",
+ "guid": "633bd2a1-a27a-4764-a90b-e0e378ee293c",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/stages?view=azure-devops&tabs=yaml",
+ "services": [],
"severity": "High",
- "text": "Public IP assignment to VM running SAP Workload is not recommended.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Continuous Integration",
+ "text": "Jobs",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
- "services": [
- "WAF",
- "ASR"
- ],
- "severity": "High",
- "text": "Consider reserving IP address on DR side when configuring ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set up conditions and Demands",
+ "guid": "1bd363ca-aab7-4571-a49a-b9193dc9fc9d",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/conditions?view=azure-devops&tabs=yaml%2Cstages",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Continuous Integration",
+ "text": "Conditions and Demands",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "services": [
- "WAF"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Define Variables",
+ "guid": "1bb84b37-b5a6-47fc-a9ed-5b35478d447a",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch",
+ "services": [],
"severity": "High",
- "text": "Avoid using overlapping IP address ranges for production and DR sites.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "subcategory": "Continuous Integration",
+ "text": "Variables",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
- "services": [
- "WAF",
- "Storage",
- "VNet"
- ],
- "severity": "Medium",
- "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set up your deployment pipeline",
+ "guid": "826c2863-c00f-41ca-a699-ef1d5a83de5d",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/create-multistage-pipeline?view=azure-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Continuous Deployment",
+ "text": "Deployment Pipeline",
"waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "services": [
- "WAF",
- "Firewall"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Select correct branches to deploy from",
+ "guid": "e36c1c81-870a-40bc-9c1e-43a18658d285",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deploy-multiple-branches?view=azure-devops",
+ "services": [],
"severity": "Medium",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "Continuous Deployment",
+ "text": "Release branch",
+ "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
- "services": [
- "WAF",
- "AppGW",
- "SAP"
- ],
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "use relevant template to deploy to azure",
+ "guid": "8ed67179-b825-4546-bf2a-ee4553afc833",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/overview-azure?view=azure-devops",
+ "services": [],
"severity": "Medium",
- "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
- "waf": "Security"
+ "subcategory": "Continuous Deployment",
+ "text": "Deploy to Azure",
+ "waf": "Operations"
},
{
- "checklist": "WAF checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Define Release Approvals and pre deployment checks",
+ "guid": "9248726d-d68c-45b5-a292-5394b69b9d37",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/approvals?view=azure-devops&tabs=check-pass",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Continuous Deployment",
+ "text": "Approvals and Checks",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Define Gates and post deployment checks",
+ "guid": "9ac43bc6-8d1d-4766-9724-6b448564b4dd",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/release/approvals/?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Continuous Deployment",
+ "text": "Gates",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Define Azure Function and REST API Checks",
+ "guid": "74a759c7-633b-4d2a-8a27-a764a90be0e3",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/process/invoke-checks?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Continuous Deployment",
+ "text": "Azure Function Checks",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Review pipeline reports",
+ "guid": "78ee293c-1bd3-463c-aaab-7571949ab919",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/reports/pipelinereport?view=azure-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Continuous Deployment",
+ "text": "Pipline Reports",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "configure Trend Result widget",
+ "guid": "3dc9fc9d-1bb8-44b3-9b5a-67fcb9ed5b35",
+ "link": "https://learn.microsoft.com/azure/devops/report/dashboards/analytics-widgets?toc=%2Fazure%2Fdevops%2Fpipelines%2Ftoc.json&view=azure-devops#test-results-trend-advanced",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Analytics",
+ "text": "Pipeline Result Trend",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Connect with WIT to visualize work",
+ "guid": "478d447a-826c-4286-9c00-f1cac699ef1d",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/integrations/configure-pipelines-work-tracking?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Analytics",
+ "text": "Work Tracking with Pipeline",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Understand agent pools",
+ "guid": "5a83de5d-e36c-41c8-8870-a0bc5c1e43a1",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/agents/agents?view=azure-devops&tabs=yaml%2Cbrowser",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Continuous Deployment",
+ "text": " Agents and agent pools",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Understand and provision Deployment Groups when required",
+ "guid": "8658d285-8ed6-4717-ab82-5546df2aee45",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deployment-groups/?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Continuous Deployment",
+ "text": "Deployment Groups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Understand Kubernetes Deployment",
+ "guid": "53afc833-9248-4726-bd68-c5b5c2925394",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/ecosystems/kubernetes/deploy?view=azure-devops",
+ "services": [
+ "AKS"
+ ],
+ "severity": "Low",
+ "subcategory": "Continuous Deployment",
+ "text": "Deploy to Kubernetes",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Perform Dynamic Security Testing",
+ "guid": "b69b9d37-9ac4-43bc-98d1-d76657246b44",
+ "link": "https://devblogs.microsoft.com/premier-developer/azure-devops-pipelines-leveraging-owasp-zap-in-the-release-pipeline/",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "DAST Scan",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Manage Service Connections",
+ "guid": "8564b4dd-74a7-459c-9633-bd2a1a27a764",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Service Connections",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set data retention policies for CI and CD",
+ "guid": "a90be0e3-78ee-4293-a1bd-363caaab7571",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/retention?view=azure-devops&tabs=yaml",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Retention Policies",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set up and pay for concurrent pipelines",
+ "guid": "949ab919-3dc9-4fc9-b1bb-84b37b5a67fc",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/licensing/concurrent-jobs?view=azure-devops&tabs=ms-hosted",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Administration",
+ "text": "Parallel Pipelines",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Set pipeline permissions",
+ "guid": "b9ed5b35-478d-4447-a826-c2863c00f1ca",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/permissions?view=azure-devops",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Pipeline Permissions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Pipelines",
+ "checklist": "Azure DevOps",
+ "description": "Add users to pipeline",
+ "guid": "c699ef1d-5a83-4de5-be36-c1c81870a0bc",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/set-permissions?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Security",
+ "text": "Pipeline Users",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Configure Artifacts",
+ "guid": "5c1e43a1-8658-4d28-98ed-67179b825546",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/artifacts-overview?view=azure-devops&tabs=nuget",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Configuration",
+ "text": "Artifact In Pipeline",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Publish and consume artifact in pipeline",
+ "guid": "df2aee45-53af-4c83-9924-8726dd68c5b5",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/pipeline-artifacts?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Configuration",
+ "text": "Publish and download Artifact",
+ "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Publish NuGet packages with artifacts",
+ "guid": "c2925394-b69b-49d3-99ac-43bc68d1d766",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/nuget?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Configuration",
+ "text": "NuGet",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Publish Maven packages with artifacts",
+ "guid": "57246b44-8564-4b4d-b74a-759c7633bd2a",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/publish-maven-artifacts?view=azure-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Configuration",
+ "text": "Maven",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Publish NPM packages with artifacts",
+ "guid": "1a27a764-a90b-4e0e-978e-e293c1bd363c",
+ "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/npm?view=azure-devops&tabs=yaml",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Configuration",
+ "text": "NPM",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Artifact",
+ "checklist": "Azure DevOps",
+ "description": "Best Practices to work with Azure Artifact",
+ "guid": "aaab7571-949a-4b91-a3dc-9fc9d1bb84b3",
+ "link": "https://learn.microsoft.com/azure/devops/artifacts/concepts/best-practices?view=azure-devops",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Configuration",
+ "text": "Best Practices",
+ "waf": "Operations"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "What is monitoring?",
+ "guid": "7b5a67fc-b9ed-45b3-9478-d447a826c286",
+ "link": "https://learn.microsoft.com/devops/operate/what-is-monitoring",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": "Practice",
+ "text": "What to monitor?",
+ "waf": "Operations"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Progressive Exposure Strategy",
+ "guid": "3c00f1ca-c699-4ef1-b5a8-3de5de36c1c8",
+ "link": "https://learn.microsoft.com/devops/operate/safe-deployment-practices",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Practice",
+ "text": "Safe Deployment Practices",
+ "waf": "Operations"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Microsoft runs reliable systems with DevOps",
+ "guid": "1870a0bc-5c1e-443a-8865-8d2858ed6717",
+ "link": "https://learn.microsoft.com/devops/operate/how-microsoft-operates-devops",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Practice",
+ "text": "Case Study",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Security in DevOps",
+ "guid": "9b825546-df2a-4ee4-953a-fc8339248726",
+ "link": "https://learn.microsoft.com/devops/operate/security-in-devops",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Practice",
+ "text": "DevSecOps",
+ "waf": "Security"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Enable DevSecops with Azure And GitHub",
+ "guid": "dd68c5b5-c292-4539-9b69-b9d379ac43bc",
+ "link": "https://learn.microsoft.com/devops/devsecops/enable-devsecops-azure-github",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Practice",
+ "text": "DevSecops",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Security"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Mirror RBAC in DevOps",
+ "guid": "68d1d766-5724-46b4-9856-4b4dd74a759c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/secure/best-practices/end-to-end-governance",
+ "services": [
+ "RBAC"
+ ],
+ "severity": "Low",
+ "subcategory": "Practice",
+ "text": "Secure DevOps Govenance",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Security"
+ },
+ {
+ "category": "DevOps Practice",
+ "checklist": "Azure DevOps",
+ "description": "Governance when using CI/CD",
+ "guid": "7633bd2a-1a27-4a76-9a90-be0e378ee293",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/governance/end-to-end-governance-in-azure",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Practice",
+ "text": "Azure DevOps Governance",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Metaprompting",
+ "text": "Follow Metaprompting guardrails for resonsible AI",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
+ "services": [
+ "Entra",
+ "APIM"
+ ],
+ "severity": "High",
+ "subcategory": "Load Balancing",
+ "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Enable monitoring for your AOAI instances",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.insights/metricalerts' | extend compliant = (properties.targetResourceType =~ 'Microsoft.CognitiveServices/accounts') | project id, compliant",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "services": [
+ "AKV",
+ "Monitor",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Alerts",
+ "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Monitor token usage to prevent service disruptions due to capacity",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Observability",
+ "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
+ "services": [
+ "APIM"
+ ],
+ "severity": "Low",
+ "subcategory": "Observability",
+ "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Infrastructure Deployment",
+ "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Authentication",
+ "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
+ "waf": "Security"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Evaluation",
+ "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Hosting model",
+ "text": "Evaluate usage of Provisioned throughput model ",
+ "waf": "Performance"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Content Safety",
+ "text": "Review and implement Azure AI content safety",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Throughput definition",
+ "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Latency improvement",
+ "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
+ "services": [
+ "ServiceBus",
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Elasticity segregation",
+ "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Benchmarking",
+ "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Elasticity ",
+ "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Model choice",
+ "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
+ "waf": "Performance"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Fine tuning",
+ "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
+ "waf": "Performance"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "services": [
+ "ACR"
+ ],
+ "severity": "Low",
+ "subcategory": "Multi-region architecture",
+ "text": "Deploy multiple OAI instances across regions",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "services": [
+ "Entra",
+ "APIM"
+ ],
+ "severity": "High",
+ "subcategory": "Load balancing",
+ "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Quotas",
+ "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "UX best practice",
+ "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
+ "services": [
+ "ACR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Load balancing",
+ "text": "Deploy separate fine tuned models across regions if finetuning is employed",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
+ "services": [
+ "Backup",
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Data Backup and Disaster Recovery",
+ "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.search/searchservices' | extend compliant = (sku.name != 'free' and properties.replicaCount >= 3) | project id, compliant",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "SLA considerations",
+ "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Data Sensitivity",
+ "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Encryption at Rest",
+ "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
+ "services": [
+ "ACR"
+ ],
+ "severity": "High",
+ "subcategory": "Transit Encryption",
+ "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "services": [
+ "RBAC"
+ ],
+ "severity": "High",
+ "subcategory": "Access Control",
+ "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Masking and Redaction",
+ "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/ai-onboarding",
+ "service": "Azure OpenAI",
+ "services": [
+ "Sentinel",
+ "Defender",
+ "Monitor"
+ ],
+ "severity": "High",
+ "subcategory": "Threat Detection and Monitoring",
+ "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Data Retention and Disposal",
+ "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "waf": "Security"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Jail break Safety",
+ "text": "Implement Prompt shields and groundedness detection using Content Safety ",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Data Privacy and Compliance",
+ "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Employee Awareness and Training",
+ "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Environment segregation",
+ "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Index Segregation",
+ "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
+ "services": [
+ "AzurePolicy",
+ "RBAC"
+ ],
+ "severity": "Medium",
+ "subcategory": "Sensitive Data in Separate Instances",
+ "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Embedding and Vector handling",
+ "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "services": [
+ "RBAC"
+ ],
+ "severity": "High",
+ "subcategory": "Access control",
+ "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.privateEndpointConnections != '[]' and properties.publicNetworkAccess !~ 'enabled')",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
+ "services": [
+ "PrivateLink"
+ ],
+ "severity": "High",
+ "subcategory": "Network security",
+ "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
+ "services": [
+ "Firewall",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "Network security",
+ "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Control Network Access",
+ "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "waf": "Security"
+ },
+ {
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "ACR",
- "FrontDoor",
- "AzurePolicy"
+ "Cost"
],
"severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Token Optimization",
+ "text": "Use prompt compression tools like LLMLingua or gprtrim",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (isnotnull(identity))",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "AKV",
+ "Entra"
],
+ "severity": "High",
+ "subcategory": "Secure APIs and Endpoints",
+ "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
+ "services": [],
"severity": "Medium",
- "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "subcategory": "Implement Strong Authentication",
+ "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "AppGW",
- "LoadBalancer"
+ "Monitor"
],
"severity": "Medium",
- "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "subcategory": "Use Network Monitoring",
+ "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Security Audits and Penetration Testing",
+ "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (tags != '{}')",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Infrastructure Deployment",
+ "text": "Azure AI Services are properly tagged for better management",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Infrastructure Deployment",
+ "text": "Azure AI Service accounts follows organizational naming conventions",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Diagnostics Logging",
+ "text": "Diagnostic logs in Azure AI services resources should be enabled",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.disableLocalAuth == true)",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "ACR",
- "VWAN",
- "SAP"
+ "Entra"
],
- "severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Entra ID based access",
+ "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "ACR",
- "Storage",
- "WAF",
- "PrivateLink",
- "Backup",
- "VNet"
+ "AKV",
+ "Entra"
],
- "severity": "Medium",
- "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "severity": "High",
+ "subcategory": "Secure Key Management",
+ "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP",
- "VM"
+ "AKV"
],
"severity": "High",
- "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Performance"
+ "subcategory": "Key Rotation and Expiration",
+ "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "LoadBalancer"
+ "Cost"
],
- "severity": "Medium",
- "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "severity": "High",
+ "subcategory": "Token Optimization",
+ "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
+ "waf": "Cost Optimization"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Secure coding practice",
+ "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Patching and updates",
+ "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
+ "waf": "Security"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP",
- "VM",
- "VNet"
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "services": [
+ "Cost"
],
"severity": "Medium",
- "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Cost familiarization",
+ "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP",
- "VNet"
+ "Cost"
],
"severity": "High",
- "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "subcategory": "Batch processing",
+ "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP"
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "Performance"
+ "subcategory": "Cost monitoring",
+ "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP"
+ "Cost"
+ ],
+ "severity": "Medium",
+ "subcategory": "Token limit",
+ "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
+ "waf": "Cost Optimization"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "AI Search Vector Limits",
+ "text": "Plan and manage AI Search Vector storage",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "services": [
+ "ACR"
+ ],
+ "severity": "Medium",
+ "subcategory": "DevOps",
+ "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "services": [
+ "Cost",
+ "Storage"
],
"severity": "High",
- "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "subcategory": "Costing Model",
+ "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
+ "waf": "Cost Optimization"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DevOps",
+ "text": "Evaluate the quality of prompts and applications when switching between model versions",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Evaluate your Azure AI Search results based on different search parameters",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Security Audits and Penetration Testing",
+ "text": "Red team your GenAI applications",
+ "waf": "Security"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "End user feedback",
+ "text": "Provide end users with scoring options for LLM responses and track these scores. ",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "services": [
+ "Cost"
+ ],
+ "severity": "High",
+ "subcategory": "Quota Management",
+ "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
+ "waf": "Cost Optimization"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
+ "services": [
+ "Entra",
+ "LoadBalancer",
+ "ACR",
+ "APIM"
+ ],
+ "severity": "Medium",
+ "subcategory": "Load Balancing",
+ "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
+ "waf": "Operational Excellence"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
+ "service": "Azure OpenAI",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Fine tuning",
+ "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Responsible AI",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Content Safety",
+ "text": "Tune content filters to minimize false positives from overly aggressive filters",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP",
- "Cost",
- "VNet"
+ "AKV"
],
- "severity": "High",
- "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Key Management",
+ "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' and kind =~ 'contentsafety' | project id, compliant = 1",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
"LoadBalancer"
],
- "severity": "High",
- "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Jailbreak protection",
+ "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
- "services": [
- "WAF",
- "SAP",
- "VNet"
- ],
+ "category": "Governance and Security",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
+ "services": [],
"severity": "Medium",
- "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
+ "subcategory": "Quota exhaustion",
+ "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SAP",
- "Backup",
- "VM"
+ "Cost"
],
- "severity": "High",
- "text": "Review SAP HANA database backups for Azure VMs.",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Cost estimation",
+ "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
+ "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "Monitor",
- "ASR",
- "SAP"
+ "Cost"
],
"severity": "Medium",
- "text": "Review Site Recovery built-in monitoring, where used for SAP.",
- "waf": "Cost"
+ "subcategory": "Model selection",
+ "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "Monitor",
- "SAP"
+ "Cost"
],
- "severity": "High",
- "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Usage Optimization",
+ "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "Backup",
- "VM"
+ "Cost"
],
"severity": "Medium",
- "text": "Review Oracle Database in Azure Linux VM backup strategies.",
- "waf": "Operations"
+ "subcategory": "Usage Optimization",
+ "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "category": "Cost Optimization",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "WAF",
- "SQL",
- "Storage"
+ "Cost"
],
"severity": "Medium",
- "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
- "waf": "Operations"
+ "subcategory": "Token Optimization",
+ "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
+ "waf": "Cost Optimization"
},
{
- "checklist": "WAF checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
- "services": [
- "WAF",
- "Backup",
- "VM"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
+ "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
+ "service": "Azure OpenAI",
+ "services": [],
"severity": "Medium",
- "text": "Review the use of Automated Backup v2 for Azure VMs.",
- "waf": "Operations"
+ "subcategory": "IaC",
+ "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
+ "waf": "Operational Excellence"
},
{
- "checklist": "WAF checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Enabling Write accelerator for M series when using premium disks(V1)",
- "waf": "Operations"
+ "category": "Operations Management",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5855",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
+ "service": "Azure OpenAI",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development",
+ "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
+ "waf": "Operational Excellence"
},
{
- "checklist": "WAF checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
+ "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
+ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
+ "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
+ "service": "ACR",
"services": [
- "WAF"
+ "ACR"
],
- "severity": "Medium",
- "text": "Test availability zone latency.",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Data Protection",
+ "text": "Disable Azure Container Registry image export",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
+ "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
+ "service": "ACR",
"services": [
- "WAF",
- "SAP"
+ "ACR",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Activate SAP EarlyWatch Alert for all SAP components.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Data Protection",
+ "text": "Enable Azure Policies for Azure Container Registry",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
+ "guid": "d345293c-7639-4637-a551-c5c04e401955",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
+ "service": "ACR",
"services": [
- "WAF",
- "SAP"
+ "AKV",
+ "ACR"
],
- "severity": "Medium",
- "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Data Protection",
+ "text": "Sign and Verify containers with notation (Notary v2)",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
+ "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
+ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
+ "service": "ACR",
"services": [
- "WAF",
- "SQL",
- "Monitor"
+ "AKV",
+ "ACR"
],
"severity": "Medium",
- "text": "Review SQL Server performance monitoring using CCMS.",
- "waf": "Performance"
+ "subcategory": "Data Protection",
+ "text": "Encrypt registry with a customer managed key",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
+ "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
- "WAF",
- "SAP",
- "VM"
+ "Entra",
+ "ACR",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Use Managed Identities to connect instead of Service Principals",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
- "WAF",
- "Monitor",
- "SAP"
+ "Entra",
+ "ACR",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Review SAP HANA studio alerts.",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Disable local authentication for management plane access",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
+ "service": "ACR",
"services": [
- "WAF",
- "SAP"
+ "Entra",
+ "ACR",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
+ "waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable anonymous pull/push access",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
+ "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
+ "service": "ACR",
"services": [
- "WAF",
- "VM"
+ "Entra",
+ "ACR"
],
"severity": "Medium",
- "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "subcategory": "Identity and Access Control",
+ "text": "Disable Anonymous pull access",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
+ "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
+ "service": "ACR",
"services": [
- "WAF",
- "SAP"
+ "Entra",
+ "ACR"
],
- "severity": "Medium",
- "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Disable repository-scoped access tokens",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
+ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
+ "service": "ACR",
"services": [
- "WAF",
- "SQL",
- "SAP"
+ "EventHubs",
+ "Entra",
+ "ACR",
+ "PrivateLink"
],
- "severity": "Low",
- "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "severity": "High",
+ "subcategory": "Identity and Access Control",
+ "text": "Deploy images from a trusted environment",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
+ "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
+ "service": "ACR",
"services": [
- "WAF",
- "SQL"
+ "Entra",
+ "ACR",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
- "training": "https://me.sap.com/notes/3019299/E",
+ "severity": "Medium",
+ "subcategory": "Identity and Access Control",
+ "text": "Disable Azure ARM audience tokens for authentication",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
+ "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
+ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
+ "service": "ACR",
"services": [
- "Storage",
- "WAF",
- "SQL",
- "Backup",
- "SAP"
+ "Entra",
+ "ACR",
+ "Monitor"
],
- "severity": "High",
- "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "severity": "Medium",
+ "subcategory": "Logging and Monitoring",
+ "text": "Enable diagnostics logging",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
+ "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "service": "ACR",
"services": [
- "WAF",
- "Storage"
+ "PrivateLink",
+ "ACR",
+ "Firewall",
+ "VNet"
],
"severity": "Medium",
- "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "subcategory": "Network Security",
+ "text": "Control inbound network access with Private Link",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable public network access if inbound network access is secured using Private Link",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
+ "service": "ACR",
"services": [
- "WAF",
- "AKV"
+ "PrivateLink",
+ "ACR"
],
- "severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Network Security",
+ "text": "Disable Public Network access",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only the ACR Premium SKU supports Private Link access",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
+ "service": "ACR",
"services": [
- "WAF",
- "Subscriptions",
- "RBAC",
- "AzurePolicy"
+ "PrivateLink",
+ "ACR"
],
"severity": "Medium",
- "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "subcategory": "Network Security",
+ "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
+ "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "service": "ACR",
"services": [
- "WAF",
- "AKV",
- "AzurePolicy"
+ "Defender",
+ "ACR"
],
- "severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "severity": "Low",
+ "subcategory": "Network Security",
+ "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
+ "service": "ACR",
"services": [
- "WAF",
- "RBAC",
- "AzurePolicy"
+ "ACR"
],
- "severity": "High",
- "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Vulnerability Management",
+ "text": "Deploy validated container images",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Security",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
+ "service": "ACR",
"services": [
- "WAF",
- "Storage",
- "SAP",
- "Defender"
+ "ACR"
],
"severity": "High",
- "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "subcategory": "Vulnerability Management",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Security"
},
{
- "checklist": "WAF checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
+ "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "RBAC",
- "SAP",
- "Defender"
+ "Storage",
+ "Cost"
],
- "severity": "High",
- "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Replication",
+ "text": "Leverage External Tables and Continuous data export overview to reduce costs",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
+ "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
+ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "SAP"
+ "Storage"
],
- "severity": "Low",
- "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
- "waf": "Security"
+ "subcategory": "Replication",
+ "text": "To share data, explore Leader-follower cluster configuration",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
+ "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "AKV"
+ "ASR"
],
- "severity": "Medium",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Replication",
+ "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "AKV"
+ "Storage",
+ "RBAC"
],
- "severity": "High",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Replication",
+ "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "services": [
- "WAF",
- "AKV",
- "SAP"
- ],
- "severity": "High",
- "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
- "waf": "Security"
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
+ "service": "Azure Data Explorer",
+ "services": [],
+ "subcategory": "Replication",
+ "text": "Ingest data into each cluster in parallel",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
+ "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "RBAC",
- "Subscriptions",
- "SAP"
+ "ACR"
],
- "severity": "High",
- "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
- "waf": "Security"
+ "subcategory": "DR Configuration",
+ "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
+ "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "PrivateLink",
- "NVA",
- "SAP"
+ "ACR"
],
- "severity": "High",
- "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "Security"
+ "subcategory": "DR Configuration",
+ "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
+ "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
+ "service": "Azure Data Explorer",
+ "services": [],
+ "subcategory": "DR Configuration",
+ "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
+ "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
"Storage",
- "VM"
+ "Cost",
+ "AzurePolicy",
+ "ASR"
],
- "severity": "Low",
- "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
- "waf": "Security"
+ "subcategory": "DR Configuration",
+ "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
+ "category": "Operations Management",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
+ "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "Defender"
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
- "waf": "Security"
+ "subcategory": "IaC",
+ "text": "Wrap DevOps and source control around all your code",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Operations Management",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
+ "services": [],
+ "subcategory": "IaC",
+ "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
+ "services": [],
+ "subcategory": "IaC",
+ "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "a96b96ad-8840-48f3-9273-4c876ba28021",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency",
"services": [
- "WAF",
- "SAP",
+ "DNS",
"VNet"
],
"severity": "High",
- "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Azure Private DNS",
+ "text": "Verify that Zones are linked to Vnets in multiple regions",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "45901465-d38e-453f-accb-d969266acca2",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency",
"services": [
- "WAF",
- "SAP"
+ "DNS"
],
- "severity": "Low",
- "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Azure Private DNS",
+ "text": "If different Zones are used between regions, verify a plan for making sure that Zones are up to date in a DR failover situation",
+ "waf": "Reliability"
},
{
- "checklist": "WAF checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "74faa19b-f39d-495d-94c7-c8919ca1f6d5",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json",
"services": [
- "WAF",
- "AKV",
- "Monitor",
- "SAP"
+ "TrafficManager",
+ "DNS",
+ "ASR"
],
"severity": "Medium",
- "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Azure DNS",
+ "text": "Plan for disaster recovery with Azure DNS and Traffic Manager",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "315ae524-ba34-4d45-a5e1-2139bd7bb012",
+ "link": "https://learn.microsoft.com/azure/dns/private-resolver-reliability#availability-zones",
"services": [
- "WAF"
+ "DNS"
],
- "severity": "High",
- "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "severity": "Medium",
+ "subcategory": "Azure DNS Resolver",
+ "text": "Enable availability zones with Private Resolver",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "f7b95e06-e154-4e2a-a359-2828e6e20517",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
"services": [
- "WAF"
+ "DNS",
+ "ASR"
],
"severity": "Medium",
- "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "subcategory": "Azure DNS Resolver",
+ "text": "Plan for failover with Private Resolvers in a Disaster Recovery",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "2676ae46-691e-4883-9ad9-42223e138105",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph",
"services": [
- "WAF"
+ "DNS",
+ "VM"
+ ],
+ "severity": "Medium",
+ "subcategory": "VM Based DNS Service",
+ "text": "Follow VM Guidance for resillency of VM",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "DNS Review Checklist",
+ "guid": "23081a94-1741-4583-9ff7-ad7c6d373316",
+ "link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html",
+ "services": [
+ "Entra",
+ "DNS",
+ "VM"
],
+ "severity": "Medium",
+ "subcategory": "VM Based DNS Service",
+ "text": "IF AD based DNS, follow the Identity -> Windows Server AD path",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "services": [],
"severity": "High",
- "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "subcategory": "Availablity Zone",
+ "text": "Use zone redundant pipelines in regions that support Availability Zones",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
+ "category": "Operations Management",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "ACR"
+ "Backup"
],
"severity": "Medium",
- "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "subcategory": "DevOps Integration",
+ "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "ACR"
+ "VM"
],
"severity": "Medium",
- "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "subcategory": "Network",
+ "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "TrafficManager"
+ "VNet"
],
"severity": "Medium",
- "text": "Use Azure Traffic Manager to coordinate requests",
+ "subcategory": "Network",
+ "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "WAF checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "category": "Governance and Security",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "Storage",
- "Backup"
+ "AKV"
],
- "severity": "High",
- "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "severity": "Low",
+ "subcategory": "Integration",
+ "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
+ "services": [
+ "Subscriptions",
+ "Entra",
+ "AVS"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "subcategory": "Identity",
+ "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"services": [
- "WAF",
- "Backup"
+ "Entra",
+ "AVS"
],
- "severity": "Medium",
- "text": "check backup instances with the underlying datasource not found",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"services": [
- "WAF"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
- "waf": "Cost"
+ "subcategory": "Identity",
+ "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage",
- "Backup",
- "ASR"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
- "waf": "Cost"
+ "subcategory": "Identity",
+ "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor"
+ "Entra",
+ "AVS"
],
- "severity": "Medium",
- "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "WAF checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy"
+ "Entra",
+ "AVS",
+ "RBAC"
],
"severity": "Medium",
- "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Cost"
+ "subcategory": "Identity",
+ "text": "Has an RBAC model been created for use within VMware vSphere",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage",
- "Backup"
+ "Entra",
+ "AVS",
+ "RBAC"
],
"severity": "Medium",
- "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Cost"
+ "subcategory": "Identity",
+ "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage",
- "AzurePolicy"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Make sure advisor is configured for VM right sizing ",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "description": "check by searching the Meter Category Licenses in the Cost analysys",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"services": [
- "WAF",
- "Cost",
- "AzurePolicy",
- "VM"
+ "AVS"
],
- "severity": "Medium",
- "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Architecture",
+ "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
"services": [
- "WAF",
- "LoadBalancer"
+ "Monitor",
+ "ExpressRoute",
+ "VPN",
+ "AVS",
+ "NetworkWatcher"
],
- "severity": "Medium",
- "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"services": [
- "WAF",
+ "Monitor",
+ "ExpressRoute",
+ "AVS",
+ "NetworkWatcher",
"VM"
],
"severity": "Medium",
- "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"services": [
- "WAF",
- "ARS",
+ "NetworkWatcher",
"VM",
- "Cost"
+ "AVS",
+ "Monitor"
],
"severity": "Medium",
- "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"services": [
- "WAF"
+ "ARS",
+ "AVS"
],
- "severity": "Medium",
- "text": "Only larger disks can be reserved => 1 TiB -",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Routing",
+ "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"services": [
- "WAF"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "Medium",
- "text": "After the right-sizing optimization",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Security (identity)",
+ "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "WAF checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"services": [
- "WAF",
- "SQL",
- "AzurePolicy",
- "Cost"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Security (identity)",
+ "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
- "waf": "Cost"
+ "subcategory": "Security (identity)",
+ "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "Entra",
+ "AVS"
],
- "severity": "Medium",
- "text": "Consider using a VMSS to match demand rather than flat sizing",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Security (identity)",
+ "text": "Limit use of CloudAdmin account to emergency access only",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "WAF checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
"services": [
- "WAF",
- "AKS"
+ "Entra",
+ "AVS",
+ "RBAC"
],
"severity": "Medium",
- "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
- "waf": "Cost"
+ "subcategory": "Security (identity)",
+ "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
"services": [
- "WAF"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "text": "Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "subcategory": "Security (identity)",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "WAF checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"services": [
- "WAF",
- "VM",
- "LoadBalancer"
+ "Entra",
+ "AVS",
+ "VM"
],
- "severity": "Medium",
- "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Security (identity)",
+ "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "Medium",
- "text": "Functions - Reuse connections",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Cost"
+ "subcategory": "Security (network)",
+ "text": "Is East-West traffic filtering implemented within NSX-T",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"services": [
- "WAF"
+ "AppGW",
+ "AVS",
+ "Firewall"
],
- "severity": "Medium",
- "text": "Functions - Cache data locally",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Security (network)",
+ "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage"
+ "AVS"
+ ],
+ "severity": "High",
+ "subcategory": "Security (network)",
+ "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
+ "services": [
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "subcategory": "Security (network)",
+ "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"services": [
- "WAF"
+ "ExpressRoute",
+ "VNet",
+ "VPN",
+ "AVS",
+ "DDoS"
],
"severity": "Medium",
- "text": "Functions - Keep your functions warm",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Cost"
+ "subcategory": "Security (network)",
+ "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "Medium",
- "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
- "waf": "Cost"
+ "subcategory": "Security (network)",
+ "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"services": [
- "WAF"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
- "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
- "waf": "Cost"
+ "subcategory": "Security (guest/VM)",
+ "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS",
+ "Arc"
],
"severity": "Medium",
- "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Cost"
+ "subcategory": "Security (guest/VM)",
+ "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "WAF checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
"services": [
- "WAF",
- "FrontDoor",
- "EventHubs"
+ "SQL",
+ "AVS"
],
- "severity": "Medium",
- "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
- "waf": "Cost"
+ "severity": "Low",
+ "subcategory": "Security (guest/VM)",
+ "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "WAF checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
"services": [
- "WAF",
- "AppSvc",
- "FrontDoor"
+ "AKV",
+ "AVS"
],
- "severity": "Medium",
- "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
- "waf": "Cost"
+ "severity": "Low",
+ "subcategory": "Security (guest/VM)",
+ "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "Medium",
- "text": "Consider archiving tiers for less used data",
- "waf": "Cost"
+ "subcategory": "Security (guest/VM)",
+ "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "Medium",
- "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance (platform)",
+ "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"services": [
- "WAF"
+ "Storage",
+ "AVS",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Consider using standard SSD rather than Premium or Ultra where possible",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance (platform)",
+ "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage"
+ "ASR",
+ "AVS"
],
- "severity": "Medium",
- "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance (platform)",
+ "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "WAF checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"services": [
- "WAF",
- "ASR"
+ "AVS"
],
"severity": "Medium",
- "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
- "waf": "Cost"
+ "subcategory": "Governance (platform)",
+ "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "WAF checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
- "text": "Storage accounts: check hot tier and/or GRS necessary",
- "waf": "Cost"
+ "subcategory": "Governance (platform)",
+ "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"services": [
- "WAF"
+ "Cost",
+ "AVS"
],
"severity": "Medium",
- "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "subcategory": "Governance (platform)",
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor",
"Cost",
- "EventHubs"
+ "AVS"
],
- "severity": "Medium",
- "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "severity": "Low",
+ "subcategory": "Governance (platform)",
+ "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"services": [
- "WAF",
- "Storage",
- "Cost"
+ "AVS"
],
"severity": "Medium",
- "text": "Export cost data to a storage account for additional data analysis.",
- "waf": "Cost"
+ "subcategory": "Governance (platform)",
+ "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
"services": [
- "WAF",
- "SQL",
- "Cost"
+ "AVS"
],
- "severity": "Medium",
- "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance (platform)",
+ "text": "Ensure all required resource reside within the same Azure availability zone(s)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"services": [
- "WAF"
+ "Defender",
+ "VM",
+ "AVS"
],
"severity": "Medium",
- "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
- "waf": "Cost"
+ "subcategory": "Governance (guest/VM)",
+ "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
"services": [
- "WAF"
+ "VM",
+ "AVS",
+ "Arc"
],
"severity": "Medium",
- "text": "Create multiple Apache Spark pool definitions of various sizes.",
- "waf": "Cost"
+ "subcategory": "Governance (guest/VM)",
+ "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "WAF checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
"services": [
- "WAF",
- "Cost"
+ "AVS"
],
- "severity": "Medium",
- "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance (guest/VM)",
+ "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
"services": [
- "WAF",
"VM",
- "Cost"
+ "AVS",
+ "Monitor"
],
"severity": "Medium",
- "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Governance (guest/VM)",
+ "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "Backup",
+ "VM",
+ "AVS",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Right-sizing all VMs",
- "waf": "Cost"
+ "subcategory": "Governance (guest/VM)",
+ "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "Defender",
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "text": "Swap VM sized with normalized and most recent sizes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Compliance",
+ "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor",
- "VM"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
- "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Compliance",
+ "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "WAF checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
"services": [
- "WAF",
- "VM"
+ "AVS"
],
- "severity": "Medium",
- "text": "Containerizing an application can improve VM density and save money on scaling it",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Compliance",
+ "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "High",
- "text": "Follow Metaprompting guardrails for resonsible AI",
- "waf": "Operational Excellence"
+ "subcategory": "Compliance",
+ "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
+ "category": "Governance",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"services": [
- "WAF",
- "Entra",
- "APIM"
+ "AVS"
+ ],
+ "severity": "Medium",
+ "subcategory": "Compliance",
+ "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "waf": "Security"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
+ "services": [
+ "Monitor",
+ "AVS"
],
"severity": "High",
- "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
- "text": "Enable monitoring for your AOAI instances",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
"services": [
- "WAF",
- "AKV",
"Monitor",
- "Subscriptions"
+ "AVS"
],
"severity": "High",
- "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
- "text": "Monitor token usage to prevent service disruptions due to capacity",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"services": [
- "WAF",
+ "Storage",
+ "AVS",
"Monitor"
],
"severity": "Medium",
- "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
"services": [
- "WAF",
- "APIM"
+ "Monitor",
+ "AVS"
],
"severity": "Low",
- "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
- "waf": "Operational Excellence"
+ "subcategory": "Monitoring",
+ "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"services": [
- "WAF"
+ "AzurePolicy",
+ "Storage",
+ "AVS",
+ "VM"
],
"severity": "High",
- "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
- "waf": "Operational Excellence"
+ "subcategory": "Operations",
+ "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
"services": [
- "WAF",
- "Entra"
+ "AVS"
],
- "severity": "High",
- "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
"services": [
- "WAF"
+ "Backup",
+ "Storage",
+ "AVS"
],
- "severity": "High",
- "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS",
+ "Arc"
],
- "severity": "High",
- "text": "Evaluate usage of Provisioned throughput model ",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"services": [
- "WAF"
+ "Monitor",
+ "AVS"
],
- "severity": "High",
- "text": "Review and implement Azure AI content safety",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "High",
- "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
"services": [
- "WAF"
+ "Monitor",
+ "AVS",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
- "waf": "Performance"
+ "subcategory": "Operations",
+ "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
"services": [
- "WAF",
- "ServiceBus",
- "Storage"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
- "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
- "waf": "Performance"
+ "subcategory": "Security",
+ "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
"services": [
- "WAF"
+ "Backup",
+ "AVS"
],
- "severity": "High",
- "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"services": [
- "WAF"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
- "waf": "Performance"
+ "subcategory": "Disaster Recovery",
+ "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
"services": [
- "WAF"
+ "ASR",
+ "AVS"
],
- "severity": "High",
- "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Disaster Recovery",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
"services": [
- "WAF"
+ "ASR",
+ "AVS"
],
- "severity": "Medium",
- "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Disaster Recovery",
+ "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"services": [
- "WAF",
- "ACR"
+ "ASR",
+ "AVS"
],
- "severity": "Low",
- "text": "Deploy multiple OAI instances across regions",
+ "severity": "Medium",
+ "subcategory": "Disaster Recovery",
+ "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
"services": [
- "WAF",
- "Entra",
- "APIM"
+ "ASR",
+ "AVS"
],
"severity": "High",
- "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "subcategory": "Disaster Recovery",
+ "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
"services": [
- "WAF"
+ "NVA",
+ "ASR",
+ "AVS",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "subcategory": "Disaster Recovery",
+ "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
"services": [
- "WAF"
+ "Backup",
+ "AVS"
],
"severity": "Medium",
- "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
- "waf": "Operational Excellence"
+ "subcategory": "Business Continuity",
+ "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
"services": [
- "WAF",
- "ACR"
+ "Backup",
+ "AVS"
],
"severity": "Medium",
- "text": "Deploy separate fine tuned models across regions if finetuning is employed",
+ "subcategory": "Business Continuity",
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
"services": [
- "WAF",
"Backup",
- "ASR"
+ "AVS"
],
"severity": "Medium",
- "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "subcategory": "Business Continuity",
+ "text": "Deploy your backup solution outside of vSan, on Azure native components",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "High",
- "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "severity": "Low",
+ "subcategory": "Business Continuity",
+ "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "Low",
- "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
- "waf": "Security"
+ "subcategory": "Deployment strategy",
+ "text": "For manual deployments, all configuration and deployments must be documented",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
"services": [
- "WAF",
- "ACR"
+ "AVS"
],
- "severity": "High",
- "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Deployment strategy",
+ "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
"services": [
- "WAF",
- "RBAC"
+ "AVS"
],
- "severity": "High",
- "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Deployment",
+ "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "Medium",
- "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Deployment",
+ "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor",
- "Sentinel",
- "Defender"
+ "AzurePolicy",
+ "AVS"
],
- "severity": "High",
- "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Deployment",
+ "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "AVS"
],
- "severity": "Medium",
- "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Connectivity",
+ "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
"services": [
- "WAF"
+ "AKV",
+ "AVS",
+ "ExpressRoute"
],
- "severity": "High",
- "text": "Implement Prompt shields and groundedness detection using Content Safety ",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "subcategory": "Automated Connectivity",
+ "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "High",
- "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Connectivity",
+ "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "Medium",
- "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Automated Connectivity",
+ "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
"services": [
- "WAF"
+ "Subscriptions",
+ "AVS"
],
- "severity": "High",
- "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automated Scale",
+ "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"services": [
- "WAF"
+ "Storage",
+ "AVS",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
- "waf": "Security"
+ "subcategory": "Automated Scale",
+ "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"services": [
- "WAF",
- "RBAC",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
- "waf": "Security"
+ "subcategory": "Automated Scale",
+ "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
- "severity": "High",
- "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automated Scale",
+ "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
"services": [
- "WAF",
- "RBAC"
+ "AVS"
],
- "severity": "High",
- "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automated Scale",
+ "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
+ "category": "Platform Automation",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
"services": [
- "WAF",
- "PrivateLink"
+ "Monitor",
+ "AVS"
],
- "severity": "High",
- "text": "Configure private endpoint for AI services to restrict service access within your network",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Automated Scale",
+ "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "category": "Migration",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "WAF",
- "Firewall",
- "VNet"
+ "VM",
+ "AVS"
],
"severity": "High",
- "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
+ "category": "Migration",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "High",
- "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "category": "Migration",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"services": [
- "WAF"
+ "VPN",
+ "AVS"
],
"severity": "Medium",
- "text": "Use prompt compression tools like LLMLingua or gprtrim",
- "waf": "Cost Optimization"
+ "subcategory": "Networking",
+ "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "category": "Migration",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
"services": [
- "WAF",
- "AKV",
- "Entra"
+ "AVS"
],
- "severity": "High",
- "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "category": "Migration",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "Medium",
- "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
- "waf": "Security"
+ "subcategory": "Process",
+ "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "category": "Data Storage",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"services": [
- "WAF",
- "Monitor"
+ "Storage",
+ "AVS",
+ "VM"
],
"severity": "Medium",
- "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "category": "Data Storage",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"services": [
- "WAF"
+ "Storage",
+ "AVS",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
+ "category": "Data Storage",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"services": [
- "WAF"
+ "Storage",
+ "AVS",
+ "ExpressRoute"
],
- "severity": "Low",
- "text": "Azure AI Services are properly tagged for better management",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "Architecture",
+ "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
+ "category": "Stretched Cluster",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
"services": [
- "WAF"
+ "ASR",
+ "AVS"
],
- "severity": "Low",
- "text": "Azure AI Service accounts follows organizational naming conventions",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "subcategory": "Architecture",
+ "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
+ "category": "Stretched Cluster",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
"services": [
- "WAF"
+ "AVS"
],
"severity": "High",
- "text": "Diagnostic logs in Azure AI services resources should be enabled",
- "waf": "Operational Excellence"
+ "subcategory": "Architecture",
+ "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "category": "Stretched Cluster",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
"services": [
- "WAF",
- "Entra"
+ "AVS",
+ "ExpressRoute"
],
"severity": "High",
- "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "category": "Stretched Cluster",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"services": [
- "WAF",
- "AKV",
- "Entra"
+ "AVS",
+ "ExpressRoute"
],
"severity": "High",
- "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "category": "Stretched Cluster",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
"services": [
- "WAF",
- "AKV"
+ "AVS"
],
"severity": "High",
- "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
- "waf": "Security"
+ "subcategory": "Architecture",
+ "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
+ "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
+ "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
+ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
+ "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
+ "service": "ACR",
"services": [
+ "ACR",
"WAF"
],
"severity": "High",
- "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
- "waf": "Cost Optimization"
+ "text": "Disable Azure Container Registry image export",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
+ "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
+ "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
+ "service": "ACR",
"services": [
- "WAF"
+ "ACR",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
+ "text": "Enable Azure Policies for Azure Container Registry",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
+ "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
+ "guid": "d345293c-7639-4637-a551-c5c04e401955",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
+ "service": "ACR",
"services": [
+ "AKV",
+ "ACR",
"WAF"
],
"severity": "High",
- "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
+ "text": "Sign and Verify containers with notation (Notary v2)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
+ "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
+ "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
+ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
+ "service": "ACR",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "ACR",
+ "WAF"
],
- "severity": "High",
- "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "text": "Encrypt registry with a customer managed key",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
+ "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
+ "ACR",
+ "Entra",
"WAF",
- "Cost"
+ "RBAC"
],
- "severity": "Medium",
- "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
- "waf": "Cost Optimization"
+ "severity": "High",
+ "text": "Use Managed Identities to connect instead of Service Principals",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
"WAF",
- "Cost"
+ "RBAC"
],
"severity": "High",
- "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
- "waf": "Cost Optimization"
+ "text": "Disable local authentication for management plane access",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
+ "service": "ACR",
"services": [
+ "ACR",
+ "Entra",
"WAF",
- "Monitor",
- "Cost"
+ "RBAC"
],
- "severity": "Medium",
- "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
- "waf": "Cost Optimization"
+ "severity": "High",
+ "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "description": "Disable anonymous pull/push access",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
+ "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
+ "service": "ACR",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
- "waf": "Cost Optimization"
+ "text": "Disable Anonymous pull access",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
+ "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
+ "service": "ACR",
"services": [
+ "Entra",
"WAF"
],
- "severity": "Medium",
- "text": "Review the guidance provided on setting up AI search for Reliability",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Disable repository-scoped access tokens",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
+ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
+ "service": "ACR",
"services": [
- "WAF",
- "Storage"
+ "ACR",
+ "PrivateLink",
+ "EventHubs",
+ "WAF"
],
- "severity": "Medium",
- "text": "Plan and manage AI Search Vector storage",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Deploy images from a trusted environment",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
+ "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
+ "service": "ACR",
"services": [
+ "ACR",
+ "Entra",
"WAF",
- "ACR"
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
- "waf": "Operational Excellence"
+ "text": "Disable Azure ARM audience tokens for authentication",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
+ "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
+ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
+ "service": "ACR",
"services": [
+ "ACR",
+ "Entra",
"WAF",
- "Storage"
+ "Monitor"
],
- "severity": "High",
- "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
- "waf": "Cost Optimization"
+ "severity": "Medium",
+ "text": "Enable diagnostics logging",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
+ "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
+ "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "service": "ACR",
"services": [
- "WAF"
+ "PrivateLink",
+ "WAF",
+ "Firewall",
+ "VNet"
],
"severity": "Medium",
- "text": "Evaluate the quality of prompts and applications when switching between model versions",
- "waf": "Operational Excellence"
+ "text": "Control inbound network access with Private Link",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "description": "Disable public network access if inbound network access is secured using Private Link",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
+ "service": "ACR",
"services": [
- "WAF",
- "Monitor"
+ "PrivateLink",
+ "WAF"
],
"severity": "Medium",
- "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
- "waf": "Operational Excellence"
+ "text": "Disable Public Network access",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "description": "Only the ACR Premium SKU supports Private Link access",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
+ "service": "ACR",
"services": [
+ "PrivateLink",
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Evaluate your Azure AI Search results based on different search parameters",
- "waf": "Operational Excellence"
+ "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
+ "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
+ "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "service": "ACR",
"services": [
+ "Defender",
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
+ "service": "ACR",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
- "waf": "Operational Excellence"
+ "text": "Deploy validated container images",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
+ "service": "ACR",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Red team your GenAI applications",
+ "severity": "High",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Provide end users with scoring options for LLM responses and track these scores. ",
- "waf": "Operational Excellence"
+ "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"services": [
"WAF"
],
"severity": "High",
- "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
- "waf": "Cost Optimization"
+ "text": "Use zone redundant pipelines in regions that support Availability Zones",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
"services": [
- "ACR",
- "WAF",
- "LoadBalancer",
- "Entra",
- "APIM"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
- "waf": "Operational Excellence"
+ "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
- "service": "Azure OpenAI",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
+ "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
- "service": "Azure OpenAI",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"services": [
"WAF",
- "Monitor"
+ "VNet"
],
"severity": "Medium",
- "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
+ "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DataFactory/datafactories",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
+ "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "Monitor"
+ "AKV",
+ "WAF"
],
- "severity": "Medium",
- "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
+ "severity": "Low",
+ "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
- "service": "Azure OpenAI",
+ "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
+ "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
+ "service": "Azure Data Explorer",
"services": [
+ "Storage",
+ "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Tune content filters to minimize false positives from overly aggressive filters",
+ "text": "Leverage External Tables and Continuous data export overview to reduce costs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
- "service": "Azure OpenAI",
+ "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
+ "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
+ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "AKV"
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
- "waf": "Security"
+ "text": "To share data, explore Leader-follower cluster configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
+ "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "LoadBalancer"
+ "ASR",
+ "WAF"
],
- "severity": "Medium",
- "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
- "waf": "Security"
+ "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
+ "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
+ "service": "Azure Data Explorer",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
- "waf": "Security"
+ "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "Cost"
+ "WAF"
],
- "severity": "Medium",
- "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
- "waf": "Cost Optimization"
+ "text": "Ingest data into each cluster in parallel",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
- "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
- "service": "Azure OpenAI",
+ "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
+ "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "Cost"
+ "ACR",
+ "WAF"
],
- "severity": "Medium",
- "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
- "waf": "Cost Optimization"
+ "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
+ "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "Cost"
+ "ACR",
+ "WAF"
],
- "severity": "Medium",
- "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
- "waf": "Cost Optimization"
+ "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
+ "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
+ "service": "Azure Data Explorer",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
- "waf": "Cost Optimization"
+ "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
+ "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
+ "service": "Azure Data Explorer",
"services": [
+ "AzurePolicy",
+ "Storage",
+ "Cost",
+ "ASR",
"WAF"
],
- "severity": "Medium",
- "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
- "waf": "Cost Optimization"
+ "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
- "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
- "service": "Azure OpenAI",
+ "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
+ "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
+ "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
- "waf": "Operational Excellence"
+ "text": "Wrap DevOps and source control around all your code",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "2744293b-b628-4537-a551-19b08e8f5855",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
- "service": "Azure OpenAI",
+ "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
- "waf": "Operational Excellence"
+ "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
+ "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
- "WAF",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Medium",
- "text": "Implement an error handling policy at the global level",
- "waf": "Operations"
+ "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "AKV",
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Ensure all APIs policies include a element.",
+ "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF",
- "ACR",
"AzurePolicy"
],
"severity": "Medium",
- "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
- "waf": "Operations"
+ "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
"services": [
- "WAF"
+ "AppGW",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
- "waf": "Operations"
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF",
- "Monitor"
+ "AzurePolicy"
],
"severity": "High",
- "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
- "waf": "Operations"
+ "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
+ "TrafficManager",
+ "EventHubs",
"WAF"
],
- "severity": "Medium",
- "text": "Enable Application Insights for more detailed telemetry",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Avoid placing Traffic Manager behind Front Door.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor"
+ "FrontDoor",
+ "WAF"
],
"severity": "High",
- "text": "Configure alerts on the most critical metrics",
- "waf": "Operations"
+ "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"services": [
- "WAF",
- "AKV"
+ "FrontDoor",
+ "WAF"
],
- "severity": "High",
- "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra"
+ "FrontDoor",
+ "WAF"
],
- "severity": "High",
- "text": "Protect incoming requests to APIs (data plane) with Azure AD",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
"services": [
+ "AKV",
+ "FrontDoor",
+ "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Create appropriate groups to control the visibility of the products",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Use Backends feature to eliminate redundant API backend configurations",
+ "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use Named Values to store common values that can be used in policies",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"services": [
- "WAF",
- "ACR"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
- "waf": "Reliability"
+ "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=~'Enabled') and (mode=~'Prevention')), enabledState, mode",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
- "severity": "Medium",
- "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
"services": [
- "WAF",
- "Backup"
+ "FrontDoor",
+ "WAF"
],
"severity": "High",
- "text": "Ensure there is an automated backup routine",
- "waf": "Reliability"
+ "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF",
"AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy",
- "EventHubs"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Low",
- "text": "If you need to log at high performance levels, consider Event Hubs policy",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Apply throttling policies to control the number of requests per second",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Configure autoscaling to scale out the number of instances when the load increases",
- "waf": "Performance"
+ "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
- "waf": "Performance"
+ "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Use the premium tier for production workloads.",
- "waf": "Reliability"
+ "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
"services": [
- "WAF",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Medium",
- "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra",
- "APIM"
+ "FrontDoor",
+ "WAF"
],
- "severity": "High",
- "text": "Be aware of APIM's limits",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
"services": [
+ "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Ensure that the self-hosted gateway deployments are resilient.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra",
- "APIM",
- "FrontDoor"
+ "Sentinel",
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Use Azure Front Door in front of APIM for multi-region deployment",
- "waf": "Performance"
+ "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
"services": [
- "WAF",
- "VNet"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "text": "Deploy the service within a Virtual Network (VNet)",
- "waf": "Security"
+ "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
"services": [
- "WAF",
- "Monitor",
- "Entra",
- "APIM",
- "VNet"
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "WAF checklist",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
+ "services": [
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
- "waf": "Security"
+ "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
"services": [
- "WAF",
- "PrivateLink",
- "Entra",
- "APIM",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
- "waf": "Security"
+ "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Disable Public Network Access",
+ "severity": "Medium",
+ "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Simplify management with PowerShell automation scripts",
- "waf": "Operations"
+ "text": "Use caching for endpoints that support it.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra",
- "APIM"
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
"services": [
- "WAF",
- "Entra",
- "APIM"
+ "FrontDoor",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
"services": [
+ "AKV",
"WAF"
],
"severity": "Medium",
- "text": "Implement DevOps and CI/CD in your workflow",
+ "text": "Use wildcard TLS certificates when possible.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Secure APIs using client certificate authentication",
- "waf": "Security"
+ "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
"services": [
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Secure backend services using client certificate authentication",
- "waf": "Security"
+ "text": "Use file compression when you're accessing downloadable content.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
"WAF"
],
- "severity": "Medium",
- "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
"services": [
+ "FrontDoor",
+ "TrafficManager",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
- "waf": "Security"
+ "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
"services": [
+ "AppSvc",
+ "FrontDoor",
"WAF"
],
"severity": "High",
- "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
+ "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV"
+ "AKS",
+ "WAF"
],
- "severity": "High",
- "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If required for AKS Windows workloads HostProcess containers can be used",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "text": "Use managed identities to authenticate to other Azure resources whenever possible",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use KEDA if running event-driven workloads",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
"services": [
- "WAF",
- "Entra",
- "APIM",
- "AppGW"
+ "WAF"
],
- "severity": "High",
- "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Dapr to ease microservice development",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "FrontDoor"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use the SLA-backed AKS offering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
+ "Cost",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Disruption Budgets in your pod and deployment definitions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "ACR",
+ "WAF"
],
- "severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "High",
+ "text": "If using a private registry, configure region replication to store images in multiple regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
+ "Cost",
+ "WAF"
],
- "severity": "High",
- "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use an external application such as kubecost to allocate costs to different users",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
"services": [
- "WAF",
- "TrafficManager",
- "FrontDoor",
- "EventHubs"
+ "WAF"
],
- "severity": "High",
- "text": "Avoid placing Traffic Manager behind Front Door.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use scale down mode to delete/deallocate nodes",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "AKS",
+ "WAF"
],
- "severity": "High",
- "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
"severity": "Low",
- "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
- "waf": "Performance"
+ "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF",
- "FrontDoor"
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
- "waf": "Reliability"
+ "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
- "severity": "Low",
- "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Separate applications from the control plane with user/system node pools",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV",
- "FrontDoor",
- "Cost"
+ "WAF"
],
- "severity": "High",
- "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Add taint to your system nodepool to make it dedicated",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "Use a private registry for your images, such as ACR",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
- "severity": "High",
- "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
+ "severity": "Medium",
+ "text": "Scan your images for vulnerabilities",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
- "severity": "Medium",
- "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
+ "severity": "High",
+ "text": "Define app separation requirements (namespace/nodepool/cluster)",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "AKV",
+ "WAF"
],
- "severity": "High",
- "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
+ "severity": "Medium",
+ "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
"severity": "High",
- "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
+ "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
+ "WAF"
],
- "severity": "High",
- "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
+ "severity": "Medium",
+ "text": "If required add Key Management Service etcd encryption",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "AKS",
+ "WAF"
],
- "severity": "High",
- "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
+ "severity": "Low",
+ "text": "If required consider using Confidential Compute for AKS",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "Defender",
+ "WAF"
],
- "severity": "High",
- "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "severity": "Medium",
+ "text": "Consider using Defender for Containers",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "severity": "High",
+ "text": "Use managed identities instead of Service Principals",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "text": "Integrate authentication with AAD (using the managed integration)",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
"severity": "Medium",
- "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
+ "text": "Limit access to admin kubeconfig (get-credentials --admin)",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"services": [
- "WAF"
+ "Entra",
+ "WAF",
+ "RBAC"
],
- "severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "severity": "Medium",
+ "text": "Integrate authorization with AAD RBAC",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF",
- "FrontDoor"
+ "RBAC"
],
- "severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "severity": "High",
+ "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
"services": [
- "WAF",
- "Monitor"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
- "waf": "Operations"
+ "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
"services": [
- "WAF",
- "Sentinel",
- "FrontDoor"
+ "AKS",
+ "WAF"
],
"severity": "Medium",
- "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "text": "For AKS non-interactive logins use kubelogin (preview)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"services": [
- "WAF",
- "Backup"
+ "AKS",
+ "WAF"
],
"severity": "Medium",
- "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
- "waf": "Reliability"
+ "text": "Disable AKS local accounts",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Configure if required Just-in-time cluster access",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "AKS",
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Configure if required AAD conditional access for AKS",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If required for Windows AKS workloads configure gMSA ",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"services": [
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
+ "text": "For finer control consider using a managed Kubelet Identity",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"services": [
+ "AppGW",
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Use caching for endpoints that support it.",
- "waf": "Cost"
+ "text": "If using AGIC, do not share an AppGW across clusters",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "AKS",
+ "WAF"
],
- "severity": "Low",
- "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"services": [
- "WAF",
- "Storage",
- "FrontDoor"
+ "WAF"
],
"severity": "Medium",
- "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
- "waf": "Operations"
+ "text": "For Windows workloads use Accelerated Networking",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
- "WAF",
- "AKV"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "Medium",
- "text": "Use wildcard TLS certificates when possible.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use the standard ALB (as opposed to the basic one)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"services": [
"WAF",
- "FrontDoor"
+ "VNet"
],
"severity": "Medium",
- "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
- "waf": "Performance"
+ "text": "If using Azure CNI, consider using different Subnets for NodePools",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"services": [
+ "PrivateLink",
"WAF",
- "Storage"
+ "VNet"
],
"severity": "Medium",
- "text": "Use file compression when you're accessing downloadable content.",
- "waf": "Performance"
+ "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "WAF",
- "FrontDoor"
+ "WAF"
],
"severity": "High",
- "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
- "waf": "Operations"
+ "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
"WAF",
- "TrafficManager",
- "Storage",
- "FrontDoor"
+ "VNet"
],
- "severity": "Medium",
- "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "WAF",
- "AppSvc",
- "FrontDoor"
+ "WAF"
],
"severity": "High",
- "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
- "waf": "Security"
+ "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS",
+ "WAF",
+ "VNet"
],
- "severity": "Medium",
- "text": "Leverage Flexible Server",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
+ "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Leverage Data-in replication for cross-region DR scenarios",
- "waf": "Reliability"
- },
- {
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
- "service": "Azure Service Fabric",
- "services": [],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Use Standard SKU for production scenarios.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If required add your own CNI plugin",
+ "waf": "Security"
},
{
- "category": "Standard clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
"services": [
- "VM"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If required configure Public IP per node in AKS",
+ "waf": "Performance"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
- "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"services": [
- "ACR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
+ "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
"waf": "Reliability"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
"services": [
- "APIM"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
- "waf": "Reliability"
- },
- {
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
- "service": "Azure Service Fabric",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload architecture",
- "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
+ "severity": "Low",
+ "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
"waf": "Reliability"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
- "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
"services": [
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
+ "waf": "Reliability"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"services": [
- "VM"
+ "NVA",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
- "waf": "Cost"
- },
- {
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
- "service": "Azure Service Fabric",
- "services": [],
- "severity": "Medium",
- "subcategory": "Cluster and workload architectures",
- "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"services": [
- "APIM",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
+ "text": "If using a public API endpoint, restrict the IP addresses that can access it",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
- "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
"services": [
- "AKV",
- "Storage",
- "Entra",
- "VM"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
- "waf": "Security"
- },
- {
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "001cbb6f-d88d-4431-8434-d01333397776",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
- "service": "Azure Service Fabric",
- "services": [],
- "severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "severity": "High",
+ "text": "Use private clusters if your requirements mandate it",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"services": [
- "ACR"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Cluster architecture",
- "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
+ "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
- "link": "",
- "service": "Azure Service Fabric",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload architecture",
- "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
+ "services": [
+ "AKS",
+ "WAF",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
- "link": "",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "AKV"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Workload architecture",
- "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
+ "severity": "High",
+ "text": "Use Kubernetes network policies to increase intra-cluster security",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Workload architecture",
- "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
+ "severity": "High",
+ "text": "Use a WAF for web workloads (UIs or APIs)",
"waf": "Security"
},
{
- "category": "Managed clusters",
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
- "service": "Azure Service Fabric",
- "services": [],
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
+ "services": [
+ "AKS",
+ "WAF",
+ "DDoS",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Cluster and workload architectures",
- "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "text": "Use DDoS Standard in the AKS Virtual Network",
"waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "Define a resource group structure for placement of Azure Arc-enabled servers resources",
- "guid": "585e1112-9bd7-4ba0-82f7-b94ef6e043d2",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Capacity Planning",
- "text": "One or more resource groups is required for onboarding servers into Azure",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "If required add company HTTP Proxy",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "guid": "aa359271-8e6e-4205-8725-769e46691e88",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"services": [
- "Arc",
- "Entra"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Capacity Planning",
- "text": "Take Azure Active Directory object limitations into account",
- "waf": "Performance"
+ "text": "Consider using a service mesh for advanced microservice communication management",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "The following resource providers needs to be registered: Microsoft.HybridCompute, Microsoft.GuestConfiguration, Microsoft.HybridConnectivity",
- "guid": "deace4bb-1deb-44c6-9fc3-fc14eeaa3692",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-resource-providers",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"services": [
- "Arc",
- "Subscriptions"
+ "Monitor",
+ "WAF"
],
"severity": "High",
- "subcategory": "General",
- "text": "Has the Resource providers required been registered in all subscriptions",
+ "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
"waf": "Operations"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "Aligning with an existing or creating an Azure tagging strategy is recommended. Resource tags allow you to quickly locate it, automate operational tasks amd more. ",
- "guid": "c6d37331-65c7-4acb-b44b-be609d79f2e8",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
"services": [
- "Arc"
+ "Entra",
+ "WAF"
],
"severity": "Low",
- "subcategory": "General",
- "text": "Has a tagging strategy for Azure Arc-enabled servers been defined",
- "waf": "Cost"
+ "text": "Check regularly Azure Advisor for recommendations on your cluster",
+ "waf": "Operations"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "Installation of the connected machine agent is supported on most newer Windows and Linux operative systems, review the link to se the latest list",
- "guid": "7778424c-5167-475c-9fa9-5b96ad88408e",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#supported-operating-systems",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
"services": [
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "High",
- "subcategory": "General",
- "text": "What operating systems need to be Azure Arc-enabled",
+ "severity": "Low",
+ "text": "Enable AKS auto-certificate rotation",
"waf": "Operations"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "There are software requirements to the agent installation. Some might require a system reboot after installation, review to link",
- "guid": "372734b8-76ba-428f-8145-901365d38e53",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#software-requirements",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"services": [
- "Arc"
+ "AKS",
+ "WAF"
],
"severity": "High",
- "subcategory": "General",
- "text": "Are required software installed on Windows and Linux servers to support the installation",
+ "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
"waf": "Operations"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "guid": "d44c7c89-19ca-41f6-b521-5ae514ba34d4",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/?products=azure-arc®ions=all",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
"severity": "High",
- "subcategory": "General",
- "text": "Make sure to use a supported Azure region",
- "waf": "Reliability"
+ "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
+ "waf": "Operations"
},
{
- "category": "Foundation",
- "checklist": "Azure Arc Review",
- "description": "The scope include organization into management groups, subscriptions, and resource groups.",
- "guid": "f9ccbd86-8266-4abc-a264-f9a19bf39d95",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/organize-inventory-servers#organize-resources-with-built-in-azure-hierarchies",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"services": [
- "Arc",
- "Subscriptions"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Organization",
- "text": "Define the structure for Azure management of resources",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "Define RBAC rules to the servers / resource groups as required for servers management, the 'Azure Connected Machine Resource Administrator' or 'Hybrid Server Resource Administrator' role would be sufficient for management of the Azure Arc-enabled servers resources in Azure",
- "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
"services": [
- "Arc",
- "RBAC",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Access",
- "text": "Assign RBAC rights to Azure AD user/group access for managing Azure Arc-enabled servers",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e",
- "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
"services": [
- "AKV",
- "Arc",
- "Entra"
+ "AKS",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Access",
- "text": "Consider using managed identities for applications to access Azure resources like Key Vault example in link",
- "waf": "Security"
+ "text": "Consider using AKS command invoke on private clusters",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "An Azure subscription must be parented to the same Azure AD tenant",
- "guid": "35ac9322-23e1-4380-8523-081a94174158",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
"services": [
- "Subscriptions",
- "Arc",
- "Entra"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Requirements",
- "text": "An Azure Active Directory tenant must be available with at least one subscription",
+ "severity": "Low",
+ "text": "For planned events consider using Node Auto Drain",
"waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "Users (or SPs) need the 'Azure Connected Machine Onboarding' or 'Contributor' role to onboarding of servers",
- "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"services": [
- "Arc",
- "RBAC",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Requirements",
- "text": "Define which users (AAD user/groups) has access to onboard Azure Arc-enabled servers",
- "waf": "Security"
+ "severity": "High",
+ "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "Ensure to only add the rights to users or groups that is required to perform their role",
- "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"services": [
- "Arc",
- "RBAC",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Use the principle of least privileged",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use custom Node RG (aka 'Infra RG') name",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "A service principle with the 'Azure Connected Machine Onboarding' role is required for at-scale onboarding of servers, consider more SP's if onboarding is done by different teams/decentralized management",
- "guid": "ad88408e-3727-434b-a76b-a28f21459013",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"services": [
- "Arc",
- "RBAC",
- "Entra"
+ "AKS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "How many Service Principals are needed for onboarding Arc-enabled servers into Azure",
- "waf": "Security"
+ "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure Arc Review",
- "description": "Consider assigning the rights for the 'Azure Connected Machine Onboarding' role at the resource group level, to control the resource creation",
- "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
"services": [
- "Arc",
- "RBAC",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Limit the rights to onboard Azure Arc-enabled servers to the desired resource groups",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Taint Windows nodes",
+ "waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Plan for agent deployments at scale",
- "guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Define a strategy for agent provisioning",
+ "severity": "Low",
+ "text": "Keep windows containers patch level in sync with host patch level",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Use Microsoft Update to ensure that the connected machine agent is always up-to-date",
- "guid": "c78e1d76-6673-457c-9496-74c5ed85b859",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "description": "Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
"services": [
"Monitor",
- "Arc"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Management",
- "text": "Define a strategy for agent updates",
+ "severity": "Low",
+ "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Recommendation is to use Azure Policy, or another automation tool like Azure DevOps - important is to avoid configuration drift.",
- "guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Define a strategy for extension installation",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "If required use nodePool snapshots",
+ "waf": "Cost"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Use automatic upgrades where available and define an update strategy for all extensions not supporting automatic upgrades.",
- "guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Management",
- "text": "Define a strategy for extension updates",
+ "severity": "Low",
+ "text": "Consider spot node pools for non time-sensitive workloads",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Azure Automanage help implement Microsoft best-practices for servers management in Azure",
- "guid": "7a927c39-74d1-4102-aac6-aae01e6a84de",
- "link": "https://learn.microsoft.com/azure/automanage/automanage-arc",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Consider using Azure Automanage to control settings and avoid configuration drift on servers",
+ "severity": "Low",
+ "text": "Consider AKS virtual node for quick bursting",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
"Monitor",
- "Arc"
+ "WAF"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Monitor for unresponsive agents",
+ "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d",
- "link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Design a monitoring strategy to send metrics and logs to an Log Analytics workspace",
+ "severity": "High",
+ "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "guid": "92881b1c-d5d1-4e54-a296-59e3958fd782",
- "link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"services": [
"Monitor",
- "Arc"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use notification in Activity logs to receive notification on unexpected changes to the resources",
+ "text": "Monitor CPU and memory utilization of the nodes",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "guid": "89c93555-6d02-4bfe-9564-b0d834a34872",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
"Monitor",
- "Arc"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Monitor for compliance and operational monitoring",
+ "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
"services": [
+ "EventHubs",
"Monitor",
- "Arc"
+ "ServiceBus",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Create an alert to identify Azure Arc-enabled servers that aren't using the latest version of the Azure connected machine agent",
+ "text": "Monitor OS disk queue depth in nodes",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "Azure Arc Review",
- "description": "Use Update Management in Azure Automation or the new Update Management Center (preview) functionality to ensure update management of servers",
- "guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
+ "NVA",
"Monitor",
- "Arc"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Security",
- "text": "Use Azure Arc-enabled servers to control software updates deployments to servers",
+ "severity": "Medium",
+ "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "The Connected Machine Agent will by default communicate with Azure services over public Internet connectivity using HTTPS (TCP port 443)",
- "guid": "f6e043d2-aa35-4927-88e6-e2050725769e",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#details",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
"services": [
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Networking",
- "text": "Define a connectivity method from the server to Azure",
+ "severity": "Medium",
+ "text": "Subscribe to resource health notifications for your AKS cluster",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "The Connected Machine Agent can be configured to use a proxy server, it is recommended to define the proxy server address using 'azcmagent config set proxy.url' command on the local system.",
- "guid": "46691e88-35ac-4932-823e-13800523081a",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#update-or-remove-proxy-settings",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Networking",
- "text": "Is a proxy server a required for communication over the Public Internet",
+ "severity": "High",
+ "text": "Configure requests and limits in your pod specs",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "The Connected Machine Agent can use a Private Link for communication with Azure Services over an existing ExpressRoute or VPN connection",
- "guid": "94174158-33ee-47ad-9c6d-3733165c7acb",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "ExpressRoute",
- "Arc",
- "VPN",
- "PrivateLink"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Is a private (not public Internet) connection required?",
+ "text": "Enforce resource quotas for namespaces",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "Firewall configuration might be required for the agent to communicate with Azure, use the link to see ServiceTags and/or URL's required",
- "guid": "e44bbe60-9d79-4f2e-a777-8424c516775c",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#service-tags",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
"services": [
- "Arc"
+ "Subscriptions",
+ "WAF"
],
"severity": "High",
- "subcategory": "Networking",
- "text": "Will Firewall configurations be needed in order to ensure communication with Azure Services?",
- "waf": "Security"
+ "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "Use available automation tool for the system in question to regularly update the Azure endpoints",
- "guid": "6fa95b96-ad88-4408-b372-734b876ba28f",
- "link": "https://www.microsoft.com/download/details.aspx?id=56519",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
+ "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Networking",
- "text": "Can the Firewall or Proxy rules be automated updated if Service Tags or IP addresses change",
- "waf": "Security"
+ "severity": "High",
+ "text": "Configure Liveness and Readiness probes for all deployments",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "Configure Servers to use Transport Layer Security (TLS) version 1.2",
- "guid": "21459013-65d3-48e5-9f9c-cbd868266abc",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#transport-layer-security-12-protocol",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Networking",
- "text": "Always use secure communication for Azure where possible",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use the Cluster Autoscaler",
+ "waf": "Performance"
},
{
- "category": "Networking",
- "checklist": "Azure Arc Review",
- "description": "All extensions (like log analytics etc.) have separate network requirements, be sure to include all in the network design.",
- "guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc",
- "PrivateLink"
+ "AKS",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Networking",
- "text": "Include communication for Azure Arc-enabled Servers extensions in the design (firewall/proxy/private link)",
- "waf": "Security"
+ "text": "Customize node configuration for AKS node pools",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "ac6aae01-e6a8-44de-9df4-7d2d92881b1c",
- "link": "https://learn.microsoft.com/azure/governance/policy/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "Arc",
- "AzurePolicy"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Use Azure Policy to implement a governance model for hybrid connected servers",
- "waf": "Security"
+ "text": "Use the Horizontal Pod Autoscaler when required",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "5c2a3649-4b69-4bad-98aa-d53cc78e1d76",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
"services": [
- "Arc"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Consider using Machine configurations for in guest OS configurations",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Consider an appropriate node size, not too large or too small",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "667357c4-4967-44c5-bd85-b859c7733be2",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/machine-configuration-create",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
"services": [
- "Arc",
- "AzurePolicy"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Evaluate the need for custom Guest Configuration policies",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "49674c5e-d85b-4859-a773-3be2a1a27b77",
- "link": "https://learn.microsoft.com/azure/automation/change-tracking/overview",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
"services": [
- "Monitor",
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Consider using change tracking for tracking changes made on the servers",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "d5d1e54a-2965-49e3-a58f-d78289c93555",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/data-residency",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
"services": [
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Requirements",
- "text": "Make sure to use an Azure region for storing the metadata approved by the organization",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For long running operation on an AKS cluster consider event termination",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780",
- "link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
"services": [
- "AKV",
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "Use Azure Key Vault for certificate management on servers",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "description": "Consider using a short-lived Azure AD service principal client secrets.",
- "guid": "6d02bfe4-564b-40d8-94a3-48726ee79d6b",
- "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"services": [
- "AKV",
- "Arc",
- "Storage",
- "Entra"
+ "WAF"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "What is the acceptable life time of the secret used by SP's",
- "waf": "Security"
+ "text": "Use ephemeral OS disks",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "description": "A private key is saved to the disk, ensure this is protected using disk encryption",
- "guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
"services": [
- "AKV",
- "Arc"
+ "AKS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "Secure the public key for Azure Arc-enabled Servers",
- "waf": "Security"
+ "severity": "High",
+ "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "description": "Local administrator is required to install the Connected Machine Agent on Windows and Linux systems",
- "guid": "29659e39-58fd-4782-a9c9-35556d02bfe4",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-portal#install-manually",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
"services": [
- "Arc"
+ "AKS",
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security",
- "text": "Ensure there is local administrator access for executing the agent installation",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "description": "Members of the local administrator group on Windows and users with root privileges on Linux, have permissions to manage the agent via command line.",
- "guid": "564b0d83-4a34-4872-9ee7-9d6b5c2a3649",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#agent-security-and-permissions",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"services": [
- "Arc"
+ "SQL",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Limit the amount of users with local administrator rights to the servers",
- "waf": "Security"
+ "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
"services": [
- "Arc",
- "Entra"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Consider using and restricting access to managed identities for applications.",
- "waf": "Security"
+ "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "description": "Use Defender for Endpoint or another AV and EDR solution to protect endpoints",
- "guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868",
- "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"services": [
- "Arc",
- "Defender"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Enable Defender for Servers for all servers to secure hybrid workloads from threats",
- "waf": "Security"
+ "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "cbafe6c4-6589-4d45-9a92-7c3974d1102c",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
"services": [
- "Arc"
+ "ASR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Define controls to detect security misconfigurations and track compliance",
- "waf": "Security"
+ "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "Azure Arc Review",
- "guid": "cbbbc868-195a-4bb9-8a4e-d90dae2cc84c",
- "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#extension-allowlists-and-blocklists",
+ "checklist": "WAF checklist",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"services": [
- "Arc"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Use allow- or block-lists to control what extensions can be installed on the Azure Arc-enabled servers",
- "waf": "Security"
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "d7e47431-76c8-4bdb-b55b-ce619e8a03f9",
- "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli",
+ "checklist": "WAF checklist",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
"services": [
"Entra",
- "RBAC"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Create a service principal and its role assignments before creating the ARO clusters.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "7879424d-6267-486d-90b9-6c97be985190",
- "link": "https://learn.microsoft.com/azure/openshift/configure-azure-ad-ui",
+ "checklist": "WAF checklist",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
"services": [
- "Entra"
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Use AAD to authenticate users in your ARO cluster.",
- "waf": "Security"
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "adfec5f9-a82d-46e9-a8d1-5a0c7fed5d15",
- "link": "https://docs.openshift.com/container-platform/4.14/authentication/remove-kubeadmin.html",
+ "checklist": "WAF checklist",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"services": [
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "When using AAD authentication, remove kubeadmin user from the cluster.",
- "waf": "Security"
+ "severity": "High",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "483835c9-86bb-4291-8155-a11475e39f54",
- "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html",
+ "checklist": "WAF checklist",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
"services": [
- "Entra",
+ "ACR",
+ "Subscriptions",
+ "WAF",
"RBAC"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Define OpenShift projects to restrict RBAC privilege and isolate workloads in your cluster.",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "0acccd97-9376-4bcd-a375-0ab2ab039da6",
- "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html",
+ "checklist": "WAF checklist",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"services": [
- "Entra",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Define the required RBAC roles in OpenShift are scoped to either a project or a cluster.",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "d54d7c89-29db-4107-b532-5ae625ca44e4",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "checklist": "WAF checklist",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
"services": [
- "AKV",
- "Entra"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Minimize the number of users who have administrator rights and secrets access.",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "685e2223-ace8-4bb1-8307-ca5f16f154e3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "checklist": "WAF checklist",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"services": [
"Entra",
- "RBAC"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Use Privileged Identity Management in AAD for ARO users with privileged roles.",
+ "severity": "High",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "aa369282-9e7e-4216-8836-87af467a1f89",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "checklist": "WAF checklist",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
"services": [
- "Firewall",
- "WAF",
- "DDoS",
- "Entra",
- "Subscriptions",
- "VNet"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "DDoS",
- "text": "Use Azure DDoS Network/IP Protection to protect the virtual network you use for the ARO cluster unless you use Azure Firewall or WAF in a centralized subscription",
+ "severity": "High",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "35bda433-24f1-4481-8533-182aa5174269",
- "link": "https://docs.openshift.com/container-platform/4.13/networking/routes/secured-routes.html",
- "services": [],
- "severity": "High",
- "subcategory": "Encryption",
- "text": "All web applications you configure to use an ingress should use TLS encryption and shouldn't allow access over unencrypted HTTP.",
+ "checklist": "WAF checklist",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "44008ae7-d7e4-4743-876c-8bdbf55bce61",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "checklist": "WAF checklist",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"services": [
- "WAF",
- "FrontDoor"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Front Door with WAF to securely publish ARO applications to the internet, especially in multi-region environments.",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "9e8a03f9-7879-4424-b626-786d60b96c97",
- "link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"services": [
- "PrivateLink",
- "FrontDoor"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "If exposing an app on ARO with Azure Front Door, use private link to connect Front Door with the ARO router.",
- "waf": "Security"
+ "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "Reliability"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "be985190-4838-435c-a86b-b2912155a114",
- "link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress",
+ "checklist": "WAF checklist",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"services": [
- "NVA",
- "AzurePolicy",
- "Firewall"
+ "Entra",
+ "WAF",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "If your security policy requires you to inspect all outbound internet traffic that's generated in the ARO cluster, secure egress network traffic by using Azure Firewall or an NVA.",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "75e39f54-0acc-4cd9-9937-6bcda3750ab2",
- "link": "https://learn.microsoft.com/azure/openshift/howto-create-private-cluster-4x",
+ "ammp": true,
+ "checklist": "WAF checklist",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
"services": [
- "AzurePolicy"
+ "Entra",
+ "WAF"
],
"severity": "High",
- "subcategory": "Private access",
- "text": "If your security policy requires you to use a private IP address for the OpenShift API, deploy a private ARO cluster.",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
"waf": "Security"
},
{
- "category": "Network topology and connectivity",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "checklist": "WAF checklist",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"services": [
- "ACR",
- "PrivateLink"
+ "Entra",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Private access",
- "text": "Use Azure Private Link to secure network connections to managed Azure services, including to Azure Container Registry.",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
"waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "25ca44e4-685e-4222-9ace-8bb12307ca5f",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-enable-arc-enabled-clusters",
+ "checklist": "WAF checklist",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"services": [
- "Monitor"
+ "Entra",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Operations",
- "text": "Establish a monitoring process using the inbuilt Prometheus, OpenShift Logging or Container Insights integration.",
- "waf": "Operations"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "16f154e3-aa36-4928-89e7-e216183687af",
- "link": "https://docs.openshift.com/container-platform/4.13/cicd/pipelines/understanding-openshift-pipelines.html",
- "services": [],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Automate the application delivery process through DevOps practices and CI/CD solutions, such as Pipelines/GitOps provided by OpenShift.",
- "waf": "Operations"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "467a1f89-35bd-4a43-924f-14811533182a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/design-principles/managed-services",
- "services": [],
- "severity": "Low",
- "subcategory": "Operations",
- "text": "Whenever possible, remove the service state from inside containers. Instead, use an Azure platform as a service (PaaS) that supports multiregion replication.",
- "waf": "Operations"
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "1b7da8cf-aa66-4e15-b4d5-ada97dc3e232",
- "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-storageclass",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"services": [
- "Storage"
+ "WAF",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Operations",
- "text": "Use RWX storage with inbuilt Azure Files storage class.",
- "waf": "Operations"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "6bb235c7-05e1-4696-bded-fa8a4c8cdec4",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/clusters/nodes-cluster-limit-ranges.html",
- "services": [],
- "severity": "Medium",
- "subcategory": "Performance",
- "text": "Use pod requests and limits to manage the compute resources within a cluster.",
- "waf": "Performance"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "c620c30c-14ee-4b7f-9ae8-d9b3fec228e7",
- "link": "https://docs.openshift.com/container-platform/4.13/applications/quotas/quotas-setting-per-project.html",
- "services": [],
"severity": "Medium",
- "subcategory": "Performance",
- "text": "Enforce resource quotas on projects.",
- "waf": "Performance"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "87ab177a-db59-4f6b-a613-334fd09dc234",
- "link": "https://docs.openshift.com/container-platform/4.13/machine_management/applying-autoscaling.html",
- "services": [],
- "severity": "High",
- "subcategory": "Performance",
- "text": "Define ClusterAutoScaler and MachineAutoScaler to scale machines when your cluster runs out of resources to support more deployments.",
- "waf": "Performance"
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "19db6128-1269-4040-a4ba-4d3e0804276d",
- "link": "https://learn.microsoft.com/azure/openshift/support-policies-v4#supported-virtual-machine-sizes",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"services": [
- "VM"
+ "Firewall",
+ "ExpressRoute",
+ "NVA",
+ "VPN",
+ "VNet",
+ "DNS",
+ "Entra",
+ "WAF"
],
"severity": "High",
- "subcategory": "Reliability",
- "text": "Use virtual machine sizes that are large enough to contain multiple container instances so you get the benefits of increased density, but not so large that your cluster can't handle the workload of a failing node.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "4b98b15c-8b31-4aa5-aceb-58889135e227",
- "link": "https://docs.openshift.com/container-platform/4.13/machine_management/deploying-machine-health-checks.html",
- "services": [],
- "severity": "High",
- "subcategory": "Reliability",
- "text": "Deploy machine health checks to automatically repair damaged machines in a machine pool.",
- "waf": "Reliability"
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "896d31b6-6c67-4ba5-a119-c08e8f5d587c",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-metric-alerts",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"services": [
- "Monitor"
+ "WAF",
+ "DDoS"
],
"severity": "High",
- "subcategory": "Reliability",
- "text": "Use an alerting system to provide notifications when things need direct action: Container Insights metric alerts or in-built Alerting UI.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "7e9ced16-acd1-476e-b9b2-41a998a57ae7",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview#availability-zones",
- "services": [],
- "severity": "High",
- "subcategory": "Reliability",
- "text": "Ensure that the cluster is created in a region that supports AZs and create a machine set for each AZ.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "7b997e71-1b7d-4a8c-baa6-6e15d4d5ada9",
- "link": "https://docs.openshift.com/container-platform/4.13/machine_management/creating-infrastructure-machinesets.html",
- "services": [
- "AKS"
- ],
- "severity": "Low",
- "subcategory": "Reliability",
- "text": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines.",
- "waf": "Reliability"
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "7dc3e232-6bb2-435c-905e-1696fdedfa8a",
- "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup#create-a-backup-with-velero-to-include-snapshots",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"services": [
- "Backup"
+ "NVA",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Reliability",
- "text": "Create application backup and plan for restore and include persistent volumes in the backup.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "81c12318-1a64-4174-8583-3fb4ae3c2df7",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-priority.html",
- "services": [],
- "severity": "Low",
- "subcategory": "Reliability",
- "text": "Use pod priorities, so that in case of limited resources the most critical pods will run.",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "43166c3b-cbe0-45bb-b209-d4a0da577784",
- "link": "https://docs.openshift.com/container-platform/4.13/architecture/admission-plug-ins.html",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
"services": [
- "AzurePolicy"
+ "VPN",
+ "ARS",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Low",
- "subcategory": "Security",
- "text": "Regulate cluster functions using admission plug-ins, which are commonly used to enforce security policy, resource limitations, or configuration requirements.",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "24d21678-5d2f-4a56-a56a-d48408fe8273",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
"services": [
- "ACR"
+ "ARS",
+ "WAF",
+ "VNet"
],
"severity": "Low",
- "subcategory": "Security",
- "text": "Store your container images in Azure Container Registry and geo-replicate the registry to each region.",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "4c486ba2-80dc-4059-8cf7-5ee8e1309ccc",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-vertical-autoscaler.html",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload",
- "text": "Optimize the CPU and memory request values, and maximize the efficiency of the cluster resources using vertical pod autoscaler.",
- "waf": "Performance"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "d579366b-cda2-4750-aa1a-bfe9d55d14c3",
- "link": "https://docs.openshift.com/container-platform/4.13/applications/application-health.html",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"services": [
- "Monitor"
+ "ACR",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Workload",
- "text": "Add health probes to your pods to monitor application health. Make sure pods contain livenessProbe and readinessProbe. Use Startup probes to determine the point at which the application has started up.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "c4929cb1-b3d1-4325-ae12-4ba34d0685ed",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-autoscaling.html",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload",
- "text": "Scale pods to meet demand using horizontal pod autoscaler.",
- "waf": "Reliability"
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
},
{
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "dce9be3b-b0dd-4b3b-95fb-2ec14eeaa359",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-configuring.html#nodes-pods-pod-distruption-about_nodes-pods-configuring",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"services": [
- "Cost"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Workload",
- "text": "Use disruption budgets to ensure the required number of pod replicas exist to handle expected application load.",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "2829e2ed-b217-4367-9aff-6791b4935ada",
- "link": "https://docs.openshift.com/container-platform/4.13/nodes/scheduling/nodes-scheduler-pod-topology-spread-constraints.html",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload",
- "text": "Use pod topology constraints to automatically schedule pods on nodes throughout the cluster.",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "fea1dbf3-dd95-4d48-a7c8-91dcb1f7d575",
- "link": "https://learn.microsoft.com/azure/openshift/intro-openshift#service-level-agreement",
- "services": [],
- "severity": "Medium",
- "subcategory": "Availablity",
- "text": "Leverage Current ARO SLA - 99.95 into BCDR planning",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "b95e06e1-58e2-4ea3-a92c-2de6e2065b3a",
- "link": "https://www.redhat.com/rhdc/managed-files/pa-getting-started-azure-openshift-ebook-f20686-201911-en_0.pdf",
- "services": [],
- "severity": "High",
- "subcategory": "Cluster Design",
- "text": "Run user workloads on the worker nodes, not the control plane nodes",
- "waf": "Reliability"
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "description": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines",
- "guid": "76af4a69-1e88-439a-ba46-667e13c10567",
- "link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"services": [
- "AKS",
+ "ExpressRoute",
+ "WAF",
"VNet"
],
"severity": "Medium",
- "subcategory": "Cluster Design",
- "text": "Isolate workloads into worker nodes running in individual subnets as needed",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "785c6fe9-6c96-4ad8-a44c-f3b2b38c886b",
- "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"services": [
- "Backup"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup a cluster state for stateful workload scenarios to a paired region",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "a2c02149-9014-4a5d-9ce5-74dccbd9792a",
- "link": "https://access.redhat.com/documentation/red_hat_openshift_container_storage/4.4/html/deploying_and_managing_openshift_container_storage_on_microsoft_azure/deploying-openshift-container-storage-on-microsoft-azure_rhocs",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
"services": [
- "ACR",
- "Storage"
+ "WAF",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Data Store",
- "text": "If container storage is required, ensure availability across regions if needed: Using RWX storage with inbuilt Azure Files storage class. Using CSI Drivers for storage provisioning",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "6bcca2b4-fea1-4dbf-9dd9-5d48c7c891dc",
- "link": "https://docs.openshift.com/aro/3/dev_guide/persistent_volumes.html",
- "services": [],
- "severity": "Medium",
- "subcategory": "Data Store",
- "text": "Whenever possible, move state out of containers and into external databases that support multi-region replication. Avoid Persistent Volumes",
+ "severity": "High",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "42324ece-81c1-4231-a1a6-417415833fb4",
- "link": "https://docs.openshift.com/container-platform/4.13/applications/deployments/route-based-deployment-strategies.html",
- "services": [],
- "severity": "Low",
- "subcategory": "Workload",
- "text": "Consider blue/green or canary strategies to deploy new releases of application.",
- "waf": "Operations"
- },
- {
- "category": "Platform Automation",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "ae3c2df7-4316-46c3-acbe-05bbe209d4a0",
- "link": "https://docs.openshift.com/container-platform/4.13/cicd/gitops/understanding-openshift-gitops.html",
- "services": [],
- "severity": "Low",
- "subcategory": "Workload",
- "text": "Consider using Red Hat OpenShift GitOps. Red Hat OpenShift GitOps uses Argo CD to maintain cluster resources and support application CI/CD.",
- "waf": "Operations"
- },
- {
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "da577784-24d2-4167-a5d2-fa56c56ad484",
- "link": "https://learn.microsoft.com/azure/openshift/support-lifecycle",
- "services": [],
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "services": [
+ "LoadBalancer",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "Control plane",
- "text": "Keep your clusters on the latest OpenShift version to avoid potential security or upgrade issues.",
- "waf": "Security"
+ "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8",
- "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"services": [
- "AKS",
- "Arc"
+ "LoadBalancer",
+ "WAF"
],
"severity": "High",
- "subcategory": "Control plane",
- "text": "Connect Azure Red Hat OpenShift clusters to Azure Arc-enabled Kubernetes.",
- "waf": "Security"
- },
- {
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "e1309ccc-d579-4366-acda-2750aa1abfe9",
- "link": "https://docs.openshift.com/container-platform/4.10/security/encrypting-etcd.html",
- "services": [],
- "severity": "Low",
- "subcategory": "Encryption",
- "text": "For Azure Red Hat OpenShift 4 clusters, etcd data isn't encrypted by default, but it's recommended to enable etcd encryption to provide another layer of data security.",
- "waf": "Security"
+ "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"services": [
- "AKS",
- "Arc",
- "Defender"
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Posture",
- "text": "Use Microsoft Defender for Containers supported via Arc-enabled Kubernetes to secure clusters, containers, and applications.",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1",
- "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
"services": [
- "AKS",
- "AKV",
- "Arc"
+ "VPN",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Secrets",
- "text": "For applications that require access to sensitive information, use a service principal and the AKV Secrets Provider with the extension for Arc-enabled Kubernetes clusters.",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "4eeaa359-2829-4e2e-bb21-73676aff6791",
- "link": "https://learn.microsoft.com/azure/aks/developer-best-practices-pod-security#secure-pod-access-to-resources",
- "services": [],
- "severity": "Medium",
- "subcategory": "Workload",
- "text": "Secure pod access to resources. Provide the least number of permissions, and avoid using root or privileged escalation.",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "services": [
+ "ACR",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "b4935ada-4232-44ec-b81c-123181a64174",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"services": [
- "Monitor",
- "AzurePolicy"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Workload",
- "text": "Monitor and enforce configuration by using the Azure Policy Extension.",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "15833fb4-ae3c-42df-9431-66c3bcbe05bb",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"services": [
- "Defender"
+ "WAF",
+ "VNet"
],
"severity": "High",
- "subcategory": "Workload",
- "text": "Scan your images for vulnerabilities with Microsoft Defender or any other image scanning solution.",
- "waf": "Security"
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
},
{
- "category": "Security",
- "checklist": "Azure Red Hat OpenShift",
- "guid": "e209d4a0-da57-4778-924d-216785d2fa56",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
"services": [
- "ACR",
- "Subscriptions"
+ "ASR",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Workload",
- "text": "Deploy a dedicated and private instance of Azure Container Registry to each landing zone subscription.",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b71ca41b-3a80-48f3-a6cd-22cdf197c1cf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "services": [],
- "severity": "Medium",
- "subcategory": "App delivery",
- "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
"services": [
- "AppGW"
+ "ACR",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Ensure you are using Application Gateway v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"services": [
- "LoadBalancer"
+ "DNS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Load Balancer",
- "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
- "waf": "Security"
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
"services": [
- "LoadBalancer"
+ "DNS",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Load Balancer",
- "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
"services": [
- "AppGW",
- "VNet"
+ "DNS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
"services": [
- "NVA",
+ "DNS",
+ "VM",
"WAF",
- "Entra",
- "AppGW",
- "Subscriptions",
"VNet"
],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
"services": [
- "DDoS"
+ "DNS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
- "services": [],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Configure autoscaling with a minimum amount of instances of two.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "WAF checklist",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
"services": [
- "ACR",
- "AppGW"
+ "Bastion",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Deploy Application Gateway across Availability Zones",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"services": [
+ "Bastion",
"WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "App delivery",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
"waf": "Security"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
- "services": [
- "TrafficManager"
- ],
- "severity": "High",
- "subcategory": "Traffic Manager",
- "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
"services": [
- "AVD",
- "Entra"
+ "ACR",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Low",
- "subcategory": "App delivery",
- "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"services": [
- "Entra"
+ "AppGW",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "App delivery",
- "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "severity": "Low",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"services": [
- "LoadBalancer"
+ "WAF",
+ "VNet"
],
"severity": "High",
- "subcategory": "Load Balancer",
- "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
- "waf": "Reliability"
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
"services": [
"WAF",
- "AppGW"
+ "DDoS",
+ "VNet"
],
"severity": "High",
- "subcategory": "App Gateway",
- "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy"
+ "WAF"
],
"severity": "High",
- "subcategory": "App Gateway",
- "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
- "waf": "Security"
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
"services": [
"WAF",
- "AppGW"
+ "DDoS"
],
"severity": "High",
- "subcategory": "App Gateway",
- "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "ammp": true,
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
"services": [
+ "VM",
"WAF",
- "AppGW",
"AzurePolicy"
],
"severity": "High",
- "subcategory": "App Gateway",
- "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"services": [
+ "VPN",
+ "Backup",
"WAF",
- "AppGW"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
"services": [
"WAF",
- "AppGW"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
- "services": [],
- "severity": "Low",
- "subcategory": "App Gateway",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
- "waf": "Security"
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"services": [
+ "VPN",
"WAF",
- "AppGW"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
- "waf": "Security"
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"services": [
+ "Cost",
"WAF",
- "AppGW"
+ "ExpressRoute"
],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
- "waf": "Security"
+ "severity": "High",
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
"services": [
+ "Cost",
"WAF",
- "AppGW"
+ "ExpressRoute"
],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"services": [
"WAF",
- "Sentinel",
- "AppGW"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"services": [
"WAF",
- "AppGW"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"services": [
"WAF",
- "AzurePolicy"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use WAF Policies instead of the legacy WAF configuration.",
- "waf": "Operations"
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"services": [
- "ExpressRoute",
- "VNet",
- "AppGW",
- "VPN"
+ "VPN",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
- "services": [],
- "severity": "High",
- "subcategory": "App Gateway",
- "text": "You should encrypt traffic to the backend servers.",
- "waf": "Security"
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "WAF checklist",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"services": [
+ "VPN",
"WAF"
],
- "severity": "High",
- "subcategory": "App Gateway",
- "text": "You should use a Web Application Firewall.",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
- "services": [],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Redirect HTTP to HTTPS",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
- "services": [],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
- "waf": "Operations"
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
- "services": [],
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "services": [
+ "Cost",
+ "WAF",
+ "ExpressRoute"
+ ],
"severity": "High",
- "subcategory": "App Gateway",
- "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
- "waf": "Security"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
- "services": [],
- "severity": "Low",
- "subcategory": "App Gateway",
- "text": "Create custom error pages to display a personalized user experience",
- "waf": "Operations"
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
- "services": [],
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "services": [
+ "WAF",
+ "ExpressRoute"
+ ],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"services": [
- "FrontDoor"
+ "Monitor",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
- "waf": "Performance"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
- "services": [],
- "severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Use transport layer load balancing",
- "waf": "Performance"
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
- "services": [],
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "services": [
+ "NetworkWatcher",
+ "ACR",
+ "WAF",
+ "Monitor"
+ ],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
- "waf": "Security"
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"services": [
- "Entra"
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "App Gateway",
- "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
- "waf": "Security"
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
"services": [
- "AppGW"
+ "VPN",
+ "WAF",
+ "ExpressRoute"
],
- "severity": "Low",
- "subcategory": "App Gateway",
- "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
- "service": "PostgreSQL",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
"services": [
- "SQL"
+ "Storage",
+ "WAF",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage Flexible Server",
+ "severity": "High",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
- "service": "PostgreSQL",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
"services": [
- "SQL"
+ "ACR",
+ "WAF",
+ "ExpressRoute"
],
"severity": "High",
- "subcategory": "Best Practices",
- "text": "Leverage Availability Zones where regionally applicable",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "31b67c67-be59-4519-8083-845d587cb391",
- "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
- "service": "PostgreSQL",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"services": [
- "SQL"
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage cross-region read replicas for BCDR",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
- "service": "Cognitive Services",
- "services": [],
- "severity": "Medium",
- "subcategory": "Best Practice",
- "text": "Leverage FTA HandBook for Cognitive Services",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Cognitive Services",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
"services": [
- "Backup"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup Your Prompts",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Cognitive Services",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
"services": [
- "Backup",
- "ASR"
+ "WAF",
+ "ExpressRoute"
],
"severity": "High",
- "subcategory": "Backup",
- "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
- "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
- "service": "Cognitive Services",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
"services": [
- "Backup"
+ "ExpressRoute",
+ "Monitor",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup Your ChatGPT conversations",
- "waf": "Reliability"
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
- "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
- "service": "Cognitive Services",
- "services": [],
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "WAF",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "CI/CD for custom speech",
- "waf": "Reliability"
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Services Review Checklist",
- "guid": "3687a046-7a1f-4893-9bda-43324f248116",
- "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
- "service": "Cognitive Services",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "services": [
+ "ACR",
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "QnA Service",
- "text": "Move a knowledge base using export-import",
- "waf": "Reliability"
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
- "services": [],
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
+ "services": [
+ "AzurePolicy",
+ "Firewall",
+ "ACR",
+ "WAF",
+ "RBAC"
+ ],
+ "severity": "Medium",
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
+ "severity": "Low",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
"services": [
- "AppSvc"
+ "DNS",
+ "WAF",
+ "Firewall"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
- },
- {
- "category": "Application Deployment",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
- "services": [],
- "severity": "Medium",
- "subcategory": "CI/CD",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "services": [],
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Select the right Function hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
- "service": "Azure Functions",
- "services": [],
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
- "waf": "Reliability"
- },
- {
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
- "services": [],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
"services": [
- "AppSvc"
+ "WAF",
+ "Firewall"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
"services": [
- "AppSvc"
+ "Firewall",
+ "VNet",
+ "NVA",
+ "Storage",
+ "VWAN",
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
- "waf": "Reliability"
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"services": [
- "Storage"
+ "Storage",
+ "WAF",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
- "waf": "Reliability"
- },
- {
- "category": "Application Deployment",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
- "services": [],
- "severity": "Medium",
- "subcategory": "CI/CD",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
"services": [
- "CosmosDB"
+ "AzurePolicy",
+ "WAF",
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": "Best Practices",
- "text": "FTA Resiliency Playbook",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"services": [
- "CosmosDB"
+ "WAF",
+ "Firewall",
+ "VNet"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
- "waf": "Reliability"
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
"services": [
- "CosmosDB"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Run multiple replicas of the database (>1 ) in Prod",
- "waf": "Reliability"
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
- "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
"services": [
- "CosmosDB",
- "ACR"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Leverage Multi-Region Writes",
- "waf": "Reliability"
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Span Cosmos account across two or more regions with multi-region writes",
- "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
"services": [
- "CosmosDB",
- "ACR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Distribute your data globally",
- "waf": "Reliability"
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
- "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
- "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
"services": [
- "CosmosDB"
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Choose from several well-defined consistency models",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
- "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
- "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"services": [
- "CosmosDB"
+ "WAF",
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Enable Service managed failover",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
- "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
- "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
- "service": "CosmosDB",
+ "severity": "High",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
"services": [
- "CosmosDB",
- "Storage",
- "Backup"
+ "ServiceBus",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Backup Strategy",
- "text": "Enable Automatic Backups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
- "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
- "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
"services": [
- "CosmosDB",
- "Backup"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Backup Strategy",
- "text": "Perform Periodic Backups",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Reliability"
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "CosmosDB Review Checklist",
- "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
- "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
- "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
- "service": "CosmosDB",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
"services": [
- "CosmosDB",
- "Backup"
+ "DNS",
+ "WAF",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "Backup Strategy",
- "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
- "waf": "Reliability"
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Security"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Implement branching policy in Azure DevOps",
- "guid": "eda1dae2-cc85-4c47-a6b7-81cca0e6c465",
- "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-policies-overview?view=azure-devops",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"services": [
- "AzurePolicy"
+ "Monitor",
+ "WAF",
+ "Firewall"
],
"severity": "High",
- "subcategory": "Branching Policy",
- "text": "Branch Policies",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "Operations"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Understand branch strategy such as GitFlow or GitHub Flow",
- "guid": "bc288bec-6a16-4ca7-8444-51e1add34529",
- "link": "https://learn.microsoft.com/azure/devops/repos/git/git-branching-guidance?view=azure-devops",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
"services": [
- "AzurePolicy"
+ "Backup",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Branching Policy",
- "text": "Branching strategy",
+ "severity": "Low",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
"waf": "Operations"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Understand how teams work with git",
- "guid": "ec723823-7a15-41c5-ab4e-401914387e5c",
- "link": "https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"services": [
- "AzurePolicy"
+ "ACR",
+ "WAF",
+ "Firewall"
],
"severity": "High",
- "subcategory": "Branching Policy",
- "text": "Understand GitFlow Branch Strategy",
- "waf": "Operations"
+ "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Reliability"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Merge into higher branches after two or more reviewers in a PR",
- "guid": "a9c26c9c-32ab-45bd-8c69-98a246e33899",
- "link": "https://learn.microsoft.com/azure/devops/repos/git/review-pull-requests?view=azure-devops&tabs=browser",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"services": [
- "AzurePolicy"
+ "Firewall",
+ "WAF",
+ "DDoS",
+ "VNet"
],
"severity": "High",
- "subcategory": "Branching Policy",
- "text": "Pull Request Review",
- "waf": "Operations"
+ "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
+ "waf": "Reliability"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Implement access control to the branches",
- "guid": "7e41c77d-68cb-46a2-8ac1-9f916d697d8e",
- "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-permissions?view=azure-devops",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"services": [
- "AzurePolicy"
+ "WAF",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Branching Policy",
- "text": "Access Control to the Branch",
- "waf": "Operations"
- },
- {
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Perform SAST code scan",
- "guid": "adfd27bd-e187-401a-a252-baa9b68a088c",
- "link": "https://devblogs.microsoft.com/devops/integrate-security-into-your-developer-workflow-with-github-advanced-security-for-azure-devops/",
- "services": [],
"severity": "High",
- "subcategory": "Security",
- "text": "Code Scan",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Security"
},
{
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Understand TFVC as Code Repo",
- "guid": "9a8f822b-8eb9-4d1b-a77f-26e5e6beba8e",
- "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/what-is-tfvc?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Practice",
- "text": "TFVC as Code Repository",
- "waf": "Operations"
- },
- {
- "category": "Version Control",
- "checklist": "Azure DevOps",
- "description": "Compare Git vs TFVC for your project",
- "guid": "d4f3437b-c336-4d71-9f27-a71eee0b9b5d",
- "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Practice",
- "text": "Choose Right version control",
- "waf": "Operations"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
+ "services": [
+ "PrivateLink",
+ "WAF",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Set up your team management",
- "guid": "8defd5d7-21d4-41d2-900c-807bf9eab40f",
- "link": "https://learn.microsoft.com/azure/devops/organizations/settings/manage-teams?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "services": [
+ "WAF",
+ "VNet"
+ ],
"severity": "High",
- "subcategory": "Team Planning",
- "text": "Configure your teams",
- "waf": "Operations"
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Start scheduling sprints",
- "guid": "9ed5b354-78d4-447a-a26c-2863c00f1cac",
- "link": "https://learn.microsoft.com/azure/devops/boards/sprints/define-sprints?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "services": [
+ "Firewall",
+ "NVA",
+ "DNS",
+ "PrivateLink",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Team Planning",
- "text": "Configure your sprints",
- "waf": "Operations"
- },
- {
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Set up your work item heirarchy",
- "guid": "699ef1d5-a83d-4e5d-b36c-1c81870a0bc5",
- "link": "https://learn.microsoft.com/azure/devops/organizations/settings/work/customize-process-work-item-type?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Team Planning",
- "text": "Choose Work Item types",
- "waf": "Operations"
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "WIT Processes available in Azure DevOps",
- "guid": "c1e43a18-658d-4285-aed6-7179b825546d",
- "link": "https://learn.microsoft.com/azure/devops/boards/work-items/guidance/choose-process?view=azure-devops&tabs=agile-process",
- "services": [],
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "services": [
+ "VPN",
+ "ExpressRoute",
+ "WAF",
+ "VNet"
+ ],
"severity": "High",
- "subcategory": "Team Planning",
- "text": "Select a WIT Process",
- "waf": "Operations"
- },
- {
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Use Azure Boards with GitHub",
- "guid": "f2aee455-3afc-4833-a248-726dd68c5b5c",
- "link": "https://learn.microsoft.com/azure/devops/cross-service/github-integration?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Tool Integration",
- "text": "GitHub Integration",
- "waf": "Operations"
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Understand the methologies",
- "guid": "2925394b-69b9-4d37-aac4-3bc68d1d7665",
- "link": "https://www.atlassian.com/agile/scrum/agile-vs-scrum",
- "services": [],
- "severity": "Medium",
- "subcategory": "Process Planning",
- "text": "Understand Agile Vs Scrum",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
+ "services": [
+ "WAF",
+ "VNet"
+ ],
+ "severity": "High",
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Create Dashboard and PowerBI reports",
- "guid": "7246b448-564b-44dd-94a7-59c7633bd2a1",
- "link": "https://learn.microsoft.com/azure/devops/report/dashboards/overview?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "services": [
+ "ACR",
+ "WAF",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Reporting",
- "text": "Dashboard",
- "waf": "Operations"
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Set up backlog",
- "guid": "a27a764a-90be-40e3-98ee-293c1bd363ca",
- "link": "https://learn.microsoft.com/azure/devops/boards/backlogs/set-up-your-backlog?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "WAF checklist",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "services": [
+ "NVA",
+ "Entra",
+ "WAF",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Reporting",
- "text": "Refine your backlog",
- "waf": "Operations"
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
},
{
- "category": "Azure Boards",
- "checklist": "Azure DevOps",
- "description": "Link your work items",
- "guid": "aab75719-49ab-4919-9dc9-fc9d1bb84b37",
- "link": "https://learn.microsoft.com/azure/devops/boards/queries/link-work-items-support-traceability?view=azure-devops&tabs=browser",
- "services": [],
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
+ "services": [
+ "NetworkWatcher",
+ "WAF",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Reporting",
- "text": "Visualize Relationships",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "View the velocity report",
- "guid": "b5a67fcb-9ed5-4b35-978d-447a826c2863",
- "link": "https://learn.microsoft.com/azure/devops/report/dashboards/team-velocity?view=azure-devops&tabs=in-context",
- "services": [],
- "severity": "Low",
- "subcategory": "Reporting",
- "text": "Review Team Velocity",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Create your first pipeline",
- "guid": "c00f1cac-699e-4f1d-9a83-de5de36c1c81",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=java%2Ctfs-2018-2%2Cbrowser",
- "services": [],
- "severity": "High",
- "subcategory": "Continuous Integration",
- "text": "Set up pipeline",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Specify events that trigger pipelines",
- "guid": "870a0bc5-c1e4-43a1-a658-d2858ed67179",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/build/triggers?view=azure-devops",
- "services": [],
- "severity": "High",
- "subcategory": "Continuous Integration",
- "text": "Set Build triggers",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Use YAML to create build pipeline",
- "guid": "b825546d-f2ae-4e45-93af-c8339248726d",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/customize-pipeline?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Continuous Integration",
- "text": "Customize YAML Pipeline",
- "waf": "Operations"
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Use classic GUI editor to set up pipeline",
- "guid": "d68c5b5c-2925-4394-a69b-9d379ac43bc6",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/get-started/pipelines-get-started?view=azure-devops&source=recommendations#define-pipelines-using-the-classic-interface",
- "services": [],
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "services": [
+ "WAF",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Integration",
- "text": "Use GUI for pipeline",
- "waf": "Operations"
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set up templates, parameters and expressions",
- "guid": "8d1d7665-7246-4b44-a564-b4dd74a759c7",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/templates?view=azure-devops&pivots=templates-includes",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "services": [
+ "WAF",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Integration",
- "text": "Configure Templates",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set up jobs, stages and dependencies",
- "guid": "633bd2a1-a27a-4764-a90b-e0e378ee293c",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/stages?view=azure-devops&tabs=yaml",
- "services": [],
- "severity": "High",
- "subcategory": "Continuous Integration",
- "text": "Jobs",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
"waf": "Operations"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set up conditions and Demands",
- "guid": "1bd363ca-aab7-4571-a49a-b9193dc9fc9d",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/conditions?view=azure-devops&tabs=yaml%2Cstages",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "services": [
+ "ACR",
+ "WAF",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Integration",
- "text": "Conditions and Demands",
- "waf": "Operations"
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Define Variables",
- "guid": "1bb84b37-b5a6-47fc-a9ed-5b35478d447a",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch",
- "services": [],
- "severity": "High",
- "subcategory": "Continuous Integration",
- "text": "Variables",
- "waf": "Operations"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set up your deployment pipeline",
- "guid": "826c2863-c00f-41ca-a699-ef1d5a83de5d",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/create-multistage-pipeline?view=azure-devops",
- "services": [],
- "severity": "High",
- "subcategory": "Continuous Deployment",
- "text": "Deployment Pipeline",
- "waf": "Operations"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "services": [
+ "WAF",
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Select correct branches to deploy from",
- "guid": "e36c1c81-870a-40bc-9c1e-43a18658d285",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deploy-multiple-branches?view=azure-devops",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "services": [
+ "Monitor",
+ "WAF",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Deployment",
- "text": "Release branch",
- "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Operations"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "use relevant template to deploy to azure",
- "guid": "8ed67179-b825-4546-bf2a-ee4553afc833",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/overview-azure?view=azure-devops",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "services": [
+ "WAF",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Deployment",
- "text": "Deploy to Azure",
- "waf": "Operations"
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Define Release Approvals and pre deployment checks",
- "guid": "9248726d-d68c-45b5-a292-5394b69b9d37",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/approvals?view=azure-devops&tabs=check-pass",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "services": [
+ "VPN",
+ "WAF",
+ "ExpressRoute"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Deployment",
- "text": "Approvals and Checks",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Operations"
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Define Gates and post deployment checks",
- "guid": "9ac43bc6-8d1d-4766-9724-6b448564b4dd",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/release/approvals/?view=azure-devops&tabs=yaml",
- "services": [],
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "services": [
+ "WAF",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "Continuous Deployment",
- "text": "Gates",
- "waf": "Operations"
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Define Azure Function and REST API Checks",
- "guid": "74a759c7-633b-4d2a-8a27-a764a90be0e3",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/process/invoke-checks?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Continuous Deployment",
- "text": "Azure Function Checks",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "services": [
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Review pipeline reports",
- "guid": "78ee293c-1bd3-463c-aaab-7571949ab919",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/reports/pipelinereport?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "Continuous Deployment",
- "text": "Pipline Reports",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Operations"
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "configure Trend Result widget",
- "guid": "3dc9fc9d-1bb8-44b3-9b5a-67fcb9ed5b35",
- "link": "https://learn.microsoft.com/azure/devops/report/dashboards/analytics-widgets?toc=%2Fazure%2Fdevops%2Fpipelines%2Ftoc.json&view=azure-devops#test-results-trend-advanced",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "WAF",
+ "RBAC"
+ ],
"severity": "Medium",
- "subcategory": "Analytics",
- "text": "Pipeline Result Trend",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Operations"
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Connect with WIT to visualize work",
- "guid": "478d447a-826c-4286-9c00-f1cac699ef1d",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/integrations/configure-pipelines-work-tracking?view=azure-devops&tabs=yaml",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Analytics",
- "text": "Work Tracking with Pipeline",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Operations"
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Understand agent pools",
- "guid": "5a83de5d-e36c-41c8-8870-a0bc5c1e43a1",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/agents/agents?view=azure-devops&tabs=yaml%2Cbrowser",
- "services": [],
- "severity": "Medium",
- "subcategory": "Continuous Deployment",
- "text": " Agents and agent pools",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Operations"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Understand and provision Deployment Groups when required",
- "guid": "8658d285-8ed6-4717-ab82-5546df2aee45",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deployment-groups/?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "Continuous Deployment",
- "text": "Deployment Groups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Operations"
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Understand Kubernetes Deployment",
- "guid": "53afc833-9248-4726-bd68-c5b5c2925394",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/ecosystems/kubernetes/deploy?view=azure-devops",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "AKS"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Continuous Deployment",
- "text": "Deploy to Kubernetes",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Perform Dynamic Security Testing",
- "guid": "b69b9d37-9ac4-43bc-98d1-d76657246b44",
- "link": "https://devblogs.microsoft.com/premier-developer/azure-devops-pipelines-leveraging-owasp-zap-in-the-release-pipeline/",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions",
+ "Entra",
+ "WAF",
+ "RBAC"
+ ],
"severity": "Medium",
- "subcategory": "Security",
- "text": "DAST Scan",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Manage Service Connections",
- "guid": "8564b4dd-74a7-459c-9633-bd2a1a27a764",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Service Connections",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set data retention policies for CI and CD",
- "guid": "a90be0e3-78ee-4293-a1bd-363caaab7571",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/retention?view=azure-devops&tabs=yaml",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
"services": [
- "AzurePolicy"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Retention Policies",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
"waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set up and pay for concurrent pipelines",
- "guid": "949ab919-3dc9-4fc9-b1bb-84b37b5a67fc",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/licensing/concurrent-jobs?view=azure-devops&tabs=ms-hosted",
- "services": [],
- "severity": "Low",
- "subcategory": "Administration",
- "text": "Parallel Pipelines",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "Operations"
- },
- {
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Set pipeline permissions",
- "guid": "b9ed5b35-478d-4447-a826-c2863c00f1ca",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/permissions?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Pipeline Permissions",
- "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
"waf": "Security"
},
{
- "category": "Azure Pipelines",
- "checklist": "Azure DevOps",
- "description": "Add users to pipeline",
- "guid": "c699ef1d-5a83-4de5-be36-c1c81870a0bc",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/set-permissions?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Security",
- "text": "Pipeline Users",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
"waf": "Security"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Configure Artifacts",
- "guid": "5c1e43a1-8658-4d28-98ed-67179b825546",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/artifacts-overview?view=azure-devops&tabs=nuget",
- "services": [],
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "WAF checklist",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Configuration",
- "text": "Artifact In Pipeline",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Operations"
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "waf": "Security"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Publish and consume artifact in pipeline",
- "guid": "df2aee45-53af-4c83-9924-8726dd68c5b5",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/pipeline-artifacts?view=azure-devops&tabs=yaml",
- "services": [],
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
+ "services": [
+ "AzurePolicy",
+ "Monitor",
+ "Entra",
+ "WAF",
+ "RBAC"
+ ],
"severity": "Medium",
- "subcategory": "Configuration",
- "text": "Publish and download Artifact",
- "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"waf": "Operations"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Publish NuGet packages with artifacts",
- "guid": "c2925394-b69b-49d3-99ac-43bc68d1d766",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/nuget?view=azure-devops&tabs=yaml",
- "services": [],
- "severity": "Low",
- "subcategory": "Configuration",
- "text": "NuGet",
- "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "waf": "Operations"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "services": [
+ "Monitor",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Reliability"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Publish Maven packages with artifacts",
- "guid": "57246b44-8564-4b4d-b74a-759c7633bd2a",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/publish-maven-artifacts?view=azure-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Configuration",
- "text": "Maven",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
+ "services": [
+ "Storage",
+ "ARS",
+ "WAF",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "Operations"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Publish NPM packages with artifacts",
- "guid": "1a27a764-a90b-4e0e-978e-e293c1bd363c",
- "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/npm?view=azure-devops&tabs=yaml",
- "services": [],
- "severity": "Low",
- "subcategory": "Configuration",
- "text": "NPM",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "services": [
+ "VM",
+ "WAF",
+ "AzurePolicy",
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Operations"
},
{
- "category": "Azure Artifact",
- "checklist": "Azure DevOps",
- "description": "Best Practices to work with Azure Artifact",
- "guid": "aaab7571-949a-4b91-a3dc-9fc9d1bb84b3",
- "link": "https://learn.microsoft.com/azure/devops/artifacts/concepts/best-practices?view=azure-devops",
- "services": [],
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "services": [
+ "VM",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Configuration",
- "text": "Best Practices",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "Operations"
},
{
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "What is monitoring?",
- "guid": "7b5a67fc-b9ed-45b3-9478-d447a826c286",
- "link": "https://learn.microsoft.com/devops/operate/what-is-monitoring",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
"services": [
- "Monitor"
+ "VM",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Practice",
- "text": "What to monitor?",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "Operations"
},
{
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Progressive Exposure Strategy",
- "guid": "3c00f1ca-c699-4ef1-b5a8-3de5de36c1c8",
- "link": "https://learn.microsoft.com/devops/operate/safe-deployment-practices",
- "services": [],
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "WAF checklist",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "services": [
+ "NetworkWatcher",
+ "Monitor",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Practice",
- "text": "Safe Deployment Practices",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
"waf": "Operations"
},
{
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Microsoft runs reliable systems with DevOps",
- "guid": "1870a0bc-5c1e-443a-8865-8d2858ed6717",
- "link": "https://learn.microsoft.com/devops/operate/how-microsoft-operates-devops",
- "services": [],
- "severity": "Low",
- "subcategory": "Practice",
- "text": "Case Study",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "services": [
+ "Monitor",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
"waf": "Operations"
},
{
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Security in DevOps",
- "guid": "9b825546-df2a-4ee4-953a-fc8339248726",
- "link": "https://learn.microsoft.com/devops/operate/security-in-devops",
- "services": [],
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "services": [
+ "Monitor",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Practice",
- "text": "DevSecOps",
- "waf": "Security"
- },
- {
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Enable DevSecops with Azure And GitHub",
- "guid": "dd68c5b5-c292-4539-9b69-b9d379ac43bc",
- "link": "https://learn.microsoft.com/devops/devsecops/enable-devsecops-azure-github",
- "services": [],
- "severity": "Low",
- "subcategory": "Practice",
- "text": "DevSecops",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Security"
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operations"
},
{
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Mirror RBAC in DevOps",
- "guid": "68d1d766-5724-46b4-9856-4b4dd74a759c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/secure/best-practices/end-to-end-governance",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
"services": [
- "RBAC"
+ "Monitor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Practice",
- "text": "Secure DevOps Govenance",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Security"
- },
- {
- "category": "DevOps Practice",
- "checklist": "Azure DevOps",
- "description": "Governance when using CI/CD",
- "guid": "7633bd2a-1a27-4a76-9a90-be0e378ee293",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/governance/end-to-end-governance-in-azure",
- "services": [],
"severity": "Medium",
- "subcategory": "Practice",
- "text": "Azure DevOps Governance",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
"services": [
- "EventHubs"
+ "Backup",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Data Protection",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
"services": [
- "EventHubs"
+ "VM",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
"services": [
- "TrafficManager",
+ "VM",
+ "WAF",
"AzurePolicy",
- "EventHubs",
- "RBAC",
- "Entra"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"services": [
- "Storage",
+ "ACR",
"VM",
- "EventHubs",
- "Entra",
- "AKV"
+ "WAF",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
"services": [
- "Entra",
- "RBAC",
- "EventHubs"
+ "Backup",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
+ "services": [
+ "AppGW",
+ "FrontDoor",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "WAF checklist",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
"services": [
- "VNet",
- "Monitor",
- "EventHubs"
+ "AppGW",
+ "Sentinel",
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"services": [
- "VNet",
- "PrivateLink",
- "EventHubs"
+ "AKV",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Networking",
- "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Event Hub Review",
- "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"services": [
- "EventHubs"
+ "AKV",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "EventHubs"
+ "AKV",
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage FTA Resillency HandBook",
- "waf": "Reliability"
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "ACR",
- "EventHubs"
+ "AKV",
+ "Entra",
+ "WAF",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Zone Redudancy",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "EventHubs"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Use the Premium or Dedicated SKUs for predicable performance",
- "waf": "Reliability"
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "ASR",
- "EventHubs"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Geo Redudancy",
- "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "ASR",
- "EventHubs"
+ "AKV",
+ "PrivateLink",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Geo Redudancy",
- "text": "For Business Critical Applications, use Active Active configuration",
- "waf": "Reliability"
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"services": [
- "EventHubs"
+ "AKV",
+ "Entra",
+ "WAF",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Reliability",
- "text": "Design Resilient Event Hubs",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "cb7da8cf-aa62-4a15-a495-6da97dc3a242",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-plan-capacity-vmware",
- "services": [],
- "severity": "High",
- "subcategory": "Replication",
- "text": "Capacity planning is required to make sure you have sufficient bandwidth for replication and an estimated number of CPU cores & disk types that will be needed in Azure for failover",
- "waf": "Reliability"
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "67b23587-05a1-4652-aded-fa8a488cdec4",
- "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-policy",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
+ "AKV",
"AzurePolicy",
- "VM",
- "ASR"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Replication",
- "text": "Use Azure Policy to ensure that all critical Azure VMs are protected with ASR",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "862bc3bc-14be-4b7f-96e8-d9b3bec228e7",
- "link": "https://learn.microsoft.com/azure/site-recovery/recovery-plan-overview",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "VM"
+ "AKV",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Replication",
- "text": "Define recovery plans to automate the failover sequence for VMs. You can also include automation scripts to reduce manual steps and improve recovery time",
- "waf": "Reliability"
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "437b1736-db55-4f67-a613-334bd09dc234",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-how-to-manage?tabs=recovery-services-vault",
- "services": [],
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AKV",
+ "ACR",
+ "WAF",
+ "ASR"
+ ],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enable and LOCK immutability for vaults. This ensures recovery points cannot be deleted before their intended expiry",
- "waf": "Reliability"
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "19db6128-1265-404b-a47a-493a08042729",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "services": [],
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
+ "services": [
+ "AKV",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enable 'Always-on soft delete' for vaults protecting critical workloads",
- "waf": "Reliability"
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Recovery Services Vault Checklist",
- "guid": "4798b158-8b31-4aa5-9ceb-54445135a227",
- "link": "https://learn.microsoft.com/azure/backup/backup-create-recovery-services-vault#set-storage-redundancy",
+ "checklist": "WAF checklist",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"services": [
- "Storage"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Redudancy",
- "text": "When creating Recovery Service Vaults choose the best storage redundancy option for your requirements. Vaults support local, geo and zone redundancy but this setting cannot be changed once the vault is protecting one or more resources",
- "waf": "Reliability"
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD control plane does not offer a financially backed service level agreement. We strive to attain at least 99.9% availability for the Azure Virtual Desktop service URLs. The availability of the session host virtual machines in your subscription is covered by the Virtual Machines SLA. Dependent resources/services and infrastructure availability must be also considered to properly satisfy global high-availability requirements.",
- "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
- "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
+ "checklist": "WAF checklist",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
"services": [
- "AVD",
- "ASR",
+ "Defender",
"Subscriptions",
- "VM"
+ "WAF"
],
"severity": "High",
- "subcategory": "Compute",
- "text": "Determine the expected High Availability SLA for applications/desktops published through AVD",
- "waf": "Reliability"
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "'Active-Active' model can be achieved with multiple host pools in different regions. A single Host Pool with VMs from different regions is not recommended. If multiple pools for same users will be used, the problem of how to synchronize/replicate user profiles must be solved. FSLogix Cloud Cache could be used, but need to be carefully reviewed and planned, or customers can decide to do not synchronize/replicate at all. 'Active-Passive' can be achieved using Azure Site Recovery (ASR) or on-demand Pool deployment with automated mechanism. For a detailed discussion on multi-region BCDR, please read the companion article in the 'More Info' column and this FSLogix related page: https://learn.microsoft.com/fslogix/concepts-container-recovery-business-continuity.",
- "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr",
+ "checklist": "WAF checklist",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
"services": [
- "AVD",
- "Storage",
- "ASR",
- "VM"
+ "Defender",
+ "Subscriptions",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Compute",
- "text": "Assess Geo Disaster Recovery requirements for AVD Host Pools",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Before approaching Azure Virtual Desktop BCDR planning and design, it is important to initially consider which applications consumed through AVD are critical. You may want to separate them from non-critical apps and use a separate Host Pool with a different disaster recovery approach and capabilities.",
- "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "checklist": "WAF checklist",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
"services": [
- "AVD",
- "ASR"
+ "Defender",
+ "Subscriptions",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compute",
- "text": "Separate critical applications in different AVD Host Pools",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Each Host Pool can be deployed using Availability Zones (AZ) or Availability Set (AS). To maximize resiliency, usage of AZ is recommended: at Host Pool creation time you can decide to spread Host Pool Session Hosts across all available AZ. Usage of AS will not protect from single datacenter failure, then should be used only in regions where AZ are not available. More details on AZ and AVD in the companion article. For a comparison between AZ and AS you can read here: https://learn.microsoft.com/azure/virtual-machines/availability.",
- "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
- "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
"services": [
- "AVD",
- "ASR",
- "ACR"
+ "WAF"
],
"severity": "High",
- "subcategory": "Compute",
- "text": "Plan the best resiliency option for AVD Host Pool deployment",
- "waf": "Reliability"
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Backup can be used to protect Host Pool VMs. For Pooled Pools, this is not necessary since should be stateless. Instead, this option can be considered for Personal Host Pools.",
- "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"services": [
- "AVD",
- "Backup",
- "VM",
- "ASR"
+ "Defender",
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Compute",
- "text": "Assess the requirement to backup AVD Session Host VMs",
- "waf": "Reliability"
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Even for Personal Pools, usage of Availability Zones, when available, is recommended. Three possible in-region DR strategies are possible, it is recommended to select the best one based on cost, RTO/RPO, and if it is really necessary to save the entire VM OS disk: (1) create each session host in a specific zone (AZ) and then use Azure Site Recovery (ASR) to replicate to a different zone. (2) Use Azure Backup to backup and restore the specific session host in a different AZ. (3) Create a new session host in a different AZ and rely on FSLogix and/or OneDrive to make data and settings available on the new machine. All options require administrator intervention for DR and direct user assignment at Host Pool level, then must be planned and configured in advance.",
- "guid": "5da58639-ca3a-4961-890b-29663c5e10d",
- "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"services": [
- "VM",
- "AVD",
- "Cost",
- "Backup",
- "ASR"
+ "Entra",
+ "WAF",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Compute",
- "text": "Prepare a local DR strategy for Personal Host Pool Session Hosts",
- "waf": "Reliability"
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If custom images are used to deploy AVD Host Pool VMs, it is important to ensure those artifacts are available in all regions where AVD is deployed. Azure Compute Gallery service can be used to replicate images across all regions where a Host Pool is deployed, with redundant storage and in multiple copies. Please be aware that the Azure Compute Gallery service isn't a global resource. For disaster recovery scenarios, the best practice is to have at least two galleries, in different regions.",
- "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
- "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
"services": [
"ACR",
- "Storage",
- "VM",
- "AVD",
- "ASR"
+ "Entra",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Dependencies",
- "text": "Plan for Golden Image cross-region availability",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If users of the AVD infrastructure need on-premises resource access, high availability of network infrastructure required to connect is also critical and should be considered. Resiliency of authentication infrastructure needs to be assessed and evaluated. BCDR aspects for dependent applications and other resources need to be considered to ensure availability in the secondary DR location.",
- "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "checklist": "WAF checklist",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"services": [
- "AVD",
- "ASR"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Dependencies",
- "text": "Assess Infrastructure & Application dependencies ",
- "waf": "Reliability"
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Not all data inside FSLogix user profiles may deserve protection from disaster. Additionally, if external storage is used, for example OneDrive or File Servers/Shares, what is remaining in the FSLogix profile is minimal and could be lost in some extreme circumstances. In other cases, data inside the profile can be rebuilt from other storages (for example Outlook Inbox in cached mode).",
- "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
- "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt",
+ "checklist": "WAF checklist",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"services": [
- "AVD",
- "Storage",
- "ASR"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "Assess which data need to be protected in the Profile and Office Containers",
- "waf": "Reliability"
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Preventing data loss for critical user data is important, first step is to assess which data need to be saved and protected. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary. Appropriate mechanism must be considered to provide protection for critical user data. Azure Backup service can be used to protect Profile and Office Containers data when stored on Azure Files Standard and Premium tiers. Azure NetApp Files Snapshots and Policies can be used for Azure NetApp Files (all tiers).",
- "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
"services": [
"Storage",
- "AzurePolicy",
- "AVD",
- "Backup",
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Build a backup protection strategy for Profile and Office Containers",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "In AVD, multiple replication mechanisms and strategies can be used for user data residing in FSLogix containers: [Profile Pattern #1]: Native Azure storage replication mechanisms, for example Azure Files Standard GRS replication, Azure NetApp Files Cross Region Replication. Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files is recommended. LRS with local-only resiliency can be used if no zone/region protection is required. NOTE: Azure Files Share Standard is LRS/ZRS/GRS, but with 100TB large support enabled only LRS/ZRS are supported. [Profile Pattern #2]: FSLogix Cloud Cache is built in automatic mechanism to replicate containers between different (up to 4) storage accounts. Cloud Cache should be used only when:(1) User Profile or Office containers data availability required high-availability SLA is critical and need to be resilient to region failure. (2) Selected storage option is not able to satisfy BCDR requirements. For example, with Azure File Share Premium tier, or Azure File Share Standard with Large File Support enabled, GRS is not available. (3) When replication between disparate storage is required. [Profile Pattern #3]: Only set up geo disaster recovery for application data and not for user data/profile containers: store important application data in separate storages, like OneDrive or other external storage with its own built-in DR mechanism.",
- "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
"services": [
- "AVD",
"Storage",
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Assess Profile Container storage replication requirements and resiliency for BCDR purpose",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "For local disaster recovery, Azure Backup for Azure Files can be used. For cross-region geo disaster recovery: GRS for Azure Files is only available with standard SKU and no large share support, then not suitable in most customer scenarios. If geo-replication is required with Azure File Share Premium, replication with FSLogix Cloud Cache can be evaluated, or 'in-region' Availability Zone (AZ) only resiliency should be considered.",
- "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
- "link": "https://docs.microsoft.com/azure/backup/backup-afs",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
"services": [
- "AVD",
- "Backup",
- "Storage",
- "ASR"
+ "AKV",
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Review Azure Files disaster recovery strategy",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Zone Redundant Storage will maximize in-region resiliency for the user profile data. ZRS is supported for premium file shares through the 'FileStorage' storage account kind. ZRS is supported in standard general-purpose v2 storage accounts. Usage of zone redundant storage must be paired with zone redundant deployment of Session Hosts in each Host Pool. ",
- "guid": "10d4e875-d502-4142-a795-f2b6eff34f88",
- "link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage",
- "ASR"
+ "WAF"
],
"severity": "High",
- "subcategory": "Storage",
- "text": "Use Zone Redundant Storage (ZRS) for Azure Files to maximize resiliency",
- "waf": "Reliability"
+ "text": "Follow Metaprompting guardrails for resonsible AI",
+ "waf": "Operational Excellence"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "Azure Virtual Desktop Review",
- "description": "For local disaster recovery, Azure NetApp Files (ANF) native backup is available. ANF is essentially locally redundant, then for cross-region geo disaster recovery it is necessary to use an additional mechanism that is Cross-Region Replication (CRR) https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering. Currently, ANF does not provide replication nor redundancy across different Availability Zones (AZ), only the possibility to select in which single AZ to place the ANF volume: https://learn.microsoft.com/azure/azure-netapp-files/manage-availability-zone-volume-placement.",
- "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
"services": [
- "ACR",
- "Storage",
- "AVD",
- "Backup",
- "ASR"
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Review Azure NetApp Files disaster recovery strategy",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Applications can be preinstalled in the golden image/s, can be attached using MSIX & AppAttach feature or distributed to the session hosts after host pool deployment using traditional software distribution methods.",
- "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "Monitor",
+ "WAF"
],
"severity": "High",
- "subcategory": "Golden Images",
- "text": "Determine how applications will be deployed in AVD Host Pools",
- "waf": "Operations"
+ "text": "Enable monitoring for your AOAI instances",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Multiple golden images can be required to support different OS versions and/or settings, different groups of applications that must be separated and cannot be included in a single image.",
- "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.insights/metricalerts' | extend compliant = (properties.targetResourceType =~ 'Microsoft.CognitiveServices/accounts') | project id, compliant",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "AKV",
+ "Monitor",
+ "Subscriptions",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Golden Images",
- "text": "Estimate the number of golden images that will be required",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Determine which Guest OS will be used to deploy each Host Pool: Windows 10 vs. Windows Server, Marketplace vs. Custom images",
- "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#operating-systems-and-licenses",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "Monitor",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Monitor token usage to prevent service disruptions due to capacity",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "services": [
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Golden Images",
- "text": "Determine which OS image/s you will use for Host Pool deployment",
- "waf": "Reliability"
+ "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure VM custom images can be created and stored in different ways: in an Azure Compute Gallery, as a managed image object or as a managed disk in the storage. The recommended way is to use Azure Compute Gallery.",
- "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage",
- "VM"
+ "WAF",
+ "APIM"
],
"severity": "Low",
- "subcategory": "Golden Images",
- "text": "Select the proper store for custom images",
- "waf": "Reliability"
+ "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If custom images will be used, plan for an automated build process. If no pre-existing software factory exists, consider using Custom Image Templates and/or Azure Image Builder to automate the build process.",
- "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/create-custom-image-templates",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "services": [
+ "Entra",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "services": [
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Golden Images",
- "text": "Design your build process for custom images",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "There are some known best practices and recommendations for the golden image customization, be sure to check the referenced article.",
- "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Golden Images",
- "text": "If custom image will be used, check recommended best practices for AVD on how to build custom image",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Evaluate usage of Provisioned throughput model ",
+ "waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "FSLogix stack installed in AVD session hosts does not provide auto-update capability. For this reason, it is recommended to download the latest version of FSLogix and include in the golden image update process.",
- "guid": "ed5c9027-dd1a-4343-86ca-52b199223186",
- "link": "https://learn.microsoft.com/fslogix/how-to-install-fslogix",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
"severity": "High",
- "subcategory": "Golden Images",
- "text": "Include the latest version of FSLogix in the golden image update process",
- "waf": "Reliability"
+ "text": "Review and implement Azure AI content safety",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "This tool-set has been created to automatically apply setting referenced in white paper 'Optimizing Windows 10, version 2004 for a Virtual Desktop Infrastructure (VDI) role': https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Usage of the tool and/or optimizations mentioned in the white-paper should be considered. ",
- "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
- "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "RBAC"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Golden Images",
- "text": "Evaluate the usage of Virtual-Desktop-Optimization-Tool",
+ "severity": "High",
+ "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
"waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If OneDrive is used and included in a golden image, be sure to follow the configuration procedure reported in the companion article in the 'More Info' section. Not in scope in this AVD checklist, but OneDrive optimizations like 'Known Folder Redirection' and 'Files On-Demand' should be evaluated used to reduce the space used in FSLogix profiles and provide a better user experience. OneDrive today is not supported for Remote Apps.",
- "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Golden Images",
- "text": "Determine if Microsoft OneDrive will be part of AVD deployment",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
+ "waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Be sure to review the requirements and configuration procedure contained in the companion article in the 'More Info' column. Since Teams automatic updates will be disabled, it is recommended to check and include Teams latest version in the golden image update process.",
- "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "ServiceBus",
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Golden Images",
- "text": "Determine if Microsoft Teams will be part of AVD deployment",
+ "severity": "Medium",
+ "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
"waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD can support users with different language and localization requirements in the same host pool. This can be done customizing golden images to ensure users can select whichever language they need. The procedure to configure additional language packs in Windows 11 is documented in the reference article.",
- "guid": "7c336f3b-822a-498e-8cd1-667d1150df4a",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/windows-11-language-packs",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Golden Images",
- "text": "Assess the requirement to support multiple languages",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "It is highly recommended to use separate storage accounts/shares to store MSIX packages. If necessary, storage can scale out independently and not being impacted by profile I/O activities. Azure offers multiple storage options that can be used for MISX app attach. We recommend using Azure Files or Azure NetApp Files as those options offer the best value between cost and management overhead. ",
- "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"services": [
- "Cost",
- "AVD",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "MSIX & AppAttach",
- "text": "Do not use the same storage account/share as FSLogix profiles",
+ "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
"waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "In the referenced article, we reported few but important performance considerations for MSIX usage in AVD context, be sure to carefully review.",
- "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "MSIX & AppAttach",
- "text": "Review performance considerations for MSIX",
+ "severity": "High",
+ "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
"waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "MSIX app attach requires read-only permissions to access the file share. If you're storing your MSIX applications in Azure Files, then for your session hosts, you'll need to assign all session host VMs both storage account role-based access control (RBAC) and file share New Technology File System (NTFS) permissions on the share.",
- "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage",
- "VM",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "MSIX & AppAttach",
- "text": "Check proper session host permissions for MSIX share",
- "waf": "Security"
+ "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
+ "waf": "Performance"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "3rd-party software vendor must provide a MSIX package, it is not recommended for customer to attempt the conversion procedure without proper support from the application owner.",
- "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "ACR",
+ "WAF"
],
"severity": "Low",
- "subcategory": "MSIX & AppAttach",
- "text": "MSIX packages for 3rd-party applications",
- "waf": "Cost"
+ "text": "Deploy multiple OAI instances across regions",
+ "waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "MSIX app attach doesn't support auto-update for MSIX applications, so they should be disabled.",
- "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "Low",
- "subcategory": "MSIX & AppAttach",
- "text": "Disable auto-update for MSIX packages",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "In order to leverage MSIX & App Attach, guest OS image for AVD Host pool must be Windows 10/11 Enterprise or Windows 10/11 Enterprise Multi-session, version 2004 or later.",
- "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "MSIX & AppAttach",
- "text": "Review operating systems support",
+ "text": "Ensure having adequate quotas of TPM & RPM for the workload",
"waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Once selected the VM SKU that will be used for Host Pool deployment, it is recommended to use Gen2 type of the SKU for higher security and improved capabilities.",
- "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
- "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Session Host",
- "text": "Evaluate the usage of Gen2 VM for Host Pool deployment",
- "waf": "Performance"
+ "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "waf": "Operational Excellence"
},
{
- "category": "Compute",
- "checklist": "Azure Virtual Desktop Review",
- "description": "MMR redirects the media content from Session Host to your local machine for faster processing and rendering. It only works when you play media content on Microsoft Edge or Google Chrome. See linked URL for more details.",
- "guid": "adecb27f-dc40-40f5-aca2-0090f633b1c9",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/multimedia-redirection",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "ACR",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Session Host",
- "text": "Consider using MMR (MultiMedia Redirection) to get better video performance on browser",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Deploy separate fine tuned models across regions if finetuning is employed",
+ "waf": "Reliability"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. A host pool can be one of two types: Personal and Pooled. Which type to use, and how many, is a key design decision that must be documented and validated. See companion article in 'More Info' column for more details.",
- "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "Backup",
+ "ASR",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Determine the Host Pool type to use",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "waf": "Reliability"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Use your design criteria to determine the number of Host Pools to deploy. This will be based on factors such as different OS images, multi-region support, guest VM hardware differences (such as GPU support or no), different user expectations and uptime requirements (examples might be 'Executives', 'Office Workers', 'Developers', etc.), and Host Pool RDP settings (such as drive redirection support). These will determine the number of host pools as well as how many hosts will be in each pool.",
- "guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.search/searchservices' | extend compliant = (sku.name != 'free' and properties.replicaCount >= 3) | project id, compliant",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "WAF"
],
"severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Estimate the number of different Host Pools to deploy ",
- "waf": "Performance"
+ "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "waf": "Reliability"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Confirm that the difference between automatic and direct assignment is well understood and the selected option is appropriate for the scenario in question. Automatic is the default setting.",
- "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
"severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "For Personal Host Pool type, select the proper assignment type",
- "waf": "Operations"
+ "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Check which one to use and available options, autoscale ignores existing load-balancing algorithms.",
- "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "For Pooled Host Pool type, select the best load balancing method",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "The number of cores increase, the system's synchronization overhead also increases. Especially for multiple user's sign-in simultaneously. Make sure not to use a VM that is too large for the session host",
- "guid": "b3724959-4943-4577-a3a9-e10ff6345f24",
- "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "ACR",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Capacity Planning",
- "text": "For Pooled Host Pool type, VMs shouldn't have more than 32 cores",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD does not support assigning both the RemoteApp and Desktop Application Group (DAG) in a single host pool to the same set of users. Doing so will cause a single user to have two user sessions in a single host pool. Users aren't supposed to have two active sessions at the same time in the same host pool using the same profile.",
- "guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage"
+ "WAF",
+ "RBAC"
],
"severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Do not use the same Host Pool to offer both full desktops (DAG) and Remote Apps to the same set of users",
+ "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
"waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "There is a limit of 500 Application Groups that can be created in AVD for each Microsoft Entra ID (former Azure AD) tenant. The limit can be increased (see the companion link for details) but it is not recommended.",
- "guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "ACR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Capacity Planning",
- "text": "Estimate the number of Application Groups required across all Host Pools in the Microsoft Entra ID tenant",
- "waf": "Reliability"
+ "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Applications are grouped under Application Groups as containers for publishing and assigning permissions: we recommend that you do not publish more than 50 applications per application group.",
- "guid": "fa9f2895-473d-439b-ab8e-5a5cf92c7f32",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/ai-onboarding",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "Sentinel",
+ "Defender",
+ "Monitor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "Estimate the number of Applications for each Application Group",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "FSLogix is not required for Personal Host Pools since each VM is statically assigned to a single user, then no immediate needs for a roaming profile solution. In some usage scenarios FSLogix can help. For example, a VM can be re-assigned, or user moved to another desktop, or roaming profile can be used to save user profile in a different location for DR purposes.",
- "guid": "38b19ab6-0693-4992-9394-5590883916ec",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage",
- "VM"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "Evaluate the usage of FSLogix for Personal Host Pools",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Use the link provided to set a starting point for SKU decision, then validate using a performance test. Ensure a minimum of four cores for Production is selected per Session Host (multi-session)",
- "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
- "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "WAF"
],
"severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Run workload performance test to determine the best Azure VM SKU and size to use",
- "waf": "Performance"
+ "text": "Implement Prompt shields and groundedness detection using Content Safety ",
+ "waf": "Operational Excellence"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "It is critical to check AVD capacity and limits reported in the referenced article. Additional limits and thresholds apply for network, compute, storage and service management. ",
- "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
"severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Verify AVD scalability limits for the environment",
- "waf": "Reliability"
+ "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Host Pools with GPU require special configuration, please be sure to review the referenced article.",
- "guid": "c936667e-13c0-4056-94b1-e945a459837e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "Determine if Session Hosts will require GPU",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Whenever is possible, it is recommended to leverage VM SKUs with Accelerated Networking feature. This feature does require specific VM SKU/size and OS versions, please see the list and requirement in the companion article.",
- "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Capacity Planning",
- "text": "Use Azure VM SKUs able to leverage Accelerated Networking",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "For proper planning and deployment, it is important to assess the maximum number of concurrent and total users for each Host Pool. Additionally, users from different regions may require different Host Pools to ensure the best user experience.",
- "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "AzurePolicy",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Clients & Users",
- "text": "Assess how many users will connect to AVD and from which regions",
- "waf": "Performance"
+ "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "The dependencies on resources external to the AVD pool should be assessed and reviewed, for example Active Directory, external file shares or other storage, on-premises services and resources, network infrastructure components like VPN and or ExpressRoute, external services and 3rd-party components. For all these resources, latency from the AVD Host Pool needs to be evaluated and connectivity considered. Additionally, BCDR considerations need to be applied to these dependencies as well.",
- "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
"services": [
- "ExpressRoute",
- "AVD",
- "VPN",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Clients & Users",
- "text": "Assess external dependencies for each Host Pool",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD offers a variety of client types (fat, thin, web) to connect over different platforms (Windows, MacOS, iOS, Android). Review limitations of each client and compare multiple options when possible.",
- "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/users/connect-windows",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF",
+ "RBAC"
],
- "severity": "Low",
- "subcategory": "Clients & Users",
- "text": "Review user client OS used and AVD client type",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Depending on the user locations, and AVD region deployment, users may have a non-optimal experience, hence is important to test as soon as possible in a small PoC environment. Run the 'Azure Virtual Desktop Experience Estimator' tool to select the best Azure region to deploy Host Pools. Beyond 150ms latency, user experience may be not optimal.",
- "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
- "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.privateEndpointConnections != '[]' and properties.publicNetworkAccess !~ 'enabled')",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "PrivateLink",
+ "WAF"
],
"severity": "High",
- "subcategory": "Clients & Users",
- "text": "Run a PoC to validate end-to-end user experience and impact of network latency",
- "waf": "Performance"
+ "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "RDP settings can currently only be configured at the host pool level, not per user/group. If different settings are required for different set of users, it is recommended to create multiple Host Pools.",
- "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF",
+ "Firewall",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Clients & Users",
- "text": "Assess and document RDP settings for all user groups",
+ "severity": "High",
+ "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
"waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD is a non-regional service, Host Pools can be created in any region, automatic redirection from closest front-end will happen automatically.",
- "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
- "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
"severity": "High",
- "subcategory": "General",
- "text": "Determine in which Azure regions AVD Host Pools will be deployed.",
- "waf": "Performance"
+ "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "waf": "Security"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD must store metadata to support the service; this is stored in the specified geography. However, this is independent of the regions where Host Pools are located.",
- "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/data-locations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "General",
- "text": "Determine metadata location for AVD service",
- "waf": "Reliability"
+ "text": "Use prompt compression tools like LLMLingua or gprtrim",
+ "waf": "Cost Optimization"
},
{
- "category": "Foundation",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Check for specific VM SKUs, especially if you need GPU or high-specs SKUs, and eventually Azure NetApp Files if used.",
- "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
- "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (isnotnull(identity))",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Storage",
- "VM"
+ "AKV",
+ "Entra",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "General",
- "text": "Check Azure quotas and availability for specific VM sizes and types in the selected regions",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
+ "waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AD DCs in Azure are recommended (at least two in different AZ) to reduce latency for users logging into AVD session hosts, and eventually for Azure NetApp Files and AD integration. A DC need to be able to talk to DCs for ALL child domains. As alternative, on-premise connectivity must be used to reach AD DCs.",
- "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
- "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "Storage",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Create at least two Active Directory Domain Controllers (DCs) in Azure VNet environment close to AVD Host Pool",
- "waf": "Reliability"
+ "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
+ "waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Recommended to create a separate OU per Host Pool under a separate OU hierarchy. These OUs will contain machine accounts of AVD Session Hosts. ",
- "guid": "6db55f57-9603-4334-adf9-cc23418db612",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Create a specific OU in Active Directory for each Host Pool",
- "waf": "Operations"
+ "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
+ "waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Carefully review, and potentially block/filter inheritance of GPOs to the OUs containing AVD Host Pools. ",
- "guid": "7126504b-b47a-4393-a080-327294798b15",
- "link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Review Domain GPOs that will be applied to OU and impacting Host Pool Session Hosts functionalities",
- "waf": "Operations"
+ "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
+ "waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If Active Directory Domain GPOs are used, it is recommended to configure FSLogix using the built-in provided GPO ADMX template referenced in the companion article in the 'More Info' column",
- "guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f",
- "link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (tags != '{}')",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Configure FSLogix settings using the built-in provided GPO ADMX template",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Azure AI Services are properly tagged for better management",
+ "waf": "Operational Excellence"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "It is recommended to have a specific dedicated account with minimal permissions, and without the default 10 joins limitation. Review the companion article for more details.",
- "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "VM"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Create a dedicated user account with only permissions to join VM to the domain",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Azure AI Service accounts follows organizational naming conventions",
+ "waf": "Operational Excellence"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Avoid granting access per user, instead use AD groups and replicate them using Active Directory Connector (ADC) in Microsoft Entra ID (former Azure AD). ",
- "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)",
- "waf": "Security"
+ "severity": "High",
+ "text": "Diagnostic logs in Azure AI services resources should be enabled",
+ "waf": "Operational Excellence"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If Azure Files Active Directory (AD) integration is used, as part of the configuration procedure, an AD account to represent the storage account (file share) will be created. You can choose to register as a computer account or service logon account, see FAQ for details. For computer accounts, there is a default password expiration age set in AD at 30 days. Similarly, the service logon account may have a default password expiration age set on the AD domain or Organizational Unit (OU). For both account types, we recommend you check the password expiration age configured in your AD environment and plan to update the password of your storage account identity of the AD account before the maximum password age. You can consider creating a new AD Organizational Unit (OU) in AD and disabling password expiration policy on computer accounts or service logon accounts accordingly.",
- "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
- "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.disableLocalAuth == true)",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
"Entra",
- "Storage",
- "AzurePolicy"
+ "WAF"
],
"severity": "High",
- "subcategory": "Active Directory",
- "text": "Review your organization password expiration policy for accounts used by Azure Files AD integration",
+ "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "You can configure this using Active Directory Connect (ADC) or Azure AD Domain Services (for hybrid or cloud organizations). Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
- "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "AKV",
+ "Entra",
+ "WAF"
],
"severity": "High",
- "subcategory": "Active Directory",
- "text": "A Windows Server Active Directory forest/domain must be in sync with Microsoft Entra ID",
- "waf": "Reliability"
+ "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
+ "waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Microsoft Entra ID) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.",
- "guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338",
- "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "Storage"
+ "AKV",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Microsoft Entra ID",
- "text": "Configure Azure Files share for Microsoft Entra ID (former Azure AD) Kerberos authentication on Microsoft Entra ID Joined scenario",
+ "severity": "High",
+ "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "An Azure subscription must be parented to the same Microsoft Entra ID (former Azure AD) tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Microsoft Entra ID Domain Services instance.",
- "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "Subscriptions",
- "VNet"
+ "WAF"
],
"severity": "High",
- "subcategory": "Requirements",
- "text": "A Microsoft Entra ID tenant must be available with at least one subscription linked",
- "waf": "Reliability"
+ "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
+ "waf": "Cost Optimization"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Virtual Desktop supports different types of identities depending on which configuration you choose. Please review the supported scenarios mentioned in the 'More Info' article and document the design decision accordingly in the 'Comment' column. Critically, external identities (B2B or B2C) are not supported. Be sure to review also the list of supported scenarios in https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios.",
- "guid": "b4ce4781-7557-4a1f-8043-332ae199d44c",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "WAF"
],
"severity": "High",
- "subcategory": "Requirements",
- "text": "Review and document your identity scenario",
+ "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Users need accounts that are in Microsoft Entra ID (former Azure AD). If you're also using AD DS or Azure AD Domain Services in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Microsoft Entra ID with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Microsoft Entra ID. If you're using Microsoft Entra ID with Azure AD Domain Services, user accounts are synchronized one way from Microsoft Entra ID to Azure AD Domain Services. This synchronization process is automatic. AVD also supports Microsoft Entra ID native accounts with some restrictions. External identities (B2B or B2C) are not supported.",
- "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Requirements",
- "text": "Assess User Account types and requirements",
+ "severity": "High",
+ "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Microsoft Entra ID (former Azure AD) authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using AD FS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.",
- "guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "AzurePolicy",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "services": [
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Requirements",
- "text": "If Single-Sign On (SSO) is a requirement, review the supported scenarios and prerequisites",
- "waf": "Reliability"
+ "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
+ "waf": "Cost Optimization"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Microsoft Entra ID (former Azure AD) Joined or Azure AD Domain Services joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.",
- "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra",
- "VM"
+ "Cost",
+ "WAF"
],
"severity": "High",
- "subcategory": "Requirements",
- "text": "Select the proper AVD Session Host domain join type",
- "waf": "Security"
+ "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
+ "waf": "Cost Optimization"
},
{
- "category": "Identity",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Compare self-managed Windows Active Directory Domain Services, Microsoft Entra ID (former Azure AD), and managed Azure AD Domain Services (AAD-DS)",
- "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
- "link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Entra"
+ "Cost",
+ "WAF",
+ "Monitor"
],
- "severity": "Low",
- "subcategory": "Requirements",
- "text": "Before using Azure AD Domain Services (AAD-DS) for AVD, be sure to review the limitations.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
+ "waf": "Cost Optimization"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD provides administrative templates for Intune and Active Directory GPO. Using these templates it is possible to centrally control several AVD configuration settings: Graphics related data logging, Screen capture protection, RDP Shortpath for managed networks, Watermarking. See companion article in 'More Info' colum for details. NOTE: FSLogix has its own separate template.",
- "guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "Entra"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Use built-in provided administrative templates for AVD settings configuration",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
+ "waf": "Cost Optimization"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Determine if a configuration management tool is already in place to manage Host Pool VM configuration after initial deployment, For example SCCM/SCOM, Intune/ConfigurationManager, 3rd-party solutions.",
- "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/management",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "VM"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Plan AVD Session Hosts configuration management strategy",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Plan and manage AI Search Vector storage",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "We recommend using Microsoft Intune, if requirements can be satisfied, to manage your Azure Virtual Desktop environment. Review supported scenarios and requirements to enable Intune for AVD Session Host management in the referenced article in the More Info column. Document your choice in the 'Comment' column. In that article, review the different requirements and capabilities for single-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop and multi-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session AVD.",
- "guid": "63a08be1-6004-4b4a-a79b-f3239faae113",
- "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "services": [
+ "ACR",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "services": [
+ "Storage",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
+ "waf": "Cost Optimization"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Evaluate Intune for AVD Session Hosts management",
- "waf": "Operations"
+ "text": "Evaluate the quality of prompts and applications when switching between model versions",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "The scaling tool provides a low-cost automation option for customers who want to optimize their session host VM costs. You can use the scaling tool to schedule VMs to start and stop based on Peak and Off-Peak business hours, scale out VMs based on number of sessions per CPU core, scale in VMs during Off-Peak hours, leaving the minimum number of session host VMs running. Not available yet for Personal Host Pool type.",
- "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
"services": [
- "Cost",
- "AVD",
"Monitor",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Assess the requirements for host pool auto-scaling capability",
- "waf": "Reliability"
+ "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Start VM On Connect lets you reduce costs by enabling end users to turn on their session host virtual machines (VMs) only when they need them. You can then turn off VMs when they're not needed. You can configure Start VM on Connect for personal or pooled host pools using the Azure portal or PowerShell. Start VM on Connect is a host pool wide setting.",
- "guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
"services": [
- "Cost",
- "AVD",
- "Monitor",
- "VM"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Consider the usage of Start VM on Connect for Personal Host Pools",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Evaluate your Azure AI Search results based on different search parameters",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "'Start VM On Connect' provides a smart way to automatically start previously stopped Session Hosts but does not provide a mechanism to shut down when not in used. Administrators are encouraged to configure additional policies to sign users out of their sessions and run Azure automation scripts to de-allocate VMs. Users should be not allowed to shut down their Personal Hosts since will not be able to de-allocate Azure VMs, then billing will still be active with no cost reduction.",
- "guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"services": [
- "AzurePolicy",
- "VM",
- "AVD",
- "Monitor",
- "Cost"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Evaluate the implementation of an ad-hoc mechanism to shut down Personal AVD Session Hosts",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Virtual Desktop billing is mainly based on cost associated to compute, networking and storage resources consumed by Host Pools. In addition to this, costs can be generated by dependent resources, for example VPN or ExpressRoute or vWAN, Active Directory Domain Controllers, DNS, etc. There is no direct cost associated to AVD objects like workspaces, host pools or application groups. To make AVD associated costs more evident and grouped by Host Pool, it is recommended to use 'cm-resource-parent' tag. ",
- "guid": "51bcafca-476a-48fa-9b91-9645a7679f20",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "VPN",
- "DNS",
- "AVD",
- "Monitor",
- "VWAN",
- "ExpressRoute",
- "Cost"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Review and adopt suggested Azure Tags for Azure Virtual Desktop",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Advisor analyzes your configurations and telemetry to offer personalized recommendations to solve common problems. With these recommendations, you can optimize your Azure resources for reliability, security, operational excellence, performance, and cost.",
- "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
"services": [
- "Cost",
- "AVD",
- "Monitor",
- "Entra"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Periodically check Azure Advisor recommendations for AVD",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Red team your GenAI applications",
+ "waf": "Security"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Customers have several options: Microsoft Configuration Manager, this article explains how to automatically apply updates to a Azure Virtual Desktop session hosts running Windows 10/11: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates, Microsoft Intune: https://docs.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session, Azure Update Management and WSUS for Windows Server OS only (client OS not supported: https://learn.microsoft.com/azure/automation/update-management/operating-system-requirements), 3rd Party tools. Outside an emergency security patching situation, it is recommended to move away from an 'in-place' update strategy patching strategy and adopt a re-imaging approach.",
- "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
- "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Plan for a Session Host emergency patching and update strategy",
- "waf": "Operations"
+ "text": "Provide end users with scoring options for LLM responses and track these scores. ",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "The Scheduled Agent Updates feature lets you create up to two maintenance windows per Host Pool to update AVD components at a convenient time. It is recommended to specify maintenance windows then upgrading Session Hosts will not happen during peak business hours. Scheduled Agent Updates is disabled by default. This means that, unless you enable this setting, the agent can get updated at any time by the agent update flighting service.",
- "guid": "c067939b-e5ca-4698-b9ce-3bd91843e73f",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/scheduled-agent-updates",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Configure the Scheduled Agent Updates feature",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
+ "waf": "Cost Optimization"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Host pools are a collection of one or more identical virtual machines within Azure Virtual Desktop environment. We highly recommend you create a validation host pool where service updates are applied first. This allows you to monitor service updates before the service applies them to your standard or non-validation environment.",
- "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "VM"
+ "LoadBalancer",
+ "APIM",
+ "Entra",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Create a validation (canary) Host Pool",
- "waf": "Operations"
+ "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
+ "waf": "Operational Excellence"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "An AVD Host Pool can be deployed in several ways: Azure Portal, ARM templates, Azure CLI tool, Powershell, manual VM creation with registration token, Terraform, 3rd-party tools. It is important to adopt proper method/s to support automatic deployment through automation and CI/CD tools.",
- "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "VM"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Determine Host Pool deployment strategy",
- "waf": "Operations"
+ "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
+ "waf": "Reliability"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "After you register a VM to a host pool within the Azure Virtual Desktop service, the agent regularly refreshes the VM's token whenever the VM is active. The certificate for the registration token is valid for 90 days. Because of this 90-day limit, we recommend VMs to be online for 20 minutes every 90 days so that the machine can refresh its tokens and update the agent and side-by-side stack components.",
- "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/faq",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
"Monitor",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Turn on Session Host VMs at least every 90 days for token refresh",
- "waf": "Operations"
+ "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
+ "waf": "Reliability"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Virtual Desktop Insights is a dashboard built on Azure Monitor Workbooks that helps IT professionals understand their Azure Virtual Desktop environments. Read the referenced article to learn how to set up Azure Monitor for Azure Virtual Desktop to monitor your AVD environments.",
- "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/insights",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor"
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Enable monitoring for AVD",
+ "severity": "Medium",
+ "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
"waf": "Reliability"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Azure Virtual Desktop uses Azure Monitor and Log Analytics for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories: Management, Feed, Connections, Host Registration, Errors, Checkpoints. ",
- "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Enable diagnostic settings for Workspaces, Host Pools, Application Groups and Host VMs to Log Analytics workspace",
+ "text": "Tune content filters to minimize false positives from overly aggressive filters",
"waf": "Reliability"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "See the referenced article and this additional one to setup proper monitoring and alerting for storage: https://docs.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
- "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
- "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor",
- "Storage"
+ "AKV",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Create alerts on the profile storage to be alerted in case of high usage and throttling",
- "waf": "Reliability"
+ "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "waf": "Security"
},
{
- "category": "Monitoring and Management",
- "checklist": "Azure Virtual Desktop Review",
- "description": "You can use Azure Service Health to monitor service issues and health advisories for Azure Virtual Desktop. Azure Service Health can notify you with different types of alerts (for example, email or SMS), help you understand the effect of an issue, and keep you updated as the issue resolves.",
- "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' and kind =~ 'contentsafety' | project id, compliant = 1",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Monitor"
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Configure Azure Service Health for AVD alerts ",
- "waf": "Reliability"
+ "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If required to connect to on-premises environment, assess the current connectivity option or plan for the required connectivity (ExpressRoute, Azure S2S or 3rd-party NVA VPN). ",
- "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
- "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
"services": [
- "ExpressRoute",
- "AVD",
- "VPN",
- "NVA"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Determine if hybrid connectivity is required to connect to on-premises environment",
- "waf": "Reliability"
+ "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD Host Pools can be deployed in either Azure Virtual WAN or traditional 'Hub & Spoke' network topologies. It is recommended to deploy each Host Pool in a separate 'spoke' VNet, using 'hub' is not recommended.",
- "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VWAN",
- "VNet"
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Determine Azure Virtual Network (VNet) placement for each AVD Host Pool",
- "waf": "Performance"
+ "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
+ "waf": "Cost Optimization"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Evaluate the bandwidth requirements, ensure VPN/ER bandwidth will be enough, ensure proper routing and firewall rules are in place, test end-to-end latency. ",
- "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
- "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
+ "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
+ "service": "Azure OpenAI",
"services": [
- "VPN",
- "AVD"
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Assess which on-premises resources are required from AVD Host Pools",
- "waf": "Reliability"
+ "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
+ "waf": "Cost Optimization"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Several options are available. You can use Azure Firewall or equivalent 3rd-party NVA, Network Security Group (NSG) and/or Proxy servers. NSG is not able to enable/disable by URL, only ports and protocols. Proxy should be used only as explicit setting in user browser. Details on using Azure Firewall Premium with AVD are reported in the companion article in the 'More Info' column. Be sure to allow proper access to required AVD URLs. Forced Tunneling to on-premises is not recommended.",
- "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
- "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Firewall",
- "NVA",
- "VNet"
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Need to control/restrict Internet outbound traffic for AVD hosts?",
- "waf": "Security"
+ "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
+ "waf": "Cost Optimization"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Required URLs for AVD control plane access by session hosts are documented here: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list. A check tool is available to verify connectivity from the session hosts: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool. Forced Tunneling to on-premises is not recommended.",
- "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/safe-url-list",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Networking",
- "text": "Ensure AVD control plane endpoints are accessible",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
+ "waf": "Cost Optimization"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Consider the usage of Azure Defender Endpoint or similar 3rd-party agents to control user web navigation, see the Security section for more details.",
- "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-worldwide",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Defender"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Need to control/restrict Internet outbound traffic only for users on AVD hosts? ",
- "waf": "Security"
+ "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
+ "waf": "Cost Optimization"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Custom UDR and NSG can be applied to AVD Host Pool subnets, for example to redirect to Azure Firewall or NVA, or to filter/block network traffic. In this case is recommended to carefully review to ensure optimal path for outbound traffic to AVD control plane is used. Service Tags can now be used with UDR and NSG, then AVD management plane traffic can be easily allowed: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list.",
- "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
- "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
+ "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "Firewall",
- "NVA",
- "VNet"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Networking",
- "text": "Review custom UDR and NSG for AVD Host Pool subnets",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
+ "waf": "Operational Excellence"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Network traffic from AVD Session Host VMs to AVD control plane should be as direct as possible. Redirecting this traffic through a Proxy or Firewall with deep packet inspection and/or SSL termination could cause serious issues and bad customer experience. It is recommended to bypass Proxy and Firewall just for the AVD control plane. User generated traffic surfing the web instead, should be filtered by Firewall and/or redirected to a Proxy. For details and guidelines, please see the companion article in the 'More Info' column.",
- "guid": "cc6edca0-aeca-4566-9e92-cf246f1465af",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5855",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
+ "service": "Azure OpenAI",
"services": [
- "AVD",
- "VM"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Networking",
- "text": "Do not use Proxy servers, SSL termination and Deep Packet Inspection for AVD control plane traffic",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
+ "waf": "Operational Excellence"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "It is recommended to assess and review networking bandwidth requirements for users, based on the specific workload type. The referenced article provide general estimations and recommendations, but specific measure are required for proper sizing. ",
- "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"services": [
- "AVD",
- "VM"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Networking",
- "text": "Check the network bandwidth required for each user and in total for the VM SKU",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Implement an error handling policy at the global level",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If Azure Files SMB share will be used to store user profiles via FSLogix, the usage of Private Endpoint (PE) for private access to the storage is recommended. AVD Session Hosts will access the storage using a private IP in the same VNet, a separate subnet is recommended. This feature has an additional cost that must be evaluated. If PE will not be used, at least Service Endpoint is recommended (no cost associated).",
- "guid": "ec27d589-9178-426d-8df2-ff60020f30a6",
- "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"services": [
- "Storage",
- "AVD",
- "PrivateLink",
- "Cost",
- "VNet"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Evaluate usage Private Endpoint for Azure Files share",
- "waf": "Security"
+ "text": "Ensure all APIs policies include a element.",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Connections to Azure Virtual Desktop can use TCP or UDP. RDP Shortpath is a feature of AVD that establishes a direct UDP-based transport between a supported Windows Remote Desktop client and session host. if clients have line of sight to AVD session hosts from internal network (VPN usage is not recommended), this feature can provide lower latency and best performances as explained in https://learn.microsoft.com/azure/virtual-desktop/rdp-shortpath?tabs=managed-networks#key-benefits.",
- "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"services": [
- "VPN",
- "AVD"
+ "ACR",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Evaluate usage of RDP ShortPath for clients connecting from managed internal networks",
- "waf": "Performance"
+ "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Security mechanisms provided by GPO should be used, if available. For example, it is possible to impose desktop screen lock and idle session disconnection time. Existing GPOs applied to on-premises environment should be reviewed and eventually applied also to secure also AVD Hosts when joined to the domain.",
- "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#establish-maximum-inactive-time-and-disconnection-policies",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
"services": [
- "AVD"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Active Directory",
- "text": "Review Active Directory GPO to secure RDP sessions",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Microsoft Defender for Endpoint supports Azure Virtual Desktop for Windows 10/11 Enterprise multi-session. Check article for onboarding non-persistent virtual desktop infrastructure (VDI) devices: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
- "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"services": [
- "AVD",
- "Defender"
+ "Monitor",
+ "WAF"
],
"severity": "High",
- "subcategory": "Host Configuration",
- "text": "Ensure anti-virus and anti-malware solutions are used",
- "waf": "Security"
+ "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Disks in Azure are already encrypted at rest by default with Microsoft managed keys. Host VM OS disk encryption is possible and supported using Azure Disk Encryption (ADE - BitLocker) and Disk Encryption Set (DES - Server Side Encryption), the latter is recommended. Encryption of FSLogix storage using Azure Files can be done using SSE on Azure Storage. For OneDrive encryption, see this article: https://docs.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
- "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"services": [
- "AVD",
- "AKV",
- "Storage",
- "VM"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Host Configuration",
- "text": "Assess disk encryption requirements for AVD Session Hosts",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Enable Application Insights for more detailed telemetry",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Trusted launch are Gen2 Azure VMs with enhanced security features aimed to protect against bottom of the stack threats through attack vectors such as rootkits, boot kits, and kernel-level malware. Recommended to enable and leverage Secure Boot, Virtual TPM (vTPM) and Integrity Monitoring.",
- "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"services": [
- "AVD",
"Monitor",
- "VM"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Host Configuration",
- "text": "Enable Trusted launch in Azure Gen2 VM Session Hosts",
- "waf": "Security"
+ "severity": "High",
+ "text": "Configure alerts on the most critical metrics",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Trusted Launch and Gen2 VM are not only security and performance enhancing features but also system requirements for Windows 11. When building an AVD environment based on Windows 11, it is essential to enable these features.",
- "guid": "135d3899-4b31-44d3-bc8f-028871a359d8",
- "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"services": [
- "AVD",
- "VM"
+ "AKV",
+ "WAF"
],
"severity": "High",
- "subcategory": "Host Configuration",
- "text": "Enable Trusted Launch and use Gen2 image are system requirements for Windows 11",
+ "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Displayed content will be automatically blocked or hidden in screenshots. Keep in mind screen sharing will also be blocked when using Teams or other collaboration software which use screen sharing.",
- "guid": "a49dc137-7896-4343-b2bc-1a31bf1d30b6",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/screen-capture-protection",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"services": [
- "AVD"
+ "Entra",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Host Configuration",
- "text": "Consider enabling screen capture protection to prevent sensitive information from being captured",
+ "severity": "High",
+ "text": "Protect incoming requests to APIs (data plane) with Azure AD",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If not absolutely required, redirecting drives, printers, and USB devices to a user's local device in a remote desktop session should be disabled or highly restricted. Restrict Windows Explorer access by hiding local and remote drive mappings is also a secure measure to adopt preventing users from discovering unwanted information about system configuration and users.",
- "guid": "7ce2cd20-85b4-4f82-828e-6558736ede6a",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#other-security-tips-for-session-hosts",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"services": [
- "AVD"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Host Configuration",
- "text": "Restrict device redirection and drive mapping",
+ "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "When choosing a deployment model, you can either provide remote users access to entire virtual desktops or only select applications. Remote applications, or RemoteApps, provide a seamless experience as the user works with apps on their virtual desktop. RemoteApps reduce risk by only letting the user work with a subset of the remote machine exposed by the application.",
- "guid": "4e25d70e-3924-44f4-b66f-d6cdd4f4a973",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"services": [
- "AVD"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "When possible, prefer Remote Apps over Full Desktops (DAG)",
+ "text": "Create appropriate groups to control the visibility of the products",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Web content filtering feature provided by Web Protection capability in Microsoft Defender for Endpoint, can be used to to control user web navigation. If this tool is used, configuration of web filtering for user Internet browsing is recommended. Access by the Guest OS system to required AVD control plane URLs must be guaranteed.",
- "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"services": [
- "AVD",
- "Defender"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Need to control/restrict user Internet navigation from AVD session hosts?",
- "waf": "Security"
+ "text": "Use Backends feature to eliminate redundant API backend configurations",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "We recommend you don't grant your users admin access to virtual desktops. If you need software packages, we recommend you make them available through configuration management utilities.",
- "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/security-guide",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"services": [
- "AVD"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Management",
- "text": "Ensure AVD users will not have local administrator privileges on AVD Hosts",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use Named Values to store common values that can be used in policies",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "We recommend you enable Defender for Cloud for the subscriptions, virtual machines, key vaults, and storage accounts used by AVD. With this tool is possible to assess and manage vulnerabilities, assess compliance with common frameworks like PCI, strengthen the overall security of your AVD environment and measure it over time using 'Secure Score': https://learn.microsoft.com/azure/virtual-desktop/security-guide#improve-your-secure-score.",
- "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"services": [
- "Storage",
- "VM",
- "AVD",
- "Defender",
- "AKV",
- "Subscriptions"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Enable Microsoft Defender for Cloud to manage AVD Session Hosts security posture",
- "waf": "Security"
+ "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Enabling audit log collection lets you view user and admin activity related to Azure Virtual Desktop and store in a central repository like Log Analytics workspace. ",
- "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"services": [
- "AVD",
- "Monitor",
- "Entra"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Enable diagnostic and audit logging",
- "waf": "Security"
+ "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Assign the least privilege required by defining administrative, operations, and engineering roles to Azure RBAC roles. To limit access to high privilege roles within your Azure Virtual Desktop landing zone, consider integration with Azure Privileged Identity Management (PIM). Maintaining knowledge of which team is responsible for each particular administrative area helps you determine Azure role-based access control (RBAC) roles and configuration.",
- "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/rbac",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"services": [
- "AVD",
- "Entra",
- "RBAC"
+ "Backup",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Assess the requirement to use custom RBAC roles for AVD management",
- "waf": "Security"
+ "severity": "High",
+ "text": "Ensure there is an automated backup routine",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "AVD users should not have permission to install application. If required, Windows Defender Application Control (WDAC) can be used to control which drivers and applications are allowed to run on their Windows clients. ",
- "guid": "b9ea80c8-0628-49fc-ae63-125aa4c0a284",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#windows-defender-application-control",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"services": [
- "AVD",
- "Defender"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Restrict users from installing un-authorized applications",
- "waf": "Security"
+ "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article. Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
- "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
"services": [
- "AVD",
- "Entra"
+ "EventHubs",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Microsoft Entra ID",
- "text": "Evaluate the usage of Multi-Factor Authentication (MFA) and Conditional Access (CA) for AVD users",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If you need to log at high performance levels, consider Event Hubs policy",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If Zero Trust is a requirement, review the companion article in the 'More Info' column. It provides steps to apply the principles of Zero Trust to an Azure Virtual Desktop deployment.",
- "guid": "221102d0-90af-49fc-b2b7-8d3fe397e43",
- "link": "https://learn.microsoft.com/security/zero-trust/azure-infrastructure-avd",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"services": [
- "AVD"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Zero Trust",
- "text": "Review and Apply Zero Trust principles and guidance",
- "waf": "Security"
+ "text": "Apply throttling policies to control the number of requests per second",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "Performance"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If used, make sure to check the list of best practices and recommendations described in the referenced article.",
- "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Azure Files",
- "text": "Check best-practices for Azure Files",
+ "text": "Configure autoscaling to scale out the number of instances when the load increases",
"waf": "Performance"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "SMB Multichannel enables clients to use multiple network connections that provide increased performance while lowering the cost of ownership. Increased performance is achieved through bandwidth aggregation over multiple NICs and utilizing Receive Side Scaling (RSS) support for NICs to distribute the IO load across multiple CPUs.",
- "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
- "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"services": [
- "Cost",
- "AVD",
- "Storage",
- "ACR"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Azure Files",
- "text": "Enable SMB multichannel when using a premium file share to host FSLogix profile containers.",
+ "severity": "Medium",
+ "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
"waf": "Performance"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "If a second region is required for DR purposes verify NetApp availability in there as well.",
- "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
- "link": "https://azure.microsoft.com/global-infrastructure/services/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Azure NetApp Files",
- "text": "If NetApp Files storage is required, check storage service availability in your specific region.",
+ "text": "Use the premium tier for production workloads.",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "CA option is a recommended setting in the FSLogix scenario, as it enables a more resilient SMB session between the Session Host and NetApp Files.",
- "guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Azure NetApp Files",
- "text": "If NetApp Files storage is used enable CA (Continuous Availability) option to increase resiliency",
+ "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "An Active Directory Site should be created for the Azure virtual network environment where Azure NetApp Files (ANF) subnet will be created, and that site name should be specified in the ANF connection property when executing the join procedure as explained in the reference article.",
- "guid": "6647e977-db49-48a8-bc35-743f17499d42",
- "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage",
- "VNet"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "High",
- "subcategory": "Azure NetApp Files",
- "text": "If Azure NetApp Files storage is used, check Active Directory Site name setting in the Active Directory Connection configuration",
+ "text": "Be aware of APIM's limits",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Possible options: Standard HDD, Standard SSD, or Premium SSD. Ephemeral disks are not supported, Ultra-Disks not recommended. Recommended to evaluate Premium for OS disk if user density is not low, and if Cloud Cache will be used. ",
- "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
- "link": "https://docs.microsoft.com/azure/virtual-machines/disks-types",
- "services": [
- "AVD",
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "Capacity Planning",
- "text": "Determine which type of managed disk will be used for the Session Hosts",
- "waf": "Performance"
- },
- {
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Possible options are: Azure NetApp Files, Azure Files, VM based File Server. File-server it is not recommended. Azure Files Premium typically a good starting point. NetApp usually required for large scale / high-performant environment. For a detailed comparison see the article in the 'More Info' column.",
- "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
- "services": [
- "AVD",
- "Storage",
- "VM"
- ],
- "severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Determine which storage backend solution will be used for FSLogix Profiles",
- "waf": "Performance"
- },
- {
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Every Host Pool should use a separate set of storage accounts/volumes (at least one) and shares. Users should have a different profile for each Host Pool since settings and configurations are specific to each Host Pool. Additionally, accessing different Host Pools at the same time can cause errors on the shared user profile VHD/X. Usage of different storage accounts/volumes for multiple shares is also recommended to scale independently.",
- "guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
- "services": [
- "AVD",
- "Storage"
- ],
- "severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Do not share storage and profiles between different Host Pools",
- "waf": "Performance"
- },
- {
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "As a starting point for estimating profile container storage performance requirements we recommend to assume 10 IOPS per user in the steady state and 50 IOPS per user during sign-in/sign-out. Space requirements is simply obtained based on the maximum profiles size in FSLogix per the total number of users for each Host Pool. Multiple storage accounts can be used for the same Host Pool if required.",
- "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
- "link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
"severity": "High",
- "subcategory": "Capacity Planning",
- "text": "Verify storage scalability limits and Host Pool requirements",
+ "text": "Ensure that the self-hosted gateway deployments are resilient.",
"waf": "Reliability"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Avoid introducing additional latency and costs associated with cross-region network traffic where possible.",
- "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
- "link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
"services": [
- "Cost",
- "AVD",
- "Storage"
+ "FrontDoor",
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "High",
- "subcategory": "Capacity Planning",
- "text": "For optimal performance, the storage solution and the FSLogix profile container should be in the same Azure region.",
+ "severity": "Medium",
+ "text": "Use Azure Front Door in front of APIM for multi-region deployment",
"waf": "Performance"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "The recommendation in Azure Virtual Desktop is to use Profile Container without Office Container (ODFC) split unless you are planning for specific Business Continuity and Disaster Recovery (BCDR) scenarios as described in the Disaster Recovery section below. https://docs.microsoft.com/fslogix/profile-container-office-container-cncpt ",
- "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
- "link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage",
- "ASR"
+ "WAF",
+ "VNet"
],
- "severity": "High",
- "subcategory": "FSLogix",
- "text": "Do not use Office Containers (ODFC) if not strictly required and justified",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy the service within a Virtual Network (VNet)",
+ "waf": "Security"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Make sure to configure the following antivirus exclusions for FSLogix Profile Container virtual hard drives, as documented in the referenced article in the 'More Info' column.",
- "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
- "link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "Monitor",
+ "APIM",
+ "VNet",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "FSLogix",
- "text": "Configure the recommended antivirus exclusions for FSLogix (includes not scanning VHD(x) files on connect).",
+ "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
"waf": "Security"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Profile containers have a default max size of 30GB. If large Profile Containers are anticipated, and customers wants to try to keep them small, consider using OneDrive to host Office 365 files outside the FSLogix profile.",
- "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
- "link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "APIM",
+ "VNet",
+ "PrivateLink",
+ "Entra",
+ "WAF"
],
- "severity": "High",
- "subcategory": "FSLogix",
- "text": "Review and confirm configured maximum profile size in FSLogix",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
+ "waf": "Security"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Defaults and recommended settings are reported in the companion article in the 'More Info' column. If not recommended keys and/or values must be used, be sure to review with a Microsoft AVD expert and clearly document your choices.",
- "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
- "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"services": [
- "AVD",
- "AKV",
- "Storage",
- "ACR"
+ "WAF"
],
"severity": "High",
- "subcategory": "FSLogix",
- "text": "Review FSLogix registry keys and determine which ones to apply",
- "waf": "Reliability"
+ "text": "Disable Public Network Access",
+ "waf": "Security"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Concurrent or multiple connections are not recommended in Azure Virtual Desktop. Concurrent connections are also not supported by Session Hosts running in an Azure Virtual Desktop Host Pool. OneDrive, if used, doesn't support concurrent or multiple connections using the same container, under any circumstance. For multiple connections, usage of the same profile disk is not recommended.",
- "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
- "link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "WAF"
],
- "severity": "High",
- "subcategory": "FSLogix",
- "text": "Avoid usage of concurrent or multiple connections",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Simplify management with PowerShell automation scripts",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "Cloud Cache uses OS drive as local cache storage and may generate lot of pressure on the VM disk. Depending on the VM SKU and size used, the VM temporary drive can be a viable and performant solution where to relocate Cloud Cache cached content. Before adopting this solution, tests should be executed to confirm performance and stability. More details on Cloud Cache can be found here: https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache. ",
- "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
- "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage",
- "VM"
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "Low",
- "subcategory": "FSLogix",
- "text": "If FSLogix Cloud Cache is used, consider moving the cache directory to the VM temporary drive.",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
+ "waf": "Operations"
},
{
- "category": "Storage",
- "checklist": "Azure Virtual Desktop Review",
- "description": "REDIRECTION.XML file is used to control what folders are redirected out of the profile container to the 'C:' drive. Exclusions should be the exception and should never be used unless the specific exclusion is completely understood by the person configuring the exclusion. Exclusions should always be fully tested in the environment where they are intended to be implemented. Configuring exclusions may impact functionality, stability and performance.",
- "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
- "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
"services": [
- "AVD",
- "Storage"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "FSLogix",
- "text": "Review the usage of FSLogix redirection.",
- "waf": "Cost"
+ "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "waf": "Operations"
},
{
- "category": "Application Deployment",
- "checklist": "Azure AKS Review",
- "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
"services": [
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Use canary or blue/green deployments",
+ "text": "Implement DevOps and CI/CD in your workflow",
"waf": "Operations"
},
{
- "category": "Application Deployment",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Development",
- "text": "If required for AKS Windows workloads HostProcess containers can be used",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Secure APIs using client certificate authentication",
+ "waf": "Security"
},
{
- "category": "Application Deployment",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Development",
- "text": "Use KEDA if running event-driven workloads",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Secure backend services using client certificate authentication",
+ "waf": "Security"
},
{
- "category": "Application Deployment",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Development",
- "text": "Use Dapr to ease microservice development",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
+ "waf": "Security"
},
{
- "category": "Application Deployment",
- "checklist": "Azure AKS Review",
- "guid": "3acbe04b-be20-49d3-afda-47778424d116",
- "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"services": [
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Infrastructure as Code",
- "text": "Use automation through ARM/TF to create your Azure resources",
- "waf": "Operations"
+ "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
"services": [
- "AKS",
- "ASR"
+ "WAF"
],
"severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Schedule and perform DR tests regularly",
- "waf": "Reliability"
+ "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"services": [
- "LoadBalancer",
- "TrafficManager",
- "AKS",
- "FrontDoor"
+ "AKV",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant",
- "guid": "578a219a-46be-4b54-9350-24922634292b",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
"services": [
- "AKS"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use Availability Zones if they are supported in your Azure region",
- "waf": "Reliability"
+ "text": "Use managed identities to authenticate to other Azure resources whenever possible",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "WAF checklist",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"services": [
- "AKS"
+ "AppGW",
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Use the SLA-backed AKS offering",
- "waf": "Reliability"
+ "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS"
+ "AppSvc",
+ "WAF"
],
"severity": "Low",
- "subcategory": "High Availability",
- "text": "Use Disruption Budgets in your pod and deployment definitions",
+ "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
+ "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "services": [
+ "Backup",
+ "ASR",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
+ "service": "App Services",
"services": [
"ACR",
- "AKS"
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "If using a private registry, configure region replication to store images in multiple regions",
+ "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "AKS",
- "Storage",
- "ASR"
+ "AppSvc",
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads",
+ "severity": "Medium",
+ "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure AKS Review",
- "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "Backup",
+ "WAF"
],
"severity": "High",
- "subcategory": "Requirements",
- "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).",
+ "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
"waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS"
+ "AppSvc",
+ "Monitor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Cost",
- "text": "Use an external application such as kubecost to allocate costs to different users",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
+ "waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS"
+ "AppSvc",
+ "ASR",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Cost",
- "text": "Use scale down mode to delete/deallocate nodes",
- "waf": "Cost"
+ "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
+ "waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS"
+ "AppSvc",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cost",
- "text": "When required use multi-instance partitioning GPU on AKS Clusters",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
+ "waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS"
+ "AppSvc",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Cost",
- "text": "If running a Dev/Test cluster use NodePool Start/Stop",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
+ "waf": "Reliability"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "AKS",
- "AzurePolicy"
+ "AppSvc",
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Compliance",
- "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
- "waf": "Security"
+ "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
+ "waf": "Reliability"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
"services": [
- "AKS"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Compliance",
- "text": "Separate applications from the control plane with user/system node pools",
- "waf": "Security"
+ "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
+ "waf": "Reliability"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"services": [
- "AKS"
+ "Monitor",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Compliance",
- "text": "Add taint to your system nodepool to make it dedicated",
- "waf": "Security"
+ "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
+ "waf": "Reliability"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "ACR",
- "AKS"
+ "AppSvc",
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Compliance",
- "text": "Use a private registry for your images, such as ACR",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "Entra",
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Compliance",
- "text": "Scan your images for vulnerabilities",
+ "severity": "High",
+ "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "cc639637-a652-42ac-89e8-06965388e9de",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
"services": [
- "AKS",
- "Defender"
+ "AppSvc",
+ "Entra",
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Compliance",
- "text": "Use Azure Security Center to detect security posture vulnerabilities",
+ "severity": "High",
+ "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "Subscriptions",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "If required configure FIPS",
+ "severity": "Medium",
+ "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "TrafficManager",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "severity": "Medium",
+ "text": "Do not store sensitive data on local disk",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
"services": [
- "AKV",
- "AKS"
+ "AppSvc",
+ "ACR",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Secrets",
- "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
+ "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"services": [
- "AKV",
- "AKS"
+ "AppSvc",
+ "WAF"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
+ "text": "Deploy code to App Service from a trusted and secure environment.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"services": [
- "AKV",
- "AKS"
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "If required add Key Management Service etcd encryption",
+ "severity": "High",
+ "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"services": [
"AKV",
- "AKS"
+ "Entra",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Secrets",
- "text": "If required consider using Confidential Compute for AKS",
+ "severity": "High",
+ "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"services": [
- "AKV",
- "AKS",
- "Defender"
+ "ACR",
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "Consider using Defender for Containers",
+ "severity": "High",
+ "text": "Pull container images from Azure Container Registry using a Managed Identity.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "Entra",
+ "WAF",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Use managed identities instead of Service Principals",
+ "severity": "Medium",
+ "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "Entra",
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Integrate authentication with AAD (using the managed integration)",
+ "text": "Send App Service activity logs to Log Analytics",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "Monitor",
+ "Firewall",
+ "VNet",
+ "NVA",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Limit access to admin kubeconfig (get-credentials --admin)",
+ "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
"services": [
- "AKS",
- "RBAC",
- "Entra"
+ "Firewall",
+ "VNet",
+ "NVA",
+ "Storage",
+ "PrivateLink",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Integrate authorization with AAD RBAC",
+ "severity": "Low",
+ "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
- "AKS",
- "RBAC",
- "Entra"
+ "AppSvc",
+ "PrivateLink",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
+ "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "Monitor",
+ "FrontDoor",
+ "AppGW",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
+ "severity": "High",
+ "text": "Use a Web Application Firewall (WAF) in front of App Service.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "PrivateLink",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "For AKS non-interactive logins use kubelogin (preview)",
+ "severity": "High",
+ "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Disable AKS local accounts",
+ "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Identity",
- "text": "Configure if required Just-in-time cluster access",
+ "severity": "High",
+ "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Identity",
- "text": "Configure if required AAD conditional access for AKS",
+ "severity": "High",
+ "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Identity",
- "text": "If required for Windows AKS workloads configure gMSA ",
+ "severity": "High",
+ "text": "Turn off remote debugging in production environments.",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"services": [
- "AKS",
- "Entra"
+ "AppSvc",
+ "Defender",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "For finer control consider using a managed Kubelet Identity",
+ "text": "Enable Defender for Cloud - Defender for App Service",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"services": [
- "ACR",
- "AKS",
- "AppGW"
+ "EventHubs",
+ "VNet",
+ "NVA",
+ "AppGW",
+ "WAF",
+ "DDoS"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "If using AGIC, do not share an AppGW across clusters",
- "waf": "Reliability"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
- "services": [
- "AKS"
- ],
- "severity": "High",
- "subcategory": "Best practices",
- "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
- "waf": "Reliability"
+ "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "VNet",
+ "PrivateLink",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "For Windows workloads use Accelerated Networking",
- "waf": "Performance"
+ "text": "Pull container images over a Virtual Network from Azure Container Registry.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"services": [
- "LoadBalancer",
- "AKS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Best practices",
- "text": "Use the standard ALB (as opposed to the basic one)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Conduct a penetration test on the web application.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"services": [
- "AKS",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "If using Azure CNI, consider using different Subnets for NodePools",
+ "text": "Deploy validated and vulnerability-scanned code.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
"services": [
- "Cost",
- "AKS",
- "PrivateLink",
- "VNet"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cost",
- "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
+ "severity": "High",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
+ "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
+ "service": "App Services",
"services": [
- "VPN",
- "AKS"
+ "AppSvc",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "HA",
- "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability",
+ "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
+ "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
+ "service": "App Services",
"services": [
- "AKS"
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "IPAM",
- "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "severity": "Medium",
+ "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
+ "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "App Services",
"services": [
- "AKS",
- "VNet"
+ "AppSvc",
+ "AzurePolicy",
+ "Backup",
+ "ACR",
+ "WAF"
],
"severity": "High",
- "subcategory": "IPAM",
- "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
- "waf": "Performance"
+ "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
+ "waf": "Governance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
+ "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/",
+ "service": "App Services",
"services": [
- "AKS"
+ "AppSvc",
+ "Cost",
+ "WAF",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "IPAM",
- "text": "If using Azure CNI, check the maximum pods/node (default 30)",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
+ "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
+ "service": "App Services",
"services": [
- "AKS",
- "VNet"
+ "AppSvc",
+ "ARS",
+ "Storage",
+ "Cost",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "IPAM",
- "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"services": [
- "AKS"
+ "Entra",
+ "Subscriptions",
+ "WAF"
],
"severity": "High",
- "subcategory": "IPAM",
- "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
- "waf": "Reliability"
+ "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Operations",
- "text": "If required add your own CNI plugin",
+ "severity": "Medium",
+ "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Operations",
- "text": "If required configure Public IP per node in AKS",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Scalability",
- "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
- "waf": "Reliability"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "services": [
- "AKS"
- ],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
- "waf": "Reliability"
+ "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Scalability",
- "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
- "waf": "Reliability"
+ "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"services": [
- "AKS",
- "NVA"
+ "Entra",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "If using a public API endpoint, restrict the IP addresses that can access it",
+ "text": "Has an RBAC model been created for use within VMware vSphere",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Security",
- "text": "Use private clusters if your requirements mandate it",
+ "severity": "Medium",
+ "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"services": [
- "AKS",
- "AzurePolicy"
+ "AVS",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
+ "severity": "High",
+ "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"services": [
- "AKS",
- "AzurePolicy"
+ "WAF",
+ "RBAC"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
+ "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"services": [
- "AKS",
- "AzurePolicy"
+ "AVS",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Use Kubernetes network policies to increase intra-cluster security",
- "waf": "Security"
+ "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
"services": [
- "WAF",
- "AKS"
+ "Monitor",
+ "ExpressRoute",
+ "VPN",
+ "NetworkWatcher",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Use a WAF for web workloads (UIs or APIs)",
- "waf": "Security"
+ "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"services": [
- "DDoS",
- "AKS",
- "VNet"
+ "Monitor",
+ "ExpressRoute",
+ "AVS",
+ "NetworkWatcher",
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Use DDoS Standard in the AKS Virtual Network",
- "waf": "Security"
+ "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"services": [
- "AKS"
+ "Monitor",
+ "AVS",
+ "NetworkWatcher",
+ "VM",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Security",
- "text": "If required add company HTTP Proxy",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"services": [
- "AKS"
+ "ARS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Consider using a service mesh for advanced microservice communication management",
- "waf": "Security"
+ "severity": "High",
+ "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "Entra",
+ "AVS",
+ "WAF",
+ "RBAC"
],
"severity": "High",
- "subcategory": "Alerting",
- "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
- "waf": "Operations"
+ "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"services": [
- "AKS",
- "Entra"
+ "Entra",
+ "AVS",
+ "WAF",
+ "RBAC"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Check regularly Azure Advisor for recommendations on your cluster",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"services": [
- "AKS"
+ "Entra",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Enable AKS auto-certificate rotation",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Limit use of CloudAdmin account to emergency access only",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"services": [
- "AKS"
+ "Entra",
+ "AVS",
+ "WAF",
+ "VM"
],
"severity": "High",
- "subcategory": "Compliance",
- "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
- "waf": "Operations"
+ "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Is East-West traffic filtering implemented within NSX-T",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"services": [
- "AKS"
+ "AppGW",
+ "AVS",
+ "WAF",
+ "Firewall"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Consider using AKS command invoke on private clusters",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "For planned events consider using Node Auto Drain",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
"services": [
- "AKS"
+ "Monitor",
+ "AVS",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"services": [
- "AKS"
+ "ExpressRoute",
+ "VNet",
+ "VPN",
+ "WAF",
+ "DDoS"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Use custom Node RG (aka 'Infra RG') name",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Compliance",
- "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
- "waf": "Operations"
+ "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"services": [
- "AKS"
+ "Defender",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Taint Windows nodes",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF",
+ "Arc"
],
- "severity": "Low",
- "subcategory": "Compliance",
- "text": "Keep windows containers patch level in sync with host patch level",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "description": "Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "SQL",
+ "AVS",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Compliance",
- "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
- "waf": "Operations"
+ "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
"services": [
- "AKS"
+ "AKV",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Compliance",
- "text": "If required use nodePool snapshots",
- "waf": "Cost"
+ "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"services": [
- "Cost",
- "AKS"
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Cost",
- "text": "Consider spot node pools for non time-sensitive workloads",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"services": [
- "Cost",
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Cost",
- "text": "Consider AKS virtual node for quick bursting",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
- "waf": "Operations"
+ "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "ASR",
+ "WAF"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
- "waf": "Operations"
+ "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor CPU and memory utilization of the nodes",
+ "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
"waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
"waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"services": [
- "Storage",
- "ServiceBus",
- "EventHubs",
- "Monitor",
- "AKS"
+ "Cost",
+ "AVS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor OS disk queue depth in nodes",
- "waf": "Operations"
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
+ "waf": "Cost"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
"services": [
- "LoadBalancer",
- "Monitor",
- "AKS",
- "NVA"
+ "Cost",
+ "AVS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
+ "waf": "Cost"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"services": [
- "Monitor",
- "AKS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Subscribe to resource health notifications for your AKS cluster",
- "waf": "Operations"
+ "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
"severity": "High",
- "subcategory": "Resources",
- "text": "Configure requests and limits in your pod specs",
- "waf": "Operations"
+ "text": "Ensure all required resource reside within the same Azure availability zone(s)",
+ "waf": "Performance"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"services": [
- "AKS"
+ "Defender",
+ "VM",
+ "AVS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Resources",
- "text": "Enforce resource quotas for namespaces",
- "waf": "Operations"
+ "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
"services": [
- "AKS",
- "Subscriptions"
+ "VM",
+ "AVS",
+ "WAF",
+ "Arc"
+ ],
+ "severity": "Medium",
+ "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
+ "services": [
+ "AVS",
+ "WAF"
],
"severity": "High",
- "subcategory": "Resources",
- "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
"waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
- "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
"services": [
- "AKS"
+ "VM",
+ "AVS",
+ "WAF",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "Resources",
- "text": "Configure Liveness and Readiness probes for all deployments",
+ "severity": "Medium",
+ "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
"waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
"services": [
- "AKS"
+ "AzurePolicy",
+ "Backup",
+ "AVS",
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Scalability",
- "text": "Use the Cluster Autoscaler",
- "waf": "Performance"
+ "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"services": [
- "AKS"
+ "Defender",
+ "Monitor",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "Customize node configuration for AKS node pools",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
"services": [
- "AKS"
+ "Defender",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Scalability",
- "text": "Use the Horizontal Pod Autoscaler when required",
- "waf": "Performance"
+ "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
"services": [
- "AKS"
+ "AVS",
+ "WAF"
],
"severity": "High",
- "subcategory": "Scalability",
- "text": "Consider an appropriate node size, not too large or too small",
- "waf": "Performance"
+ "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"services": [
- "AKS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "Consider subscribing to EventGrid Events for AKS automation",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
"services": [
- "AKS"
+ "Monitor",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "For long running operation on an AKS cluster consider event termination",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"services": [
- "AKS"
+ "Monitor",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
"services": [
- "AKS",
- "Storage"
+ "Monitor",
+ "AVS",
+ "WAF"
],
"severity": "High",
- "subcategory": "Storage",
- "text": "Use ephemeral OS disks",
- "waf": "Performance"
+ "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"services": [
- "AKS",
- "Storage"
+ "Monitor",
+ "WAF"
],
"severity": "High",
- "subcategory": "Storage",
- "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
- "waf": "Performance"
+ "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"services": [
- "AKS",
- "Storage"
+ "Storage",
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Storage",
- "text": "For hyper performance storage option use Ultra Disks on AKS",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
"services": [
- "SQL",
- "AKS",
- "Storage"
+ "AVS",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"services": [
- "AKS",
- "Storage"
+ "AzurePolicy",
+ "Storage",
+ "WAF",
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
+ "waf": "Operations"
},
{
- "category": "Operations",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
"services": [
- "AKS",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
- "waf": "Performance"
- },
- {
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
- "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
- "service": "Purview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage FTA Resillency Handbook",
- "waf": "Reliability"
+ "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
"services": [
- "ASR"
+ "Backup",
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Plan for Data Center level outage",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
- "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
"services": [
- "ASR"
+ "AVS",
+ "WAF",
+ "Arc"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Practice Failover for BCDR",
- "waf": "Reliability"
+ "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"services": [
- "Backup"
+ "Monitor",
+ "AVS",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Backup and Restore ",
- "text": "Plan a backup strategy and take regular backups",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
- "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"services": [
- "EventHubs"
+ "AVS",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Purview Accounts Replications",
- "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
- "waf": "Reliability"
- },
- {
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
- "link": "https://learn.microsoft.com/purview/deployment-best-practices",
- "service": "Purview",
- "services": [],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Purview accounts architectures and deployment best practices",
- "waf": "Reliability"
+ "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
+ "services": [
+ "Monitor",
+ "AVS",
+ "WAF",
+ "AzurePolicy"
+ ],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Collection Architectures and best practices",
- "waf": "Reliability"
+ "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
+ "services": [
+ "Defender",
+ "AVS",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Assest lifecycle best practices",
- "waf": "Reliability"
+ "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
+ "services": [
+ "Backup",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow automation best practices",
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"services": [
- "Backup"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Backup and Migration Best practices",
+ "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
+ "services": [
+ "ASR",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Purview Glossary Best Practices",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
- "link": "https://learn.microsoft.com/purview/concept-workflow",
- "service": "Purview",
- "services": [],
- "severity": "Low",
- "subcategory": "Data catalog",
- "text": "Leverage Workflows ",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
+ "services": [
+ "ASR",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data catalog",
- "text": "Follow Purview Security Best Practices",
+ "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
- "service": "Purview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Data Map",
- "text": "Follow Purview Data Lineage Best Practices",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
+ "services": [
+ "NVA",
+ "AVS",
+ "WAF",
+ "ExpressRoute"
+ ],
"severity": "Medium",
- "subcategory": "Data Map",
- "text": "Follow Best Practices for Scanning Registered Sources",
+ "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
+ "services": [
+ "Backup",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data Map",
- "text": "Follow Classification Best Practices in Governance Portal",
+ "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
- "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
+ "services": [
+ "Backup",
+ "AVS",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Data Map",
- "text": "Perform Sensitivity Labelling in the Purview Data Map",
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
- "link": "https://learn.microsoft.com/purview/concept-data-share",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
"services": [
- "Storage"
+ "Backup",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Data Sharing",
- "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
+ "severity": "Medium",
+ "text": "Deploy your backup solution outside of vSan, on Azure native components",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "services": [
+ "AVS",
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "Data Estate",
- "text": "Leverage Data Estate Insights",
+ "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
- "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "Data Estate",
- "text": "Use Data stewardship and Catalog adoption",
- "waf": "Reliability"
+ "text": "For manual deployments, all configuration and deployments must be documented",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "services": [
+ "AVS",
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "Data Estate",
- "text": "Use Inventory and Ownership",
- "waf": "Reliability"
+ "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
- "link": "https://learn.microsoft.com/purview/glossary-insights",
- "service": "Purview",
- "services": [],
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
"severity": "Low",
- "subcategory": "Data Estate",
- "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
- "waf": "Reliability"
+ "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
- "link": "https://learn.microsoft.com/purview/compliance-manager",
- "service": "Purview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Data Quality ",
- "text": "Generate assessment scores",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
- "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
- "service": "Purview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Data Quality ",
- "text": "Profiling- get summaries of data content",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
+ "services": [
+ "AzurePolicy",
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
- "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
"services": [
- "AzurePolicy"
+ "AKV",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Data Policy",
- "text": "Follow Microsoft Purview Data Owner access policies",
- "waf": "Reliability"
+ "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
- "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
"services": [
- "AzurePolicy"
+ "AKV",
+ "AVS",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Low",
- "subcategory": "Data Policy",
- "text": "Follow Self-service access policies",
- "waf": "Reliability"
+ "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "waf": "Operations"
},
{
- "category": "Operations management",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
- "link": "https://learn.microsoft.com/purview/concept-policies-devops",
- "service": "Purview",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
"services": [
- "AzurePolicy"
+ "AVS",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Data Policy",
- "text": "Follow DevOps policies",
- "waf": "Reliability"
+ "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Container Apps Review",
- "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
- "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
- "service": "Container Apps",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Container Apps Review",
- "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
- "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
- "service": "Container Apps",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Use more than one replica and enable Zone Redundancy.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
+ "services": [
+ "AVS",
+ "Subscriptions",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Container Apps Review",
- "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
+ "services": [
+ "Storage",
+ "WAF",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Container Apps Review",
- "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"services": [
- "TrafficManager",
- "FrontDoor"
+ "WAF"
],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
"services": [
- "Entra"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Entra ID",
- "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
- "waf": "Reliability"
+ "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
"services": [
- "Entra"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "AAD B2C",
- "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
- "waf": "Reliability"
+ "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
"services": [
- "Entra"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "AAD B2C",
- "text": "Custom brand assets should be hosted on a CDN",
- "waf": "Performance"
+ "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "Entra"
+ "VM",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "AAD B2C",
- "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "severity": "High",
+ "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "Entra",
- "VM"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Windows Server AD",
- "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "severity": "High",
+ "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"services": [
- "Entra"
+ "VPN",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Windows Server AD",
- "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"services": [
- "Entra"
+ "Storage",
+ "AVS",
+ "WAF",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Windows Server AD",
- "text": "Have active-active for multi-regions",
+ "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"services": [
- "Entra"
+ "Storage",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Entra Domain Services",
- "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"services": [
- "Entra"
+ "Storage",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Entra Domain Services",
- "text": "Use Replica Sets for DR",
+ "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
"waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
"service": "AVS",
"services": [
- "Entra",
- "AVS",
- "Subscriptions"
+ "ASR",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
- "waf": "Security"
+ "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
"service": "AVS",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
- "waf": "Security"
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
"service": "AVS",
"services": [
- "Entra",
- "AVS"
+ "WAF",
+ "ExpressRoute"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
- "waf": "Security"
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
"service": "AVS",
"services": [
- "Entra",
- "AVS"
+ "WAF",
+ "ExpressRoute"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
- "waf": "Security"
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
"service": "AVS",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
- "waf": "Security"
+ "severity": "High",
+ "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
- "waf": "Security"
+ "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Has an RBAC model been created for use within VMware vSphere",
- "waf": "Security"
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
- "waf": "Security"
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "AppSvc",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
- "waf": "Security"
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "AppSvc",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
- "waf": "Security"
+ "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
"services": [
- "VPN",
- "Monitor",
- "AVS",
- "ExpressRoute",
- "NetworkWatcher"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "severity": "Medium",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
"waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "WAF checklist",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"services": [
- "VM",
- "Monitor",
- "AVS",
- "ExpressRoute",
- "NetworkWatcher"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
- "waf": "Operations"
+ "text": "Follow reliability support recommendations in Azure Bot Service",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "WAF checklist",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
"services": [
- "Monitor",
- "AVS",
- "NetworkWatcher",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
- "waf": "Operations"
+ "text": "Deploying bots with local data residency and regional compliance",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "WAF checklist",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
"services": [
- "ARS",
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Routing",
- "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security (identity)",
- "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "TrafficManager",
+ "FrontDoor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security (identity)",
- "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (identity)",
- "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
- "waf": "Security"
+ "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security (identity)",
- "text": "Limit use of CloudAdmin account to emergency access only",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use more than 1 app instance for your apps",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (identity)",
- "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
- "waf": "Security"
+ "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (identity)",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
- "waf": "Security"
+ "text": "Set up autoscaling in Spring Cloud Gateway",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "AVS",
- "VM"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security (identity)",
- "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "WAF checklist",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (network)",
- "text": "Is East-West traffic filtering implemented within NSX-T",
- "waf": "Security"
+ "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"services": [
- "AppGW",
- "AVS",
- "Firewall"
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Security (network)",
- "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
+ "severity": "Medium",
+ "text": "Consider the 'Azure security baseline for storage'",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "PrivateLink",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security (network)",
- "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "text": "Consider using private endpoints for Azure Storage",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "Storage",
+ "Subscriptions",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Security (network)",
- "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"services": [
- "VPN",
- "AVS",
- "ExpressRoute",
- "DDoS",
- "VNet"
+ "Defender",
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security (network)",
- "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "severity": "High",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (network)",
- "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "text": "Enable 'soft delete' for blobs",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "Defender"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security (guest/VM)",
- "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "text": "Disable 'soft delete' for blobs",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"services": [
- "Arc",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security (guest/VM)",
- "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "severity": "High",
+ "text": "Enable 'soft delete' for containers",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"services": [
- "SQL",
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Security (guest/VM)",
- "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "severity": "Medium",
+ "text": "Disable 'soft delete' for containers",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"services": [
- "AKV",
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Security (guest/VM)",
- "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "severity": "High",
+ "text": "Enable resource locks on storage accounts",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "Subscriptions",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Security (guest/VM)",
- "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "severity": "High",
+ "text": "Consider immutable blobs",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Governance (platform)",
- "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
- "waf": "Reliability"
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "AzurePolicy",
- "Storage"
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Governance (platform)",
- "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
- "waf": "Reliability"
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "ASR"
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Governance (platform)",
- "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Governance (platform)",
- "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "AzurePolicy"
+ "Storage",
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Governance (platform)",
- "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Microsoft Entra ID tokens for blob access",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"services": [
- "Cost",
- "AVS"
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Governance (platform)",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
- "waf": "Cost"
+ "text": "Least privilege in IaM permissions",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
"services": [
- "Cost",
- "AVS"
+ "Entra",
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Governance (platform)",
- "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
- "waf": "Cost"
+ "severity": "High",
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Monitor",
+ "AKV",
+ "Storage",
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Governance (platform)",
- "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "severity": "High",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "AzurePolicy",
+ "Monitor",
+ "AKV",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Governance (platform)",
- "text": "Ensure all required resource reside within the same Azure availability zone(s)",
- "waf": "Performance"
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "VM",
- "Defender"
+ "AKV",
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Governance (guest/VM)",
- "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"services": [
- "Arc",
- "AVS",
- "VM"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Governance (guest/VM)",
- "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "text": "Consider configuring an SAS expiration policy",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "AKV",
+ "Storage",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Governance (guest/VM)",
- "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Consider linking SAS to a stored access policy",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS",
- "VM"
+ "AKV",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Governance (guest/VM)",
- "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
- "waf": "Operations"
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"services": [
- "Backup",
- "AVS",
- "AzurePolicy",
- "VM"
+ "Storage",
+ "Entra",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Governance (guest/VM)",
- "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS",
- "Defender"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Compliance",
- "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "severity": "High",
+ "text": "Strive for short validity periods for ad-hoc SAS",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "Defender"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Compliance",
- "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "text": "Apply a narrow scope to a SAS",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "severity": "Medium",
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "severity": "Low",
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
"waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "Entra",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Compliance",
- "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "severity": "High",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
"waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "waf": "Operations"
+ "text": "Avoid overly broad CORS policies",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
- "waf": "Operations"
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Determine which/if platform encryption should be used.",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
- "waf": "Operations"
+ "text": "Determine which/if client-side encryption should be used.",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Monitoring",
- "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "AzurePolicy",
- "VM",
- "Storage"
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Operations",
- "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
- "waf": "Operations"
+ "text": "Leverage a storagev2 account type for better performance and reliability",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"services": [
- "AVS"
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Operations",
- "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"services": [
- "AVS",
- "Backup",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "waf": "Operations"
+ "text": "For write operation after failover, use customer-Managed Failover ",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"services": [
- "Arc",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
- "waf": "Operations"
+ "text": "Understand Microsoft-Managed Failover details",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"services": [
- "Monitor",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "waf": "Operations"
+ "text": "Enable Soft Delete",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Operations",
- "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"services": [
- "Monitor",
- "AVS",
- "AzurePolicy"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "waf": "Operations"
+ "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
"services": [
- "AVS",
- "Defender"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
- "waf": "Security"
+ "severity": "High",
+ "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"services": [
- "AVS",
- "Backup"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
+ "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"services": [
- "AVS",
- "ASR"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
+ "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"services": [
- "AVS",
- "ASR"
+ "TrafficManager",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
+ "text": "Use Azure Traffic Manager to coordinate requests",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "WAF checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"services": [
- "AVS",
- "ASR"
+ "Backup",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
+ "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
+ "service": "Cognitive Services",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
+ "text": "Leverage FTA HandBook for Cognitive Services",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Cognitive Services",
"services": [
- "AVS",
- "ASR"
+ "Backup",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
+ "severity": "Medium",
+ "text": "Backup Your Prompts",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Cognitive Services",
"services": [
- "ExpressRoute",
- "AVS",
"ASR",
- "NVA"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
+ "severity": "High",
+ "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
+ "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
+ "service": "Cognitive Services",
"services": [
- "AVS",
- "Backup"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
+ "text": "Backup Your ChatGPT conversations",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
+ "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
+ "service": "Cognitive Services",
"services": [
- "AVS",
- "Backup"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
+ "text": "CI/CD for custom speech",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "WAF checklist",
+ "guid": "3687a046-7a1f-4893-9bda-43324f248116",
+ "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
+ "service": "Cognitive Services",
"services": [
- "AVS",
- "Backup"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Deploy your backup solution outside of vSan, on Azure native components",
+ "severity": "Low",
+ "text": "Move a knowledge base using export-import",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "WAF checklist",
+ "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
+ "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
+ "service": "Container Apps",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Business Continuity",
- "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable",
"waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "WAF checklist",
+ "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
+ "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
+ "service": "Container Apps",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Deployment strategy",
- "text": "For manual deployments, all configuration and deployments must be documented",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use more than one replica and enable Zone Redundancy.",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "WAF checklist",
+ "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Deployment strategy",
- "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
- "waf": "Operations"
+ "severity": "High",
+ "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "WAF checklist",
+ "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [
- "AVS"
+ "TrafficManager",
+ "FrontDoor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Deployment",
- "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
+ "service": "CosmosDB",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Deployment",
- "text": "For automated deployments, request or reserve quota prior to starting the deployment",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "FTA Resiliency Playbook",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
- "AVS",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Deployment",
- "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
+ "service": "CosmosDB",
"services": [
- "AKV",
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Connectivity",
- "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Run multiple replicas of the database (>1 ) in Prod",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
+ "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
+ "service": "CosmosDB",
"services": [
- "ExpressRoute",
- "AKV",
- "AVS"
+ "ACR",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Connectivity",
- "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Leverage Multi-Region Writes",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Span Cosmos account across two or more regions with multi-region writes",
+ "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
- "AVS"
+ "ACR",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Connectivity",
- "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Distribute your data globally",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
+ "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
+ "service": "CosmosDB",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Automated Connectivity",
- "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Choose from several well-defined consistency models",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
+ "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+ "service": "CosmosDB",
"services": [
- "AVS",
- "Subscriptions"
+ "CosmosDB",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "waf": "Performance"
+ "text": "Enable Service managed failover",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
+ "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
+ "service": "CosmosDB",
"services": [
- "AVS",
- "AzurePolicy",
- "Storage"
+ "Backup",
+ "Storage",
+ "CosmosDB",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "waf": "Performance"
+ "text": "Enable Automatic Backups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
+ "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "AVS"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "waf": "Performance"
+ "text": "Perform Periodic Backups",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "WAF checklist",
+ "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
+ "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "AVS"
+ "CosmosDB",
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
- "waf": "Performance"
+ "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Reliability"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
"services": [
- "AVS"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "waf": "Performance"
+ "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "category": "Platform Automation",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
"services": [
- "Monitor",
- "AVS"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "waf": "Operations"
+ "text": "check backup instances with the underlying datasource not found",
+ "waf": "Cost"
},
{
- "category": "Migration",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
"services": [
- "AVS",
- "VM"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "waf": "Cost"
},
{
- "category": "Migration",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
"services": [
- "AVS"
+ "Backup",
+ "Storage",
+ "WAF",
+ "ASR"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
+ "waf": "Cost"
},
{
- "category": "Migration",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
"services": [
- "VPN",
- "AVS"
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
- "waf": "Performance"
+ "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Cost"
},
{
- "category": "Migration",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "WAF checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
"services": [
- "AVS"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
- "waf": "Performance"
+ "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Cost"
},
{
- "category": "Migration",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
"services": [
- "AVS"
+ "Backup",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Process",
- "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
- "waf": "Reliability"
+ "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Cost"
},
{
- "category": "Data Storage",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
"services": [
- "AVS",
- "VM",
- "Storage"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Architecture",
- "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
- "waf": "Reliability"
+ "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Cost"
},
{
- "category": "Data Storage",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
"services": [
- "ExpressRoute",
- "AVS",
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Architecture",
- "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "Make sure advisor is configured for VM right sizing ",
+ "waf": "Cost"
},
{
- "category": "Data Storage",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "check by searching the Meter Category Licenses in the Cost analysys",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
"services": [
- "ExpressRoute",
- "AVS",
- "Storage"
+ "Cost",
+ "VM",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Architecture",
- "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
+ "waf": "Cost"
},
{
- "category": "Stretched Cluster",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
"services": [
- "AVS",
- "ASR"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Cost"
},
{
- "category": "Stretched Cluster",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
"services": [
- "AVS"
+ "VM",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Cost"
},
{
- "category": "Stretched Cluster",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
"services": [
- "ExpressRoute",
- "AVS"
+ "Cost",
+ "ARS",
+ "WAF",
+ "VM"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
+ "waf": "Cost"
},
{
- "category": "Stretched Cluster",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
"services": [
- "ExpressRoute",
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Only larger disks can be reserved => 1 TiB -",
+ "waf": "Cost"
},
{
- "category": "Stretched Cluster",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Architecture",
- "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "After the right-sizing optimization",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "WAF checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
"services": [
- "ACR"
+ "SQL",
+ "Cost",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
- "waf": "Reliability"
+ "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
- "waf": "Reliability"
+ "text": "Consider using a VMSS to match demand rather than flat sizing",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "WAF checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
"services": [
- "ASR"
+ "AKS",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
- "waf": "Reliability"
+ "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
- "services": [],
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "services": [
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "services": [],
- "severity": "High",
- "subcategory": "Availablity Zone",
- "text": "Use zone redundant pipelines in regions that support Availability Zones",
- "waf": "Reliability"
+ "text": "Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
"services": [
- "Backup"
+ "VM",
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "DevOps Integration",
- "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
- "waf": "Reliability"
+ "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
"services": [
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Network",
- "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
- "waf": "Reliability"
+ "text": "Functions - Reuse connections",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
"services": [
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Network",
- "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
- "waf": "Reliability"
+ "text": "Functions - Cache data locally",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Cost"
},
{
- "category": "Governance and Security",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
"services": [
- "AKV"
+ "Storage",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Integration",
- "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "974a759c-763e-47d2-9161-3a7649907e0e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ASB_v1.docx",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage FTA Handbook.",
- "waf": "Reliability"
+ "text": "Functions - Keep your functions warm",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "49907e0e-338e-4e25-9c17-d32e8aaab757",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/operational-excellence",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Implement geo-replication on the sender and receiver side to protect against outages and disasters",
- "waf": "Reliability"
+ "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "1549ab81-53d8-49f8-ad17-b84b33b5a67f",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
"services": [
- "ServiceBus",
- "Storage",
- "ASR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "If you need mission-critical messaging with queues and topics, Service Bus Premium is recommended with Geo-Disaster Recovery.",
- "waf": "Reliability"
+ "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "7b9ed5b3-1f38-4c40-9a82-2c2463cf0f18",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Implement high availability for the Service Bus namespace",
- "waf": "Reliability"
+ "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "ac699ef1-d5a8-43de-9de3-2c1881470607",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "WAF checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
"services": [
- "ServiceBus"
+ "FrontDoor",
+ "EventHubs",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Ensure related messages are delivered in guaranteed order",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "c5c0e4e6-1465-48d2-958e-d67139b82110",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "WAF checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
"services": [
- "ServiceBus"
+ "AppSvc",
+ "FrontDoor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Best Practices",
- "text": "Evaluate different Java Messaging Service (JMS) features through the JMS API",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "2df26ee4-11e6-4f88-9e52-f4722dd68c5b",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
"services": [
- "ServiceBus"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Best Practices",
- "text": "Use .NET Nuget packages to communicate with Service Bus messaging entities",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider archiving tiers for less used data",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "5c2521e5-4a69-4b9d-939a-c4e7c68d1d75",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Implement resilience for transient fault handling when sending or receiving messages",
- "waf": "Reliability"
+ "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "description": "This will be turned on automatically for a new SB namespace created from the portal with the Premium SKUs in a zone-enabled region. Both the Service Bus metadata and the messages data are replicated across datacenters in the availability zones configuration",
- "guid": "338ee253-c17d-432e-aaaa-b7571549ab81",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#availability-zones",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
"services": [
- "ACR",
- "ServiceBus"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider using standard SSD rather than Premium or Ultra where possible",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "description": "If enabled, Implements namespace metadata replication to a secondary region. Does not replicate queue/topic message data. Premium sku only.",
- "guid": "53d89f89-d17b-484b-93b5-a67f7b9ed5b3",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
"services": [
- "ServiceBus",
"Storage",
- "ASR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Geo-Disaster Recovery",
- "text": "Plan for Metadata replication during regional failure",
- "waf": "Reliability"
+ "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "description": "If an outage cannot be tolerated, do not use the build-in metadata replication option. Leverage a replication pattern to replicate Service Bus messages across two or more sets of cross-region namespaces",
- "guid": "1f38c403-a822-4c24-93cf-0f18ac699ef1",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-federation-overview",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
"services": [
- "ACR",
- "ServiceBus",
- "ASR"
+ "ASR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Geo-Disaster Recovery",
- "text": "Plan for Message replication during regional failure",
- "waf": "Reliability"
+ "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus uses a message broker to handle messages that are sent to a Service Bus queue or topic. By default, all messages that are sent to a queue or topic are handled by the same message broker process. This architecture can place a limitation on the overall throughput of the message queue. However, you can also partition a queue or topic when it is created",
- "guid": "d5a83de4-de32-4c18-a147-0607c5c0e4e6",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/data-partitioning-strategies#partitioning-azure-service-bus",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
"services": [
- "ServiceBus",
- "Storage"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "For applications which require high throughput, use Patritioning ",
- "waf": "Reliability"
+ "text": "Storage accounts: check hot tier and/or GRS necessary",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "14658d24-58ed-4671-99b8-21102df26ee4",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Evaluate Premier-tier benefits of Azure Service Bus",
- "waf": "Reliability"
+ "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "11e6f883-e52f-4472-8dd6-8c5b5c2521e5",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-messaging-exceptions",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
"services": [
- "ServiceBus"
+ "EventHubs",
+ "Cost",
+ "WAF",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Ensure that Service Bus Messaging Exceptions are handled properly",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
"services": [
- "ServiceBus",
- "PrivateLink",
- "Storage"
+ "Storage",
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Connect to Service Bus with the Advanced Messaging Queue Protocol (AMQP) and use Service Endpoints or Private Endpoints when possible.",
- "waf": "Reliability"
+ "text": "Export cost data to a storage account for additional data analysis.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Service Bus Review Checklist",
- "guid": "f4564b4d-974a-4759-a763-e7d261613a76",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-performance-improvements?tabs=net-standard-sdk-2",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
"services": [
- "ServiceBus"
+ "SQL",
+ "Cost",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Review the Best Practices for performance improvements using Service Bus Messaging",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
"services": [
- "ServiceBus"
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Data Protection",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
"services": [
- "ServiceBus"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Security"
+ "text": "Create multiple Apache Spark pool definitions of various sizes.",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "WAF checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
"services": [
- "TrafficManager",
- "ServiceBus",
- "AzurePolicy",
- "RBAC",
- "Entra"
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
- "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
"services": [
- "ServiceBus",
- "Entra"
+ "Cost",
+ "WAF",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
"services": [
- "Storage",
- "ServiceBus",
- "RBAC",
- "Entra",
- "Subscriptions"
+ "VM",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Right-sizing all VMs",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
"services": [
- "ServiceBus",
- "Monitor",
- "VNet"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Swap VM sized with normalized and most recent sizes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
- "ServiceBus",
- "PrivateLink",
- "VNet"
+ "VM",
+ "WAF",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "category": "Security",
- "checklist": "Service Bus Review Checklist",
- "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
- "ServiceBus"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Device Provisioning Service Review",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "WAF checklist",
"guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
"link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
"service": "IoT Hub DPS",
- "services": [],
+ "services": [
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
"text": "Select the right Logic App hosting plan based on your business & SLO requirements",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Device Provisioning Service Review",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "WAF checklist",
"guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
"link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
"service": "IoT Hub DPS",
- "services": [],
+ "services": [
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
"text": "Protect logic apps from region failures with zone redundancy and availability zones",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Device Provisioning Service Review",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "WAF checklist",
"guid": "8aed4fbf-0830-4883-899d-222a154af478",
"link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
"service": "IoT Hub DPS",
- "services": [],
+ "services": [
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
"text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Device Provisioning Service Review",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "WAF checklist",
"guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
"link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
"service": "IoT Hub DPS",
"services": [
- "AppSvc"
+ "AppSvc",
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
"text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
"waf": "Reliability"
},
{
- "category": "Application Deployment",
- "checklist": "Device Provisioning Service Review",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "WAF checklist",
"guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
"link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
"service": "IoT Hub DPS",
- "services": [],
- "severity": "Medium",
- "subcategory": "CI/CD",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b",
- "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
- "services": [
- "AVS",
- "Backup",
- "Storage"
- ],
- "severity": "Medium",
- "subcategory": "Backup",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Microsoft backup service",
- "guid": "fc8af7a1-c724-e255-c18d-4ca22a6f27f0",
- "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
- "services": [
- "AVS",
- "Backup"
- ],
- "severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Use MABS as your backup solution",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Best practice - this is Backup, not disaster recovery",
- "guid": "be28860f-3d29-a79a-1a0e-36f1b23b36ae",
- "link": "Best practice to deploy backup in the same region as your AVS deployment",
- "services": [
- "AVS",
- "Backup",
- "ASR"
- ],
- "severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Best practice - in case AVS is unavailable",
- "guid": "4d2f79a5-4ccf-0dfc-557c-49619b99a540",
- "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
- "services": [
- "AVS"
- ],
- "severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Preferably deploy MABS outside of the SDDC as native Azure IaaS",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
- "guid": "ff431c40-962c-5182-d536-0c2f0c4ce9e0",
- "link": "Will Disaster Recovery Site Recovery, HCX Disaster Recovery, SRM or back tools be used?",
- "services": [
- "AVS"
- ],
- "severity": "Medium",
- "subcategory": "Business Continuity",
- "text": "Escalation process with Microsoft in the event of a regional DR",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Compare SRM with HCX",
- "guid": "f379436d-3051-daa0-01fb-dc4e0e04d677",
- "link": "https://docs.microsoft.com/azure/azure-vmware/disaster-recovery-using-vmware-site-recovery-manager",
- "services": [
- "AVS",
- "ASR"
- ],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use VMware Site Recovery Manager when both sites are Azure VMware Solution",
- "waf": "Reliability"
- },
- {
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Recovery into Azure instead of Vmware solution",
- "guid": "367f71d8-3cf6-51a0-91a5-3db3d570cc19",
- "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
- "waf": "Reliability"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Avoid manual tasks as much as possible",
- "guid": "ee02ada0-1887-bb3a-b84c-423f45a09ef9",
- "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "WAF checklist",
+ "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use Automated recovery plans with either of the Disaster solutions,",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Any other datacenter in the same region",
- "guid": "0c2b74e5-9c28-780d-1df3-12d3de4aaa76",
- "link": "https://docs.microsoft.com/azure/azure-vmware/connect-multiple-private-clouds-same-region",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "WAF checklist",
+ "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Configure a secondary disaster recovery environment",
+ "severity": "High",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
- "guid": "c2a34ec4-2933-4e6c-dc36-e20e67abbe3f",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "WAF checklist",
+ "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Device Update for IoT Hub",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Assign IP ranges unique to each region",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "category": "BCDR",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "ExpressRoute Global Reach can be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or routing must be done through network virtual appliances?",
- "guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c",
- "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "WAF checklist",
+ "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Device Update for IoT Hub",
"services": [
- "ExpressRoute",
- "AVS",
- "ASR",
- "NVA"
+ "AppSvc",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Use Global Reach between DR regions",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
"waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "An ExR Global Reach connection will be established to the ExR circuit, no other connections",
- "guid": "a2c12df2-07fa-3edd-2cec-fda0b55fb952",
- "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud",
- "services": [
- "VWAN",
- "AVS"
- ],
- "severity": "Medium",
- "subcategory": "Direct (no vWAN, no H&S)",
- "text": "Global Reach to ExR circuit - no Azure resources",
- "waf": "Performance"
- },
- {
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use ExR to connect on-premises (other) location to Azure",
- "guid": "f62ce162-ba5a-429d-674e-fafa1af5f706",
- "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud",
- "services": [
- "ExpressRoute",
- "AVS"
- ],
- "severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "Connect to Azure using ExR",
- "waf": "Performance"
- },
- {
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use the migration assesment tool and timeline to determine bandwidth required",
- "guid": "cf01c73b-1247-0a7a-740c-e1ea29bda340",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-introduction",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
"services": [
- "ExpressRoute",
- "AVS"
+ "EventHubs",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "Bandwidth sizing",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "What traffic is routed through a firewall, what goes directly into Azure",
- "guid": "aab216ee-8941-315e-eada-c7e1f2243bd1",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"services": [
- "ExpressRoute",
- "AVS"
+ "EventHubs",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "Traffic routing ",
- "waf": "Performance"
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "AVS to ExR circuit, no traffic inspection",
- "guid": "1f956e45-f62d-5c95-3a95-3bab718907f8",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"services": [
- "ExpressRoute",
- "AVS"
+ "EventHubs",
+ "AzurePolicy",
+ "TrafficManager",
+ "Entra",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "Global Reach ",
- "waf": "Performance"
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Name of the vNet and a unique address space /24 minimum",
- "guid": "91f7a87b-21ac-d712-959c-8df2ba034253",
- "link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"services": [
- "AVS",
- "VNet"
+ "EventHubs",
+ "VM",
+ "AKV",
+ "Storage",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "VNet name & address space",
- "waf": "Performance"
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Subnet must be called GatewaySubnet",
- "guid": "58a027e2-f37f-b540-45d5-e44843aba26b",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"services": [
- "ExpressRoute",
- "VNet",
- "AVS",
- "VPN"
+ "EventHubs",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "Gateway subnet",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Create a VPN gateway on the hub Gateway subnet",
- "guid": "d4806549-0913-3e79-b580-ac2d3706e65a",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
"services": [
- "VPN",
- "ExpressRoute",
- "AVS",
+ "EventHubs",
+ "Monitor",
+ "WAF",
"VNet"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "VPN Gateway",
- "waf": "Performance"
+ "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Create an ExR Gateway in the hub Gateway subnet.",
- "guid": "864d7a8b-7016-c769-a717-61af6bfb73d2",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
- "services": [
- "ExpressRoute",
- "VNet",
- "AVS",
- "VPN"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
+ "services": [
+ "PrivateLink",
+ "EventHubs",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "ExR Gateway",
- "waf": "Performance"
+ "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "How will Internet traffic be routes, Az Firewall, NVA, Secure Hub, On-Premises firewall?",
- "guid": "cc2e11b9-7911-7da1-458c-d7fcef794aad",
- "link": "https://learn.microsoft.com/azure/azure-vmware/enable-public-internet-access",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"services": [
- "AVS",
- "NVA"
+ "EventHubs",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Egress point",
- "waf": "Performance"
+ "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Allow remote connectivity to AVS via the portal, specifically to vCenter, NSX-T and HCX",
- "guid": "71e68ce3-982e-5e56-0191-01100ad0e66f",
- "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"services": [
- "AVS",
- "Bastion"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Jumpbox & Bastion",
- "text": "Remote connectivity to AVS",
- "waf": "Performance"
+ "text": "Leverage FTA Resillency HandBook",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Name the jumpbox and identify the subnet where it will be hosted",
- "guid": "6f8e93a2-44b1-bb1d-28a1-4d5b3c2ea857",
- "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"services": [
- "AVS",
- "Bastion",
- "VNet"
+ "ACR",
+ "EventHubs",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Jumpbox & Bastion",
- "text": "Configure a jumbox and Azure Bastion",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Provides secure / seamless RDP/SSH connectivity to your vm's directly through the portal.",
- "guid": "ba430d58-4541-085c-3641-068c00be9bc5",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"services": [
- "AVS",
- "VM",
- "Bastion"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Jumpbox & Bastion",
- "text": "Security measure allowing RDP access via the portal",
- "waf": "Performance"
+ "text": "Use the Premium or Dedicated SKUs for predicable performance",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Using a VPN to connect to Azure to enable VMware communications (HCX) (not recommended)",
- "guid": "9988598f-2a9f-6b12-9b46-488415ceb325",
- "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"services": [
- "VPN",
- "AVS"
+ "EventHubs",
+ "ASR",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "VPN",
- "text": "Connect to Azure using a VPN",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use the migration assesment tool and timeline to determine bandwidth required (eg 3rd party tool in link)",
- "guid": "956ce5e9-a862-fe2b-a50d-a22923569357",
- "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"services": [
- "VPN",
- "AVS"
+ "EventHubs",
+ "WAF",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "VPN",
- "text": "Bandwidth sizing",
- "waf": "Performance"
+ "text": "For Business Critical Applications, use Active Active configuration",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "What traffic is routed through a firewall, what goes directly into Azure",
- "guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"services": [
- "VPN",
- "AVS"
+ "EventHubs",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "VPN",
- "text": "Traffic routing ",
- "waf": "Performance"
+ "text": "Design Resilient Event Hubs",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Name and unique address space for the vWAN, name for the vWAN hub",
- "guid": "4dc480ac-cecd-39c4-fdc6-680b300716ab",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-site-to-site-portal#openvwan",
+ "checklist": "WAF checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"services": [
- "VWAN",
- "AVS"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "vWAN hub",
- "text": "vWAN name, hub name and address space",
- "waf": "Performance"
+ "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Select either boh or the appropriate connection type.",
- "guid": "51d6affd-8e02-6aea-d3d4-0baf618b3076",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal",
+ "checklist": "WAF checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"services": [
- "VPN",
- "VWAN",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "vWAN hub",
- "text": "ExR and/or VPN gateway provisioned",
- "waf": "Performance"
+ "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "waf": "Reliability"
},
{
- "category": "Connectivity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Add Azure firewall to vWAN (recommended)",
- "guid": "e32a4c67-3dc0-c134-1c12-52d46dcbab5b",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal",
+ "checklist": "WAF checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"services": [
- "VWAN",
- "AVS",
- "Firewall"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "vWAN hub",
- "text": "Secure vWAN",
- "waf": "Security"
+ "text": "Custom brand assets should be hosted on a CDN",
+ "waf": "Performance"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Active directory or other identity provider servers",
- "guid": "fbc47fbf-bc96-fa93-ed5d-8c9be63cd5c3",
- "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter",
+ "checklist": "WAF checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Access",
- "text": "External Identity (user accounts)",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Not required for LDAPS, required for Kerberos",
- "guid": "b5db7975-f6bb-8ba3-ee5f-e3e805887997",
- "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology",
+ "checklist": "WAF checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "Entra",
- "AVS"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Access",
- "text": "If using AD domain, ensure Sites & Services has been configured",
- "waf": "Security"
+ "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Authentication for users, must be secure.",
- "guid": "c30749c4-e2af-558c-2eb9-0b6ae84881d1",
- "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter",
+ "checklist": "WAF checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Access",
- "text": "Use LDAPS not ldap ( vCenter)",
- "waf": "Security"
+ "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Authentication for users, must be secure.",
- "guid": "64cb9b5c-9edd-787e-1dd8-2b2338e51635",
- "link": "https://learn.microsoft.com/azure/azure-vmware/configure-external-identity-source-nsx-t",
+ "checklist": "WAF checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "Entra",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Access",
- "text": "Use LDAPS not ldap (NSX-T)",
- "waf": "Security"
+ "text": "Have active-active for multi-regions",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "CN or SAN names, no wildcards, contains private key - CER or PFX",
- "guid": "bec285ab-037e-d629-81d1-f61dac23cd4c",
- "link": "https://youtu.be/4jvfbsrhnEs",
+ "checklist": "WAF checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
"Entra",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Security certificate installed on LDAPS servers ",
- "waf": "Security"
+ "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Standard Azure Roles Based Access Controls",
- "guid": "4ba394a2-3c33-104c-8e34-2dadaba9cc73",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity",
+ "checklist": "WAF checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "RBAC applied to Azure roles",
- "waf": "Security"
+ "text": "Use Replica Sets for DR",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Create roles in vCenter required to meet minimum viable access guidelines",
- "guid": "b04ca129-83a9-3494-7512-347dd2d766db",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "WAF checklist",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "RBAC model in vCenter",
- "waf": "Security"
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
- "guid": "8e477d2f-8004-3dd0-93d6-0aece9e1b2fb",
- "link": "Best practice",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "WAF checklist",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "CloudAdmin role usage",
- "waf": "Security"
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "For roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
- "guid": "00e0b729-f9be-f600-8c32-5ec0e8f2ed63",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "WAF checklist",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security ",
- "text": "Is Privileged Identity Management implemented",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "For the Azure VMware Solution PIM roles",
- "guid": "0842d45f-41a8-8274-1155-2f6ed554d315",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "WAF checklist",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"services": [
- "Entra",
- "AVS",
- "RBAC"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security ",
- "text": "Is Privileged Identity Management audit reporting implemented",
- "waf": "Security"
+ "severity": "High",
+ "text": "Learn how to trigger a manual failover.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Best practice, also see Monitoring/Alerts",
- "guid": "915cbcd7-0640-eb7c-4162-9f33775de559",
- "link": "Best practice",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "WAF checklist",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
"services": [
- "Monitor",
- "Entra",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security ",
- "text": "Limit use of CloudAdmin account to emergency access only",
- "waf": "Security"
+ "severity": "High",
+ "text": "Learn how to fail back after a failover.",
+ "waf": "Reliability"
},
{
- "category": "Identity",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Operational procedure",
- "guid": "7effa0c0-9172-e8e4-726a-67dbea8be40a",
- "link": "https://learn.microsoft.com/azure/azure-vmware/rotate-cloudadmin-credentials?tabs=azure-portal",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Entra",
- "AVS"
+ "AKV",
+ "Backup",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security ",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
- "waf": "Security"
+ "severity": "High",
+ "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
- "guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82",
- "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
"services": [
- "Arc",
- "AVS",
- "VM"
+ "AKV",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "AVS VM Management (Azure Arc)",
- "waf": "Operations"
+ "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "guid": "11dbe773-e380-9191-1418-e886fa7a6fd0",
- "link": "https://docs.microsoft.com/azure/governance/policy/overview",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
"services": [
- "Monitor",
- "AVS",
- "AzurePolicy"
+ "AKV",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Azure policy",
- "waf": "Operations"
+ "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
- "guid": "1e59c639-9b7e-a60b-5e93-3798c1aff5db",
- "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json#configure-locks",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
"services": [
- "AVS"
+ "AKV",
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Resource locks",
- "waf": "Operations"
+ "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "For manual deployments, all configuration and deployments must be documented",
- "guid": "8f2c46aa-ca1b-cad3-3ac9-213dfc0a265e",
- "link": "Make sure to create your own runbook on the deployment of AVS.",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
"services": [
- "AVS"
+ "AKV",
+ "Backup",
+ "Storage",
+ "Subscriptions",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Run books",
- "waf": "Operations"
+ "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
"AKV",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Operations",
- "text": "Naming conventions for auth keys",
- "waf": "Operations"
+ "severity": "High",
+ "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "For automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "guid": "e22a2d99-eb71-7d7c-07af-6d4cdb1d4443",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
- "Monitor",
- "AVS"
+ "AKV",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Alerts",
- "text": "Create warning alerts for critical thresholds ",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "guid": "6d02f159-627d-79bf-a931-fab6d947eda2",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "Monitor",
- "AVS"
+ "AKV",
+ "Backup",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Alerts",
- "text": "Create critical alert vSAN consumption",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Provides platform alerts (generated by Microsoft)",
- "guid": "1cc97b39-2c7e-246f-6d73-789cfebfe951",
- "link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "Monitor",
- "AVS"
+ "AKV",
+ "Backup",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Alerts",
- "text": "Configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509",
- "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"services": [
- "AzurePolicy",
- "VM",
- "Monitor",
- "AVS",
- "Backup"
+ "AKV",
+ "EventHubs",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Backup policy",
- "waf": "Operations"
+ "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Keep in mind the lead time for requesting new nodes",
- "guid": "4ec7ccfb-795e-897e-4a84-fd31c04eadc6",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"services": [
- "Monitor",
- "AVS",
- "AzurePolicy"
+ "AKV",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Capacity",
- "text": "Policy around ESXi host density and efficiency",
- "waf": "Operations"
+ "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
+ "waf": "Security"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Azure Cost Management can be used - one option, put AVS in it's own Subscription. ",
- "guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"services": [
- "Cost",
- "Monitor",
- "AVS",
- "Subscriptions"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Costs",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - ",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "guid": "01e689e0-7c6c-b58f-37bd-4d6b9b1b9c74",
- "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
"services": [
- "Monitor",
- "AVS",
- "NetworkWatcher"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Dashboard",
- "text": "Connection monitor dashboard",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Send to an Azure Storage account or Azure EventHub for processing (direct to Log Analytics is pending)",
- "guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"services": [
- "Monitor",
- "AVS",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Logs & Metrics",
- "text": "Configure Azure VMware Solution logging ",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Must be on-premises, implement if available",
- "guid": "7cbac8c3-4eda-d5d9-9bda-c6b5abba9fb6",
- "link": "Is vROPS or vRealize Network Insight going to be used? ",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"services": [
- "Monitor",
- "AVS"
+ "AppSvc",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Logs & Metrics",
- "text": "vRealize Operations",
- "waf": "Operations"
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "guid": "b243521a-644d-f865-7fb6-21f9019c0dd2",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"services": [
- "Monitor",
- "AVS",
- "VM"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Logs & Metrics",
- "text": "AVS VM logging",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
"waf": "Operations"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Between on-premises to Azure are monitored using 'connection monitor'",
- "guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"services": [
- "VPN",
- "Monitor",
- "AVS",
- "ExpressRoute",
- "NetworkWatcher"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Network",
- "text": "Monitor ExpressRoute and/or VPN connections ",
- "waf": "Operations"
+ "text": "Leverage Flexible Server",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "To monitor the Azure VMware Solution back-end ExpressRoute connection (Azure native to AVS)",
- "guid": "99209143-60fe-19f0-5633-8b5671277ba5",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"services": [
- "ExpressRoute",
- "Monitor",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Network",
- "text": "Monitor from an Azure native resource to an Azure VMware Solution VM",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "To monitor end-to-end, on-premises to AVS workloads",
- "guid": "b9e5867c-57d3-036f-fb1b-3f0a71664efe",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"services": [
- "Monitor",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Network",
- "text": "Monitor from an on-premises resource to an Azure VMware Solution VM",
- "waf": "Operations"
+ "text": "Leverage Data-in replication for cross-region DR scenarios",
+ "waf": "Reliability"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Track requests to Azure VMware Solution and Azure VMware Solution based workloads",
- "guid": "4af7c5f7-e5e9-bedf-a8cf-314b81735962",
- "link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
"services": [
- "Monitor",
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Auditing and logging is implemented for inbound internet ",
- "waf": "Operations"
+ "text": "Ensure you are using Application Gateway v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
- "guid": "74be60a3-cfac-f057-eda6-3ee087e805d5",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
"services": [
- "Monitor",
- "AVS"
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Session monitoring ",
- "waf": "Operations"
+ "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
+ "waf": "Security"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "guid": "a434b3b5-f258-0845-cd76-d7df6ef5890e",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "WAF checklist",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
"services": [
- "Monitor",
- "AVS"
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "VMWare",
- "text": "Logging and diagnostics",
- "waf": "Operations"
+ "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "waf": "Security"
},
{
- "category": "Monitoring",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Monitor AVS workloads (each VM in AVS)",
- "guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a",
- "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
"services": [
- "Monitor",
- "AVS",
- "VM"
+ "AppGW",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "VMware",
- "text": "Log Analytics Agents deployed on Azure VMware Solution guest VM workloads",
- "waf": "Operations"
+ "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Decision on traffic flow",
- "guid": "a1354b87-e18e-bf5c-c50b-8ddf0540e971",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "VNet",
+ "NVA",
+ "Subscriptions",
+ "AppGW",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "North/South routing through Az Firewall or 3rd party ",
+ "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)",
- "guid": "29a8a499-ec31-f336-3266-0895f035e379",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/application-gateway/tutorial-protect-application-gateway-ddos",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF",
+ "DDoS"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "East West (Internal to Azure)",
+ "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Requires a 3rd party NVA with Azure Route server - Scenario 2 (see link)",
- "guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"services": [
- "ARS",
- "AVS",
- "NVA"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "ExR without Global Reach",
- "waf": "Operations"
+ "text": "Configure autoscaling with a minimum amount of instances of two.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "When route server is used, ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN",
- "guid": "ffb5c5ca-bd89-ff1b-8b73-8a54d503d506",
- "link": "https://learn.microsoft.com/azure/route-server/route-server-faq",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"services": [
- "ARS",
- "AVS"
+ "AppGW",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub & Spoke",
- "text": "Route server ",
- "waf": "Operations"
+ "text": "Deploy Application Gateway across Availability Zones",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Via on-premises, Az Firewall, 3rd Party, NSX-T pubic IP",
- "guid": "a4070dad-3def-818d-e9f7-be440d10e7de",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-design-public-internet-access",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "WAF checklist",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"services": [
- "AVS"
+ "AppGW",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Egress point(s)",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "WAF checklist",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
+ "services": [
+ "TrafficManager",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "WAF",
+ "AVD"
+ ],
+ "severity": "Low",
+ "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Az Firewall, 3rd party NVA, Application Gateway, Azure Frontdoor ",
- "guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937",
- "link": "Research and choose optimal solution for each application",
+ "checklist": "WAF checklist",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"services": [
- "AppGW",
- "AVS",
- "FrontDoor",
- "NVA"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Internet facing applications",
+ "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN",
- "guid": "e778a2ec-b4d7-1d27-574c-14476b167d37",
- "link": "https://docs.microsoft.com/azure/route-server/route-server-faq#route-server-limits",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
"services": [
- "ARS",
- "AVS"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Routing",
- "text": "When route server Route limit understood? ",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "(VPN Gateway, AppGW, FrontDoor, Load balancer, VMs (etc) (Remove: enabled on ExR/VPN Gateway subnet in Azure)",
- "guid": "66c97b30-81b9-139a-cc76-dd1d94aef42a",
- "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
"services": [
- "FrontDoor",
- "VPN",
- "VM",
- "ExpressRoute",
- "AVS",
- "LoadBalancer",
- "DDoS",
"AppGW",
- "VNet"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Is DDoS standard protection of public facing IP addresses? ",
+ "severity": "High",
+ "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "To manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
- "guid": "d43da920-4ecc-a4e9-dd45-a2986ce81d32",
- "link": "Best practice: Bastion or 3rd party tool",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AppGW",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Use a dedicated privileged access workstation (PAW)",
+ "severity": "High",
+ "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use NSX-T for inter-vmware-traffic inspection",
- "guid": "a2dac74f-5380-6e39-25e6-f13b99ece51f",
- "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-F6685367-7AA1-4771-927E-ED77727CFDA3.html",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AppGW",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Traffic Inspection",
- "text": "East West (Internal to AVS)",
+ "severity": "High",
+ "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Decision on whether or not to use Secure hub for E/W and Internet traffic - requires Global Reach",
- "guid": "3f621543-dfac-c471-54a6-7b2849b6909a",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
"services": [
- "VWAN",
- "AVS",
- "Firewall"
+ "AppGW",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Use Secure Hub (Azure Firewall or 3rd party)",
+ "severity": "High",
+ "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)",
- "guid": "d7af5670-1b39-d95d-6da2-8d660dfbe16b",
- "link": "https://learn.microsoft.com/azure/firewall-manager/secure-cloud-network",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"services": [
- "VWAN",
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "East West (Internal to Azure)",
+ "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
"waf": "Security"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "guid": "7d049005-eb35-4a93-50a5-3b31a9f61161",
- "link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
"services": [
- "AVS",
- "Subscriptions"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scale out operations planning",
- "waf": "Performance"
+ "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "waf": "Security"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
"services": [
- "AVS",
- "AzurePolicy",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scale in operations planning",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "guid": "3233e49e-62ce-97f3-8737-8230e771b694",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scale serialized operations planning",
- "waf": "Performance"
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Security"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
- "guid": "68161d66-5707-319b-e77d-9217da892593",
- "link": "Best practice (testing)",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scale rd operations planning",
- "waf": "Performance"
+ "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "waf": "Security"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "guid": "c32cb953-e860-f204-957a-c79d61202669",
- "link": "Operational planning - understand workload requirements",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Scale maximum operations planning",
- "waf": "Performance"
+ "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
+ "waf": "Operations"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "guid": "7bd65a5e-7b5d-652d-dbea-fc6f73a42857",
- "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"services": [
- "Monitor",
- "AVS"
+ "AppGW",
+ "Sentinel",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Automated Scale",
- "text": "Monitor scaling operations ",
- "waf": "Performance"
+ "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Consider the use of Azure Private-Link when using other Azure Native Services",
- "guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"services": [
- "PrivateLink",
- "AVS"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Private link",
- "waf": "Performance"
+ "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "category": "Other Services/Operations",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
- "guid": "71eff90d-5ad7-ac60-6244-2a6f7d3c51f2",
- "link": "Best practice",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Provisioning Vmware VLANs",
- "waf": "Performance"
+ "text": "Use WAF Policies instead of the legacy WAF configuration.",
+ "waf": "Operations"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "In which region will AVS be deployed",
- "guid": "04e3a2f9-83b7-968a-1044-2811811a924b",
- "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "ExpressRoute",
+ "VNet",
+ "VPN",
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Region selected",
- "waf": "Reliability"
+ "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Are there regulatory or compliance policies in play",
- "guid": "e52d1615-9cc6-565c-deb6-743ed7e90f4b",
- "link": "Internal policy or regulatory compliance",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways'| extend compliant = (properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443') |where properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443'|distinct id,name,compliant",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
"services": [
- "AVS",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Data residency compliant with selected regions",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "You should encrypt traffic to the backend servers.",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Request through the support blade",
- "guid": "92bd5ad6-441f-a983-7aa9-05dd669d760b",
- "link": "https://learn.microsoft.com/azure/migrate/concepts-azure-vmware-solution-assessment-calculation",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Request for number of AVS hosts submitted ",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "You should use a Web Application Firewall.",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "PG approval for deployment",
- "guid": "28370f63-1cb8-2e35-907f-c5516b6954fa",
- "link": "Support request through portal or get help from Account Team",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Region and number of AVS nodes approved",
- "waf": "Reliability"
+ "text": "Redirect HTTP to HTTPS",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Portal/subscription/resource providers/ Microsoft.AVS",
- "guid": "96c76997-30a6-bb92-024d-f4f93f5f57fa",
- "link": "Done through the subscription/resource providers/ AVS register in the portal",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
"services": [
- "AVS",
- "Subscriptions"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Resource provider for AVS registered",
- "waf": "Reliability"
+ "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
+ "waf": "Operations"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Connectivity, subscription & governanace model",
- "guid": "5898e3ff-5e6b-bee1-6f85-22fee261ce63",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
"services": [
- "AVS",
- "Subscriptions"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Landing zone architecture",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "The name of the RG where AVS will exist",
- "guid": "d0181fb8-9cb8-bf4b-f5e5-b5f9bf7ae4ea",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/manage-resource-groups-portal",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Resource group name selected",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Create custom error pages to display a personalized user experience",
+ "waf": "Operations"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Each resource created as part of the deployment will also utilize this prefix in the name",
- "guid": "0f0d20c2-5a19-726c-de20-0984e070d9d6",
- "link": "Best practice - naming standards",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Deployment prefix selected",
- "waf": "Reliability"
+ "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "/22 unique non-overlapping IPv4 address space",
- "guid": "7fbf2ab7-a36c-5957-c27a-67038557af2a",
- "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-network-checklist#routing-and-subnet-considerations",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Network space for AVS management layer",
- "waf": "Reliability"
+ "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
+ "waf": "Performance"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "vNets used by workloads running in AVS (non-stretched)",
- "guid": "0c87f999-e517-21ef-f355-f210ad4134d2",
- "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"services": [
- "AVS",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Network space for AVS NSX-T segments",
- "waf": "Reliability"
+ "text": "Use transport layer load balancing",
+ "waf": "Performance"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Choose AV36, AV36P, AV52, AV36T (AV36T = Trial)",
- "guid": "946c8966-f902-6f53-4f37-00847e8895c2",
- "link": "https://azure.microsoft.com/pricing/details/azure-vmware/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "AVS SKU (region dependent)",
- "waf": "Performance"
+ "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "waf": "Security"
},
- {
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use the Azure migration assessment tool to determine the minimum number of nodes required (consider BCDR as well)",
- "guid": "31833808-26ba-9c31-416f-d54a89a17f5d",
- "link": "https://learn.microsoft.com/azure/migrate/how-to-assess",
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"services": [
- "AVS"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Number of hosts to be deployed",
- "waf": "Performance"
+ "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Understand how and if you should be using reserved instances (cost control)",
- "guid": "f2b73c4f-3d46-32c9-5df1-5b8dfcd3947f",
- "link": "https://azure.microsoft.com/en-ca/pricing/details/azure-vmware/#:~:text=Azure%20VMware%20Solution%20%20%20%20Instance%20size,TB%20%28all%20NVMe%29%20%20%20N%2FA%20%2Fhour%20",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"services": [
- "Cost",
- "AVS"
+ "AppGW",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Reserverd Instances",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
+ "waf": "Security"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
- "guid": "94ac48ab-ade5-3fa7-f800-263feeb97070",
- "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
+ "service": "PostgreSQL",
"services": [
- "AVS",
- "ASR"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Capacity ",
- "waf": "Performance"
+ "text": "Leverage Flexible Server",
+ "waf": "Reliability"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Identify which of the networking scenarios make ",
- "guid": "1f9d4bd5-14b8-928c-b4cb-eb211f9b8de5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
+ "service": "PostgreSQL",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "Networking & Connectivity See docs describing scenrario 1 through 5",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
- "category": "Planning",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "guid": "070db19b-8a2a-fd6a-c39b-4488d8780da9",
- "link": "Please Check Partner Ecosystem",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "WAF checklist",
+ "guid": "31b67c67-be59-4519-8083-845d587cb391",
+ "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
+ "service": "PostgreSQL",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Pre-deployment",
- "text": "3rd party application compatibility ",
+ "text": "Leverage cross-region read replicas for BCDR",
"waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
- "guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646",
- "link": "General recommendation for storing encryption keys.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
+ "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
+ "service": "Purview",
"services": [
- "AKV",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Encryption",
- "text": "Use Azure Key Vault with in-guest encryption ",
- "waf": "Security"
+ "text": "Leverage FTA Resillency Handbook",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
- "guid": "c1a81638-18df-0ce9-a73a-4b9a8a8dd392",
- "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#data-at-rest-encryption",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "SQL",
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Encryption",
- "text": "Use in-guest encryption",
- "waf": "Security"
+ "severity": "High",
+ "text": "Plan for Data Center level outage",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "guid": "8d0a8f51-8d35-19cd-c2fe-4e3512fb467e",
- "link": "https://docs.microsoft.com/azure/key-vault/general/authentication",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
+ "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "ExpressRoute",
- "AKV",
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Encryption",
- "text": "Keyvault use for secrets",
- "waf": "Security"
+ "text": "Practice Failover for BCDR",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Older OS security patching configured for workloads running on Azure VMware Solution are eligible for ESU",
- "guid": "4f8b20e9-a2a1-f80f-af9b-8aa3b26dca08",
- "link": "https://docs.microsoft.com/windows-server/get-started/extended-security-updates-deploy",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "AVS"
+ "Backup",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Extended support",
- "text": "Ensure extended security update support ",
- "waf": "Security"
+ "severity": "High",
+ "text": "Plan a backup strategy and take regular backups",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Use a SIEM/SOAR",
- "guid": "9bb22fec-4d00-3b95-7136-e225d0f5c63a",
- "link": "https://learn.microsoft.com/azure/sentinel/overview",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
+ "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
+ "service": "Purview",
"services": [
- "Sentinel",
- "AVS"
+ "EventHubs",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Investigation",
- "text": "Enable Azure Sentinel or 3rd party SIEM ",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "MS Defender For Cloud, for workloads running on Azure VMware Solution",
- "guid": "f42b0b09-c591-238a-1580-2de3c485ebd2",
- "link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
+ "link": "https://learn.microsoft.com/purview/deployment-best-practices",
+ "service": "Purview",
"services": [
- "AVS",
- "Defender"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Enable Advanced Threat Detection ",
- "waf": "Security"
+ "text": "Follow Purview accounts architectures and deployment best practices",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Are the applicable policies enabled (compliance baselines added to MDfC)",
- "guid": "bcdd2348-3d0e-c6bb-1092-aa4cd1a66d6b",
- "link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
+ "service": "Purview",
"services": [
- "AVS",
- "AzurePolicy"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Policy & Regulatory Compliance",
- "waf": "Security"
+ "text": "Follow Collection Architectures and best practices",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Azure to Azure (E/W), Azure to On-premises), AVS to Internet, AVS to Azure",
- "guid": "607c1ca9-da92-ae19-5a4c-eb1e876acbe7",
- "link": "https://techcommunity.microsoft.com/t5/azure-migration-and/firewall-integration-in-azure-vmware-solution/ba-p/2254961#:~:text=Azure%20VMware%20Solution%20customers%20have%20multiple%20security%20options,the%20box%20to%20provide%20East-West%20and%20North-South%20firewalling.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Firewalls",
- "text": "Azure / 3rd party firewall",
- "waf": "Security"
+ "text": "Follow Assest lifecycle best practices",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "To allow HCX appliance to connect/sync",
- "guid": "1d87925c-c02b-7fde-a425-7e95ad846a27",
- "link": "https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-networking-security/GUID-2CFE1654-9CC9-4EDB-A625-21317299E559.html",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Firewalls",
- "text": "Firewalls allow for East/West traffic inside AVS",
- "waf": "Security"
+ "text": "Follow automation best practices",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Decision on which tool to use (SRM requires additional license - enables automation & other features)",
- "guid": "468b3495-2f6e-b65a-38ef-3ba631bcaa46",
- "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-B842696B-89EF-4183-9C73-B77157F56055.html",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "AVS"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "HCX and/or SRM",
+ "text": "Follow Backup and Migration Best practices",
"waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Read up on requirements for Service Mesh requirements and how HCX ",
- "guid": "be2ced52-da08-d366-cf7c-044c19e29509",
- "link": "https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-76BCD059-A31A-4041-9105-ACFB56213E7C.html",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Configuring and Managing the HCX Interconnect",
+ "text": "Follow Purview Glossary Best Practices",
"waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "If you are planning on using stretch networks ensure that your on-premises environment requirements",
- "guid": "7dcac579-fc5c-5c9c-f1f7-9b1149ff2c37",
- "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-DBDB4D1B-60B6-4D16-936B-4AC632606909.html",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
+ "link": "https://learn.microsoft.com/purview/concept-workflow",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Networking",
- "text": "Restrictions and limitations for network extensions",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Leverage Workflows ",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Do workloads require MoN?",
- "guid": "cf45c0b9-6c4b-3bfb-86c5-62fe54061c73",
- "link": "https://learn.microsoft.com/azure/azure-vmware/vmware-hcx-mon-guidance",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Mobility optimized networking",
- "waf": "Performance"
+ "text": "Follow Purview Security Best Practices",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Operating system level of Vmware environment",
- "guid": "b7cf11f3-b12e-5189-991a-06df5250d2ca",
- "link": "https://learn.microsoft.com/azure/site-recovery/vmware-physical-azure-support-matrix",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "On-premises pre-requisites",
- "text": "Support matrix (OS versions etc).",
- "waf": "Operations"
+ "text": "Follow Purview Data Lineage Best Practices",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Required that all switches are dynamic",
- "guid": "45fe9252-aa1b-4e30-45c6-bc02f3b76acf",
- "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/vsan-network-design-guide/GUID-91E1CD6F-33A6-4AC6-BC22-3E4807296F86.html#:~:text=Migrate%20Management%20Network%201%20Add%20hosts%20to%20the,each%20host.%20...%204%20Finish%20the%20configuration.%20",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "On-premises pre-requisites",
- "text": "Standard switches converted to dynamic switches",
- "waf": "Operations"
+ "text": "Follow Best Practices for Scanning Registered Sources",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "See sections on sizing and capacity in the link.",
- "guid": "e9f6d736-ee44-e2ac-e7f9-e361f8c857f3",
- "link": "https://learn.microsoft.com/azure/azure-vmware/plan-private-cloud-deployment",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "On-premises pre-requisites",
- "text": "Capacity for HCX appliance",
- "waf": "Performance"
+ "text": "Follow Classification Best Practices in Governance Portal",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Check hardware restrictions to ensure compatibility with AVS/OS ",
- "guid": "1be2cdd6-15a7-9a33-aea7-113859035ce9",
- "link": "https://kb.vmware.com/s/article/2007240#:~:text=ESXi%2FESX%20hosts%20and%20compatible%20virtual%20machine%20hardware%20versions,%20Not%20Supported%20%204%20more%20rows",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
+ "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
+ "service": "Purview",
"services": [
- "AVS"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "On-premises pre-requisites",
- "text": "Hardware compatibility",
- "waf": "Operations"
+ "text": "Perform Sensitivity Labelling in the Purview Data Map",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Need to be converted",
- "guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7",
- "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
+ "link": "https://learn.microsoft.com/purview/concept-data-share",
+ "service": "Purview",
"services": [
- "AVS",
- "Storage"
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "VSAN RDM disks are converted - not supported.",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Need to be converted",
- "guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611",
- "link": "3rd-Party tools",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
"services": [
- "AVS",
- "VM",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "VM with SCSI shared bus are not supported",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Leverage Data Estate Insights",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Remove Direct IO before migration",
- "guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381",
- "link": "Contact VMware",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
+ "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
+ "service": "Purview",
"services": [
- "AVS",
- "VM",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "VM with Direct IO require removing DirectPath device",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Use Data stewardship and Catalog adoption",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Cannot migrate clusters ",
- "guid": "efc8a311-74f8-0252-c6a0-4bac7610e266",
- "link": "Contact VMware",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
"services": [
- "AVS",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Shared VMDK files are not supported",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Use Inventory and Ownership",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Convert to a different format",
- "guid": "ab6c89cd-a26f-b894-fe59-61863975458e",
- "link": "Contact VMware",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
+ "link": "https://learn.microsoft.com/purview/glossary-insights",
+ "service": "Purview",
"services": [
- "AVS",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "RDM with 'physical compatibility mode' are not supported.",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning 'RAID-1 FTT-1' is default with Thin Provisioning",
- "guid": "7628d446-6b10-9678-9cec-f407d990de43",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
+ "link": "https://learn.microsoft.com/purview/compliance-manager",
+ "service": "Purview",
"services": [
- "AVS",
- "AzurePolicy",
- "VM",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "Default storage policy",
- "waf": "Operations"
+ "text": "Generate assessment scores",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "The default storage policy is set to RAID-1 (Mirroring) FTT-1, with Object Space Reservation set to Thin provisioning.",
- "guid": "37fef358-7ab9-43a9-542c-22673955200e",
- "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
+ "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
+ "service": "Purview",
"services": [
- "AVS",
- "AzurePolicy",
- "VM",
- "Storage"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "Ensure that the appropriate VM template storage policy is used",
- "waf": "Operations"
+ "text": "Profiling- get summaries of data content",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
- "guid": "ebebd109-9f9d-d85e-1b2f-d302012843b7",
- "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
+ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
+ "service": "Purview",
"services": [
- "AVS",
"AzurePolicy",
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Failure to tolerate policy",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Follow Microsoft Purview Data Owner access policies",
+ "waf": "Reliability"
},
{
- "category": "VMware",
- "checklist": "Azure VMware Solution Implementation Checklist",
- "description": "ANF can be used to extend storage for Azure VMware Solution,",
- "guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863",
- "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
+ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
+ "service": "Purview",
"services": [
- "AVS",
- "Storage"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Use ANF for external storage",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Follow Self-service access policies",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "WAF checklist",
+ "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
+ "link": "https://learn.microsoft.com/purview/concept-policies-devops",
+ "service": "Purview",
"services": [
- "Storage"
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": " Overview",
- "text": "Consider the 'Azure security baseline for storage'",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Follow DevOps policies",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "WAF checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
"services": [
- "PrivateLink",
- "Storage"
+ "ACR",
+ "WAF"
],
"severity": "High",
- "subcategory": "Networking",
- "text": "Consider using private endpoints for Azure Storage",
- "waf": "Security"
+ "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "WAF checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"services": [
"Storage",
- "Subscriptions",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
- "waf": "Security"
+ "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "WAF checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"services": [
"Storage",
- "Defender"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Governance",
- "text": "Enable Microsoft Defender for all of your storage accounts",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "WAF checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"services": [
- "Storage"
+ "ASR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Data Availability",
- "text": "Enable 'soft delete' for blobs",
- "waf": "Security"
+ "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
+ "checklist": "WAF checklist",
+ "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
+ "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
+ "service": "VMSS",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Confidentiality",
- "text": "Disable 'soft delete' for blobs",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
+ "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
+ "service": "VM",
"services": [
- "Storage"
+ "Backup",
+ "VM",
+ "WAF"
],
"severity": "High",
- "subcategory": "Data Availability",
- "text": "Enable 'soft delete' for containers",
- "waf": "Security"
+ "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
+ "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "VM",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Confidentiality",
- "text": "Disable 'soft delete' for containers",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use Premium or Ultra disks for production VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
+ "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
+ "service": "VM",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "High",
- "subcategory": "Data Availability",
- "text": "Enable resource locks on storage accounts",
- "waf": "Security"
+ "text": "Ensure Managed Disks are used for all VMs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
+ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
+ "service": "VM",
"services": [
- "Subscriptions",
+ "SQL",
"Storage",
- "AzurePolicy"
+ "WAF",
+ "VM"
],
- "severity": "High",
- "subcategory": "Data Availability, Compliance",
- "text": "Consider immutable blobs",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
+ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "VM",
"services": [
- "Storage"
+ "Storage",
+ "ACR",
+ "VM",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Leverage Availability Zones for your VMs in regions where they are supported",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
+ "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "VM",
+ "services": [
+ "VM",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
+ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "VM",
+ "services": [
+ "VM",
+ "WAF",
+ "ASR"
],
"severity": "High",
- "subcategory": "Networking",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "waf": "Security"
+ "text": "Avoid running a production workload on a single VM",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
+ "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"services": [
- "Storage"
+ "VM",
+ "AVS",
+ "WAF",
+ "ASR"
],
"severity": "High",
- "subcategory": "Networking",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
- "waf": "Security"
+ "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
+ "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
+ "service": "VM",
"services": [
- "Storage"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Networking",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
+ "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
+ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
+ "service": "VM",
"services": [
- "Storage"
+ "ASR",
+ "WAF",
+ "VM"
],
- "severity": "High",
- "subcategory": "Networking",
- "text": "Enforce the latest TLS version for a storage account",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Increase quotas in DR region before testing failover with ASR",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
+ "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
+ "service": "VM",
"services": [
- "Entra",
- "Storage"
+ "VM",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Use Microsoft Entra ID tokens for blob access",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Utilize Scheduled Events to prepare for VM maintenance",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
+ "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
"service": "Azure Storage",
"services": [
- "Entra",
"Storage",
- "RBAC"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Least privilege in IaM permissions",
- "waf": "Security"
+ "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
+ "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
"service": "Azure Storage",
"services": [
- "Entra",
- "Storage"
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
"service": "Azure Storage",
"services": [
- "Monitor",
- "AKV",
"Storage",
- "Entra"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Enable soft delete for Storage Account Containers",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
"service": "Azure Storage",
"services": [
- "AKV",
- "Monitor",
"Storage",
- "AzurePolicy"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Enable soft delete for blobs",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
+ "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "service": "Azure Backup",
"services": [
- "Entra",
- "AKV",
- "Storage",
- "AzurePolicy"
+ "Backup",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
- "waf": "Security"
+ "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
+ "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
+ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
+ "service": "Azure Backup",
"services": [
- "Entra",
- "Storage",
- "AzurePolicy"
+ "Backup",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Consider configuring an SAS expiration policy",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "WAF checklist",
+ "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
+ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
+ "service": "Azure Backup",
"services": [
- "AKV",
- "Entra",
+ "Backup",
"Storage",
- "AzurePolicy"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Consider linking SAS to a stored access policy",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
+ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
+ "service": "DNS",
"services": [
- "AKV",
- "Storage"
+ "ACR",
+ "DNS",
+ "WAF",
+ "ASR"
+ ],
+ "severity": "Low",
+ "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.PowerBI/gateways",
+ "checklist": "WAF checklist",
+ "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
+ "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
+ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
+ "service": "Data Gateways",
+ "services": [
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "CI/CD",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
- "waf": "Security"
+ "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
+ "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"services": [
- "Entra",
- "Storage"
+ "NVA",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
- "waf": "Security"
+ "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage",
- "AzurePolicy"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Strive for short validity periods for ad-hoc SAS",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Apply a narrow scope to a SAS",
- "waf": "Security"
+ "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
- "waf": "Security"
+ "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage"
+ "Backup",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Identity and Access Management",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"services": [
- "Entra",
+ "Backup",
"Storage",
- "RBAC"
+ "SQL",
+ "SAP",
+ "ASR",
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
- "waf": "Security"
+ "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
- "waf": "Security"
+ "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"services": [
- "Storage",
- "AzurePolicy"
+ "VPN",
+ "ASR",
+ "WAF",
+ "ExpressRoute"
],
"severity": "High",
- "subcategory": "Networking",
- "text": "Avoid overly broad CORS policies",
- "waf": "Security"
+ "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"services": [
- "Storage"
+ "AKV",
+ "ACR",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"services": [
- "Storage"
+ "SAP",
+ "ASR",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine which/if platform encryption should be used.",
- "waf": "Security"
+ "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
"services": [
- "Storage"
+ "SAP",
+ "Storage",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine which/if client-side encryption should be used.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Storage Review Checklist",
- "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage"
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity and Access Management",
- "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
- "waf": "Security"
+ "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
"services": [
- "Storage"
+ "WAF",
+ "VNet"
],
"severity": "High",
- "subcategory": "Platform Version",
- "text": "Leverage a storagev2 account type for better performance and reliability",
+ "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure Storage Review Checklist",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
"services": [
- "Storage"
+ "Entra",
+ "WAF",
+ "VM",
+ "ASR"
],
"severity": "High",
- "subcategory": "Availablity",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
- "Storage"
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Failover",
- "text": "For write operation after failover, use customer-Managed Failover ",
+ "severity": "High",
+ "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"services": [
- "Storage"
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Failover",
- "text": "Understand Microsoft-Managed Failover details",
+ "severity": "High",
+ "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "checklist": "WAF checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "Storage"
+ "Storage",
+ "WAF",
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enable Soft Delete",
+ "severity": "High",
+ "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
- "services": [],
- "severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Follow reliability support recommendations in Azure Bot Service",
+ "checklist": "WAF checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Storage",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "services": [],
- "severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Deploying bots with local data residency and regional compliance",
+ "checklist": "WAF checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Operations management",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
- "services": [],
- "severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "LoadBalancer",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview",
+ "checklist": "WAF checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "services": [
+ "LoadBalancer",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Make sure the Floating IP is enabled on the Load balancer",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"services": [
- "Entra"
+ "WAF"
],
"severity": "High",
- "subcategory": "Business",
- "text": "Understand what kind of solution you're creating, such as business-to-business (B2B), business-to-consumer (B2C), or your enterprise software, and how tenants are different from users.",
- "waf": "Operations"
+ "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF",
+ "VM"
+ ],
"severity": "High",
- "subcategory": "Business",
- "text": "Define your tenants. Understand how many tenants you will support initially, and your growth plans.",
- "waf": "Operations"
+ "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "waf": "Reliability"
},
{
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "services": [
+ "Entra",
+ "WAF",
+ "VM",
+ "RBAC"
+ ],
"severity": "High",
- "subcategory": "Business",
- "text": "Define your pricing model and ensure it aligns with your tenants' consumption of Azure resources.",
- "waf": "Cost"
- },
- {
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models",
- "services": [],
- "severity": "Medium",
- "subcategory": "Business",
- "text": "Understand whether you need to separate your tenants into different tiers. Tiers might have different pricing, features, performance promises, geographic locations, and so forth.",
- "waf": "Operations"
+ "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
+ "services": [
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Business",
- "text": "Based on your customers' requirements, decide on the tenancy models that are appropriate for various parts of your solution.",
- "waf": "Operations"
+ "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "Reliability"
},
{
- "category": "Business",
- "checklist": "Multitenant architecture",
- "guid": "f5d76ae1-7048-4ff5-abba-f1ca799578b9",
- "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer",
+ "checklist": "WAF checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"services": [
- "Entra"
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Business",
- "text": "When you're ready, sell your B2B multitenant solution using the Microsoft Commercial Marketplace.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "Reliability",
- "text": "Review the Azure Well-Architected Reliability checklist, which is applicable to all workloads.",
+ "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
"waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
- "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "ACR",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "Reliability",
- "text": "Understand the Noisy Neighbor antipattern. Prevent individual tenants from impacting the system's availability for other tenants.",
+ "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
"waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Reliability",
- "text": "Design your multitenant solution for the level of growth that you expect. But don't overengineer for unrealistic growth.",
+ "checklist": "WAF checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
+ "services": [
+ "Entra",
+ "WAF",
+ "VM"
+ ],
"severity": "Medium",
- "subcategory": "Reliability",
- "text": "Define service-level objectives (SLOs) and optionally service-level agreements (SLAs) for your solution. SLAs and SLOs should be based on the requirements of your tenants, as well as the composite SLA of the Azure resources in your architecture.",
+ "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
- "services": [],
- "severity": "High",
- "subcategory": "Reliability",
- "text": "Test the scale of your solution. Ensure that it performs well under all levels of load, and that it scales correctly as the number of tenants increases.",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "services": [
+ "Storage",
+ "WAF",
+ "VM"
+ ],
+ "severity": "Medium",
+ "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
"waf": "Reliability"
},
{
- "category": "Reliability",
- "checklist": "Multitenant architecture",
- "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Reliability",
- "text": "Apply chaos engineering principles to test the reliability of your solution.",
+ "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
- "link": "https://learn.microsoft.com/security/zero-trust",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "services": [
+ "Storage",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "Security",
- "text": "Apply the Zero Trust and least privilege principles in all layers of your solution.",
- "waf": "Security"
+ "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests",
+ "checklist": "WAF checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Ensure that you can correctly map user requests to tenants. Consider including the tenant context as part of the identity system, or by using another means, like application-level tenant authorization.",
- "waf": "Security"
- },
- {
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "services": [],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Perform ongoing penetration testing and security code reviews.",
- "waf": "Security"
+ "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Storage",
+ "WAF",
+ "ASR"
+ ],
"severity": "High",
- "subcategory": "Security",
- "text": "Understand your tenants' compliance requirements, including data residency and any compliance or regulatory standards that they require you to meet.",
- "waf": "Security"
+ "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names",
+ "checklist": "WAF checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
- "DNS"
+ "SAP",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Correctly manage domain names and avoid vulnerabilities like dangling DNS and subdomain takeover attacks.",
- "waf": "Security"
- },
- {
- "category": "Security",
- "checklist": "Multitenant architecture",
- "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview",
- "services": [],
- "severity": "Medium",
- "subcategory": "Security",
- "text": "Follow service-specific guidance for multitenancy.",
- "waf": "Security"
+ "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "waf": "Reliability"
},
{
- "category": "Cost Optimization",
- "checklist": "Multitenant architecture",
- "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
- "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist",
+ "checklist": "WAF checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"services": [
- "Cost"
+ "SAP",
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Cost Optimization",
- "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
+ "text": "Automate SAP System Start-Stop to manage costs.",
"waf": "Cost"
},
{
- "category": "Cost Optimization",
- "checklist": "Multitenant architecture",
- "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption",
+ "checklist": "WAF checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
- "Cost"
+ "Storage",
+ "SAP",
+ "Cost",
+ "VM",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Cost Optimization",
- "text": "Ensure you can adequately measure per-tenant consumption and correlate it with your infrastructure costs.",
+ "severity": "Low",
+ "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
"waf": "Cost"
},
{
- "category": "Cost Optimization",
- "checklist": "Multitenant architecture",
- "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation",
+ "checklist": "WAF checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
+ "Storage",
+ "SAP",
"Cost",
- "Monitor"
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Cost Optimization",
- "text": "Avoid antipatterns. Antipatterns include failing to track costs, tracking costs with unnecessary precision, real-time measurement, and using monitoring tools for billing.",
+ "severity": "Low",
+ "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
"waf": "Cost"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "0d475a5a-2c0f-47ab-b1e1-701da68d3407",
- "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops",
- "services": [],
+ "checklist": "WAF checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
+ "services": [
+ "Subscriptions",
+ "WAF",
+ "RBAC"
+ ],
"severity": "High",
- "subcategory": "Operational Excellence",
- "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
- "waf": "Operations"
+ "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Operational Excellence",
- "text": "Use automation to manage the tenant lifecycle, such as onboarding, deployment, provisioning, and configuration.",
- "waf": "Operations"
+ "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Operational Excellence",
- "text": "Find the right balance for deploying service updates. Consider both your tenants' requirements and your own operational requirements.",
- "waf": "Operations"
+ "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
+ "checklist": "WAF checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"services": [
- "Monitor"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Operational Excellence",
- "text": "Monitor the health of the overall system, as well as each tenant.",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
+ "checklist": "WAF checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"services": [
- "Monitor"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Operational Excellence",
- "text": "Configure and test alerts to notify you when specific tenants are experiencing issues or are exceeding their consumption limits.",
- "waf": "Operations"
- },
- {
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization",
- "services": [],
- "severity": "High",
- "subcategory": "Operational Excellence",
- "text": "Organize your Azure resources for isolation and scale.",
- "waf": "Operations"
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "Multitenant architecture",
- "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Operational Excellence",
- "text": "Avoid deployment and configuration antipatterns. Antipatterns include running separate versions of the solution for each tenant, hardcoding tenant-specific configurations or logic, and manual deployments.",
- "waf": "Operations"
- },
- {
- "category": "Performance Efficiency",
- "checklist": "Multitenant architecture",
- "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
- "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency",
- "services": [],
- "severity": "High",
- "subcategory": "Performance Efficiency",
- "text": "Review the Azure Well-Architected Performance Efficiency checklist, which is applicable to all workloads.",
- "waf": "Performance"
+ "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "category": "Performance Efficiency",
- "checklist": "Multitenant architecture",
- "guid": "18911c4c-934c-49a8-839a-60c092afce30",
- "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor",
- "services": [],
- "severity": "High",
- "subcategory": "Performance Efficiency",
- "text": "If you use shared infrastructure, plan for how you'll mitigate Noisy Neighbor concerns. Ensure that one tenant can't reduce the performance of the system for other tenants.",
- "waf": "Performance"
+ "checklist": "WAF checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
+ "services": [
+ "AKV",
+ "SAP",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "Security"
},
{
- "category": "Performance Efficiency",
- "checklist": "Multitenant architecture",
- "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute",
+ "checklist": "WAF checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"services": [
- "Storage"
+ "AKV",
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Performance Efficiency",
- "text": "Determine how you'll scale your compute, storage, networking, and other Azure resources to match the demands of your tenants.",
- "waf": "Performance"
- },
- {
- "category": "Performance Efficiency",
- "checklist": "Multitenant architecture",
- "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization",
- "services": [],
- "severity": "High",
- "subcategory": "Performance Efficiency",
- "text": "Consider each Azure resource's scale limits. Organize your resources appropriately, in order to avoid resource organization antipatterns. For example, don't over-architect your solution to work within unrealistic scale requirements.",
- "waf": "Performance"
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "waf": "Security"
},
{
- "category": "Application Deployment",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
- "waf": "Reliability"
+ "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "checklist": "WAF checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"services": [
- "TrafficManager",
- "FrontDoor",
- "ASR"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Disaster Recovery",
- "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
- "waf": "Reliability"
+ "text": "Implement SSO to SAP HANA",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "checklist": "WAF checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
"services": [
- "ACR"
+ "SAP",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
- "waf": "Reliability"
+ "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use more than 1 app instance for your apps",
- "waf": "Reliability"
+ "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
+ "checklist": "WAF checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
"services": [
- "Monitor"
+ "SAP",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
- "waf": "Reliability"
+ "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Scalability",
- "text": "Set up autoscaling in Spring Cloud Gateway",
- "waf": "Reliability"
+ "text": "Implement SSO to SAP BTP",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
- "services": [],
- "severity": "Low",
- "subcategory": "Scalability",
- "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
- "waf": "Reliability"
+ "checklist": "WAF checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Entra",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
- "services": [],
+ "checklist": "WAF checklist",
+ "description": "Keep your management group hierarchy reasonably flat, no more than four.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Support",
- "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
- "waf": "Reliability"
+ "text": "enforce existing Management Group policies to SAP Subscriptions",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Device Update Review",
- "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "services": [],
+ "checklist": "WAF checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
- "waf": "Reliability"
+ "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Device Update Review",
- "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "services": [],
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "services": [
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
+ "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Device Update Review",
- "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Device Update for IoT Hub",
- "services": [],
+ "checklist": "WAF checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "services": [
+ "VM",
+ "Subscriptions",
+ "WAF"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operations"
},
{
- "category": "BC and DR",
- "checklist": "Device Update Review",
- "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Device Update for IoT Hub",
+ "checklist": "WAF checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"services": [
- "AppSvc"
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
+ "services": [
+ "VM",
+ "Subscriptions",
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
- "ASR"
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"services": [
- "Entra"
+ "TrafficManager",
+ "Cost",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Microsoft Entra ID Tenants",
- "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"services": [
- "Entra"
+ "Backup",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Microsoft Entra ID Tenants",
- "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Help protect your HANA database by using the Azure Backup service.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"services": [
- "Entra"
+ "Entra",
+ "Storage",
+ "WAF",
+ "VM"
+ ],
+ "severity": "Medium",
+ "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "WAF"
],
"severity": "High",
- "subcategory": "Microsoft Entra ID Tenants",
- "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "text": "Ensure time-zone matches between the operating system and the SAP system.",
"waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"services": [
- "Entra"
+ "Entra",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Cloud Solution Provider",
- "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "a24d0de3-d4b9-4dfb-8ddd-bbfaf123fa01",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-cloud-solution-provider#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
"services": [
- "Entra"
+ "Cost",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Cloud Solution Provider",
- "text": "If you have a CSP partner, define and document your support request and escalation process.",
+ "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
"waf": "Cost"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "32952499-58c8-4e6f-ada5-972e67893d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"services": [
- "Cost",
- "Entra"
+ "SAP",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Cloud Solution Provider",
- "text": "Setup Cost Reporting and Views with Azure Cost Management.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/",
- "waf": "Cost"
+ "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "685cb4f2-ac9c-4b19-9167-993ed0b32415",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "checklist": "WAF checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"services": [
- "LoadBalancer",
- "Entra"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Enterprise Agreement",
- "text": "Configure Notification Contacts to a group mailbox.",
- "waf": "Cost"
+ "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "checklist": "WAF checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"services": [
- "TrafficManager",
- "Entra"
+ "SAP",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Enterprise Agreement",
- "text": "Use departments and accounts to map your organization's structure to your enrollment hierarchy which can help with separating billing.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-ea-roles",
- "waf": "Cost"
+ "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "ca0fe401-12ad-46fc-8a7e-86293866a9f6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"services": [
- "Cost",
- "Entra"
+ "SQL",
+ "Monitor",
+ "WAF",
+ "SAP"
],
"severity": "Medium",
- "subcategory": "Enterprise Agreement",
- "text": "Enable both DA View Charges and AO View Charges on your EA Enrollments to allow users with the correct perms review Cost and Billing Data.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/assign-access-acm-data#enable-access-to-costs-in-the-azure-portal",
- "waf": "Security"
+ "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "checklist": "WAF checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"services": [
- "Cost",
+ "Monitor",
+ "VM",
+ "SAP",
"Entra",
- "Subscriptions"
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
+ "services": [
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Enterprise Agreement",
- "text": "Use of Enterprise Dev/Test Subscriptions to reduce costs for non-production workloads.",
- "training": "https://learn.microsoft.com/azure/devtest/offer/how-to-manage-monitor-devtest",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "6ad5c3dd-e5ea-4ff1-81a4-7886ff87845c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"services": [
- "Entra"
+ "NetworkWatcher",
+ "SAP",
+ "Monitor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Microsoft Customer Agreement",
- "text": "Configure Agreement billing account notification contact email.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-setup-account",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "90e87802-602f-4dfb-acea-67c60689f1d7",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice",
+ "checklist": "WAF checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"services": [
- "Cost",
- "Entra",
- "Storage"
+ "SAP",
+ "VM",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Microsoft Customer Agreement",
- "text": "Use Billing Profiles and Invoice sections to structure your agreements billing for effective cost management.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/mca-overview#billing-profiles",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "waf": "Operations"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "e81a73f0-84c4-4641-b406-14db3b4d1f50",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
- "Cost",
- "Entra"
+ "SAP",
+ "Subscriptions",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Microsoft Customer Agreement",
- "text": "Make use of Microsoft Azure plan for dev/test offer to reduce costs for non-production workloads.",
- "training": "https://learn.microsoft.com/azure/devtest/offer/overview-what-is-devtest-offer-visual-studio",
- "waf": "Cost"
+ "severity": "High",
+ "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Performance"
},
{
- "category": "Azure Billing and Microsoft Entra ID Tenants",
- "checklist": "Azure Landing Zone Review",
- "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"services": [
- "Entra",
- "RBAC"
+ "Storage",
+ "WAF",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Microsoft Customer Agreement",
- "text": "Define and document a process to periodically audit the agreement billing RBAC role assignments to review who has access to your MCA billing account.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-mca-roles",
- "waf": "Cost"
+ "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
"services": [
- "ACR",
- "Entra",
- "RBAC",
- "Subscriptions"
+ "Sentinel",
+ "SAP",
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "severity": "Medium",
+ "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "4348bf81-7573-4512-8f46-9061cc198fea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
+ "checklist": "WAF checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
"services": [
- "Entra"
+ "Cost",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Microsoft Entra ID and Hybrid Identity",
- "text": "Use managed identities instead of service principals for authentication to Azure services. You can check for existing service principals via Entra ID > Sign in Logs > Service principal logins.",
- "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
"services": [
- "Entra"
+ "VM",
+ "WAF",
+ "Monitor"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
+ "waf": "Performance"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "Monitor",
+ "WAF",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"services": [
- "Entra",
- "AzurePolicy"
+ "SAP",
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
+ "waf": "Performance"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
+ "waf": "Performance"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "checklist": "WAF checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"services": [
- "Entra",
- "RBAC"
+ "SAP",
+ "Storage",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "Performance"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"services": [
- "Entra"
+ "SQL",
+ "WAF",
+ "SAP"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Performance"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
- "ACR",
- "Entra",
- "VM"
+ "SAP",
+ "Monitor",
+ "WAF",
+ "ASR"
],
"severity": "High",
- "subcategory": "Identity",
- "text": "When deploying Active Directory Domain Controllers, use a location with Availability Zones and deploy at least two VMs across these zones. If not available, deploy in an Availability Set.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
- "waf": "Reliability"
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8aa1e41-870d-4968-94c6-77be14f510ac",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions#identity",
+ "checklist": "WAF checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"services": [
- "Entra"
+ "AppGW",
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Deploy your Azure landing zone identity resources in multiple regions. If using domain controllers, associate each region with an Active Directory site so that resources can resolve to their local domain controllers.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
- "waf": "Reliability"
+ "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "ACR",
- "Entra",
- "RBAC",
- "Subscriptions"
+ "DNS",
+ "SAP",
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Use Azure custom RBAC roles for the following key roles to provide fine-grain access across your ALZ: Azure platform owner, network management, security operations, subscription owner, application owner. Align these roles to teams and responsibilities within your business.",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
- "waf": "Security"
+ "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "DNS",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "Security"
+ "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "ACR",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
"waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"services": [
- "Monitor",
- "Entra"
+ "NVA",
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "Security"
+ "severity": "High",
+ "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Performance"
},
{
- "ammp": true,
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "ACR",
+ "WAF",
+ "VWAN"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
- "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
+ "checklist": "WAF checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"services": [
- "Entra",
- "ASR"
+ "NVA",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Microsoft Entra ID",
- "text": "When deploying Microsoft Entra Connect, use a staging sever for high availability/disaster recovery.",
- "training": "https://learn.microsoft.com/entra/identity/hybrid/connect/plan-connect-topologies",
- "waf": "Reliability"
+ "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"services": [
- "Entra",
- "RBAC"
+ "VNet",
+ "NVA",
+ "SAP",
+ "VWAN",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Security"
+ "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"services": [
- "Entra"
+ "SAP",
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "severity": "High",
+ "text": "Public IP assignment to VM running SAP Workload is not recommended.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Security"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
"services": [
- "Entra",
- "VNet"
+ "ASR",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Consider reserving IP address on DR side when configuring ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "services": [
+ "WAF"
],
"severity": "High",
- "subcategory": "Landing zones",
- "text": "Configure Identity network segmentation through the use of a virtual Network and peer back to the hub. Providing authentication inside application landing zone (legacy).",
- "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
- "waf": "Security"
+ "text": "Avoid using overlapping IP address ranges for production and DR sites.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
"services": [
- "ACR",
"Storage",
- "RBAC",
- "Entra",
- "AKV"
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Landing zones",
- "text": "Use Azure RBAC to manage data plane access to resources, if possible. E.g. Data Operations across Key Vault, Storage Account and Database Services.",
- "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "waf": "Security"
+ "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operations"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "d505ebcb-79b1-4274-9c0d-a27c8bea489c",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"services": [
- "Entra"
+ "WAF",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "Landing zones",
- "text": "Use Microsoft Entra ID PIM access reviews to periodically validate resource entitlements.",
- "training": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-perform-roles-and-resource-roles-review",
- "waf": "Security"
- },
- {
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "description": "Consider using the Azure naming tool available at https://aka.ms/azurenamingtool",
- "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
- "services": [],
- "severity": "High",
- "subcategory": "Naming and tagging",
- "text": "Use a well defined naming scheme for resources, such as Microsoft Best Practice Naming Standards.",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "checklist": "WAF checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "AppGW",
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce reasonably flat management group hierarchy with no more than four levels.",
- "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "ACR",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure.",
- "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
"services": [
- "Subscriptions",
- "RBAC",
+ "AppGW",
+ "FrontDoor",
+ "WAF",
"AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment.",
- "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "checklist": "WAF checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
- "ExpressRoute",
- "DNS",
- "VWAN",
- "Subscriptions"
+ "AppGW",
+ "LoadBalancer",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce a dedicated connectivity subscription in the Connectivity management group to host an Azure Virtual WAN hub, private non-AD Domain Name System (DNS), ExpressRoute circuit, and other networking resources.",
- "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
- "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
- "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
+ "checklist": "WAF checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "SAP",
+ "ACR",
+ "WAF",
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce no subscriptions are placed under the root management group.",
- "training": "https://learn.microsoft.com/azure/governance/management-groups/overview",
- "waf": "Security"
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Performance"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
- "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
+ "checklist": "WAF checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"services": [
- "RBAC",
- "Subscriptions"
+ "VNet",
+ "Backup",
+ "Storage",
+ "PrivateLink",
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings.",
- "training": "https://learn.microsoft.com/training/modules/configure-role-based-access-control/",
+ "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
- "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "SAP",
+ "VM",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.",
- "waf": "Security"
+ "severity": "High",
+ "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Performance"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "49b82111-2df2-47ee-912e-7f983f630472",
- "link": "https://learn.microsoft.com/entra/id-governance/access-reviews-overview",
+ "checklist": "WAF checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
"services": [
- "Cost",
- "Subscriptions",
- "RBAC",
- "AzurePolicy"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Subscriptions",
- "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.",
- "training": "https://learn.microsoft.com/training/modules/plan-implement-manage-access-review/",
+ "severity": "Medium",
+ "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "checklist": "WAF checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "SAP",
+ "VM",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Ensure that all subscription owners and IT core team are aware of subscription quotas and the impact they have on provision resources for a given subscription.",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/",
+ "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
+ "checklist": "WAF checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "Cost",
- "Subscriptions"
+ "SAP",
+ "WAF",
+ "VNet"
],
"severity": "High",
- "subcategory": "Subscriptions",
- "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions.",
- "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/",
- "waf": "Security"
+ "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "ammp": true,
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
- "link": "https://learn.microsoft.com/azure/azure-portal/azure-portal-dashboards",
+ "checklist": "WAF checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "Monitor",
- "Storage",
- "Subscriptions"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Establish dashboards and/or visualizations to monitor compute and storage capacity metrics. (i.e. CPU, memory, disk space)",
- "training": "https://learn.microsoft.com/training/modules/visualize-data-workbooks/",
- "waf": "Security"
+ "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Performance"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/get-started/manage-costs",
+ "checklist": "WAF checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "Cost",
- "Subscriptions"
+ "SAP",
+ "WAF"
],
"severity": "High",
- "subcategory": "Subscriptions",
- "text": "As part of your cloud adoption, implement a detailed cost management plan using the 'Managed cloud costs' process.",
- "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/",
- "waf": "Security"
+ "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
- "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
+ "checklist": "WAF checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "Entra",
- "Subscriptions"
+ "SAP",
+ "Cost",
+ "WAF",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "If servers will be used for Identity services, like domain controllers, establish a dedicated identity subscription in the identity management group, to host these services. Make sure that resources are set to use the domain controllers available in their region.",
- "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
- "waf": "Security"
+ "severity": "High",
+ "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Cost"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
+ "checklist": "WAF checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
"services": [
- "Cost",
- "Subscriptions"
+ "LoadBalancer",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Ensure tags are used for billing and cost management.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "severity": "High",
+ "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Performance"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "6cc0ea22-42bb-441e-a345-804ab0a09666",
- "link": "https://github.com/Azure/sovereign-landing-zone/blob/main/docs/02-Architecture.md",
+ "checklist": "WAF checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"services": [
- "Subscriptions"
+ "SAP",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "For Sovereign Landing Zone, have a 'confidential corp' and 'confidential online' management group directly under the 'landing zones' MG.",
- "training": "https://learn.microsoft.com/industry/sovereignty/slz-overview",
+ "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
"waf": "Security"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "250d81ce-8bbe-4f85-9051-6a18a8221e50",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions",
+ "checklist": "WAF checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"services": [
- "Cost"
+ "SAP",
+ "VM",
+ "WAF",
+ "Backup"
],
"severity": "High",
- "subcategory": "Regions",
- "text": "Select the right Azure region/s for your deployment. Azure is a global-scale cloud platform that provide global coverage through many regions and geographies. Different Azure regions have different characteristics, access and availability models, costs, capacity, and services offered, then it is important to consider all criteria and requirements.",
- "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
- "waf": "Reliability"
+ "text": "Review SAP HANA database backups for Azure VMs.",
+ "waf": "Cost"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "19ca3f89-397d-44b1-b5b6-5e18661372ac",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions#operate-in-multiple-geographic-regions",
+ "checklist": "WAF checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
+ "SAP",
+ "Monitor",
+ "WAF",
"ASR"
],
"severity": "Medium",
- "subcategory": "Regions",
- "text": "Deploy your Azure landing zone in a multi-region deployment. Depending on customer size, locations, and users presence, operating in multiple regions can be a common choice to deliver services and run applications closer to them. Using a multi-region deployment is also important to provide geo disaster recovery capabilities, to eliminate the dependency from a single region capacity and diminish the risk of a temporary and localized resource capacity constraint.",
- "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
- "waf": "Reliability"
+ "text": "Review Site Recovery built-in monitoring, where used for SAP.",
+ "waf": "Cost"
},
{
- "category": "Resource Organization",
- "checklist": "Azure Landing Zone Review",
- "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "services": [
+ "SAP",
+ "Monitor",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
+ "services": [
+ "Backup",
+ "VM",
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Regions",
- "text": "Ensure required services and features are available within the chosen deployment regions.",
- "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
- "waf": "Reliability"
+ "text": "Review Oracle Database in Azure Linux VM backup strategies.",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery",
+ "checklist": "WAF checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"services": [
- "AppGW",
- "FrontDoor"
+ "SQL",
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "App delivery",
- "text": "Document a standard for securing the delivery application content from your Workload spokes using Application Gateway and Azure Front Door. You can use the Application Delivery checklist to for recommendations.",
+ "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
"waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"services": [
- "VNet"
+ "Backup",
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "text": "Review the use of Automated Backup v2 for Azure VMs.",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"services": [
- "VPN",
- "DNS",
- "NVA",
- "Firewall",
- "ExpressRoute",
- "Entra",
- "VNet"
+ "WAF"
],
"severity": "High",
- "subcategory": "Hub and spoke",
- "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Cost"
+ "text": "Enabling Write accelerator for M series when using premium disks(V1)",
+ "waf": "Operations"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"services": [
- "DDoS"
+ "WAF"
],
- "severity": "High",
- "subcategory": "App delivery",
- "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Test availability zone latency.",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "checklist": "WAF checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"services": [
- "NVA"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
- "waf": "Reliability"
+ "text": "Activate SAP EarlyWatch Alert for all SAP components.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"services": [
- "ExpressRoute",
- "ARS",
- "VPN"
+ "SAP",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Hub and spoke",
- "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
+ "checklist": "WAF checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"services": [
- "ARS",
- "VNet"
+ "SQL",
+ "Monitor",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "Hub and spoke",
- "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Review SQL Server performance monitoring using CCMS.",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
"services": [
- "ACR",
- "VNet"
+ "SAP",
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
"waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
"services": [
- "Monitor"
+ "SAP",
+ "Monitor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Operations"
+ "text": "Review SAP HANA studio alerts.",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
"services": [
- "ExpressRoute",
- "VNet"
+ "SAP",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
+ "waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
- "Storage"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hub and spoke",
- "text": "Limit the number of routes per route table to 400.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
- "VNet"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Hub and spoke",
- "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "checklist": "WAF checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "LoadBalancer"
+ "SQL",
+ "WAF",
+ "SAP"
],
- "severity": "High",
- "subcategory": "Hub and spoke",
- "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "checklist": "WAF checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "LoadBalancer"
+ "SQL",
+ "WAF"
],
"severity": "High",
- "subcategory": "Hub and spoke",
- "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
- "waf": "Reliability"
+ "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "ExpressRoute"
+ "Backup",
+ "Storage",
+ "SQL",
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Encryption",
- "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "severity": "High",
+ "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
"services": [
- "ExpressRoute",
- "VPN"
+ "Storage",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Encryption",
- "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"services": [
- "ACR",
- "VNet"
+ "AKV",
+ "WAF"
],
"severity": "High",
- "subcategory": "IP plan",
- "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "text": "Use Azure Key Vault to store your secrets and credentials",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"services": [
- "VNet"
+ "AzurePolicy",
+ "Subscriptions",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "IP plan",
- "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"services": [
- "VNet"
+ "AKV",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "High",
- "subcategory": "IP plan",
- "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
"services": [
- "ASR",
- "VNet"
+ "AzurePolicy",
+ "WAF",
+ "RBAC"
],
"severity": "High",
- "subcategory": "IP plan",
- "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "checklist": "WAF checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "ACR",
- "VNet"
+ "Defender",
+ "SAP",
+ "Storage",
+ "WAF"
],
"severity": "High",
- "subcategory": "IP plan",
- "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "Reliability"
+ "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "checklist": "WAF checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"services": [
- "DNS",
- "VNet"
+ "Defender",
+ "SAP",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "IP plan",
- "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "checklist": "WAF checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "ACR",
- "DNS",
- "VNet"
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "IP plan",
- "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "severity": "Low",
+ "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
+ "checklist": "WAF checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"services": [
- "DNS",
- "VNet"
+ "AKV",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "IP plan",
- "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
+ "checklist": "WAF checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
"services": [
- "DNS",
- "VM",
- "VNet"
+ "AKV",
+ "WAF"
],
"severity": "High",
- "subcategory": "IP plan",
- "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operations"
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "checklist": "WAF checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
"services": [
- "DNS",
- "VNet"
+ "AKV",
+ "SAP",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "IP plan",
- "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "checklist": "WAF checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
"services": [
- "Bastion"
+ "SAP",
+ "Subscriptions",
+ "WAF",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Bastion to securely connect to your network.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "severity": "High",
+ "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "checklist": "WAF checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"services": [
- "Bastion",
- "VNet"
+ "NVA",
+ "SAP",
+ "WAF",
+ "PrivateLink"
],
- "severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Bastion in a subnet /26 or larger.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "severity": "High",
+ "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "checklist": "WAF checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
"services": [
+ "Storage",
"WAF",
- "ACR",
- "FrontDoor",
- "AzurePolicy"
+ "VM"
],
- "severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "severity": "Low",
+ "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "checklist": "WAF checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "Defender",
+ "WAF"
],
"severity": "Low",
- "subcategory": "Internet",
- "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "checklist": "WAF checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF",
"VNet"
],
"severity": "High",
- "subcategory": "Internet",
- "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "DDoS",
- "VNet"
+ "SAP",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Internet",
- "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "severity": "Low",
+ "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
- "services": [],
- "severity": "High",
- "subcategory": "Internet",
- "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "Reliability"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "checklist": "WAF checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"services": [
- "DDoS"
+ "AKV",
+ "SAP",
+ "Monitor",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Internet",
- "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "severity": "Medium",
+ "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
"services": [
- "AzurePolicy",
- "VM"
+ "ServiceBus",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Internet",
- "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"services": [
- "ExpressRoute",
- "VPN",
- "Backup"
+ "ServiceBus",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"services": [
- "ExpressRoute"
+ "AzurePolicy",
+ "ServiceBus",
+ "TrafficManager",
+ "Entra",
+ "WAF",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
+ "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
+ "service": "Service Bus",
"services": [
- "ExpressRoute",
- "VPN"
+ "ServiceBus",
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
"services": [
- "ExpressRoute",
- "Cost"
+ "ServiceBus",
+ "Storage",
+ "Subscriptions",
+ "WAF",
+ "RBAC"
],
"severity": "High",
- "subcategory": "Hybrid",
- "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"services": [
- "ExpressRoute",
- "Cost"
+ "ServiceBus",
+ "Monitor",
+ "WAF",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Hybrid",
- "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"services": [
- "ExpressRoute"
+ "ServiceBus",
+ "PrivateLink",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"services": [
- "ExpressRoute"
+ "ServiceBus",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "Use Standard SKU for production scenarios.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
+ "service": "Azure Service Fabric",
"services": [
- "VPN"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
+ "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
+ "service": "Azure Service Fabric",
"services": [
- "VPN"
+ "ACR",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "Cost"
+ "WAF",
+ "APIM"
],
- "severity": "High",
- "subcategory": "Hybrid",
- "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
+ "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "Monitor"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
+ "service": "Azure Service Fabric",
"services": [
- "ACR",
- "Monitor",
- "NetworkWatcher"
+ "VM",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "VPN"
+ "WAF",
+ "APIM",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
+ "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"services": [
+ "VM",
+ "AKV",
"Storage",
- "VNet"
+ "Entra",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Hybrid",
- "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "001cbb6f-d88d-4431-8434-d01333397776",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "ACR"
+ "WAF"
],
- "severity": "High",
- "subcategory": "Hybrid",
- "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute"
- ],
- "severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "ACR",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
- "services": [],
+ "checklist": "WAF checklist",
+ "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
+ "link": "",
+ "service": "Azure Service Fabric",
+ "services": [
+ "WAF"
+ ],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
+ "link": "",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute"
+ "AKV",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Hybrid",
- "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "Monitor",
- "VNet"
+ "Entra",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "checklist": "WAF checklist",
+ "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
+ "service": "Azure Service Fabric",
"services": [
- "ExpressRoute",
- "VNet"
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Hybrid",
- "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
"services": [
- "ACR"
+ "EventHubs"
],
"severity": "Low",
- "subcategory": "Hybrid",
- "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
- "waf": "Performance"
+ "subcategory": "Data Protection",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"services": [
- "Firewall"
+ "EventHubs"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "severity": "Medium",
+ "subcategory": "Data Protection",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"services": [
- "ACR",
- "RBAC",
+ "EventHubs",
"AzurePolicy",
- "Firewall"
+ "TrafficManager",
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "subcategory": "Identity and Access Management",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"services": [
- "Firewall"
+ "EventHubs",
+ "VM",
+ "AKV",
+ "Storage",
+ "Entra"
],
- "severity": "Low",
- "subcategory": "Firewall",
- "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "severity": "Medium",
+ "subcategory": "Identity and Access Management",
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"services": [
- "DNS",
- "Firewall"
+ "Entra",
+ "EventHubs",
+ "RBAC"
],
"severity": "High",
- "subcategory": "Firewall",
- "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "subcategory": "Identity and Access Management",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
"services": [
- "Firewall"
+ "EventHubs",
+ "VNet",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Use Azure Firewall Premium to enable additional security features.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"services": [
- "Firewall"
+ "PrivateLink",
+ "EventHubs",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "category": "Security",
+ "checklist": "Azure Event Hub Review",
+ "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"services": [
- "Firewall"
+ "EventHubs"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"services": [
- "Storage",
- "NVA",
- "Firewall",
- "VWAN",
- "VNet"
+ "EventHubs"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Leverage FTA Resillency HandBook",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"services": [
- "Storage",
- "Firewall"
+ "EventHubs",
+ "ACR"
],
- "severity": "Medium",
- "subcategory": "Firewall",
- "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Zone Redudancy",
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"services": [
- "AzurePolicy",
- "Firewall"
+ "EventHubs"
],
- "severity": "Important",
- "subcategory": "Firewall",
- "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Use the Premium or Dedicated SKUs for predicable performance",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"services": [
- "Firewall",
- "VNet"
+ "EventHubs",
+ "ASR"
],
"severity": "High",
- "subcategory": "Segmentation",
- "text": "Use a /26 prefix for your Azure Firewall subnets.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Security"
+ "subcategory": "Geo Redudancy",
+ "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"services": [
- "AzurePolicy"
+ "EventHubs",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "Performance"
+ "subcategory": "Geo Redudancy",
+ "text": "For Business Critical Applications, use Active Active configuration",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"services": [
- "Storage"
+ "EventHubs"
],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
- "waf": "Performance"
+ "subcategory": "Reliability",
+ "text": "Design Resilient Event Hubs",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
+ "service": "Cognitive Services",
"services": [],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "subcategory": "Best Practice",
+ "text": "Leverage FTA HandBook for Cognitive Services",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Cognitive Services",
"services": [
- "Monitor"
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "subcategory": "Backup",
+ "text": "Backup Your Prompts",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Cognitive Services",
"services": [
- "Firewall"
+ "Backup",
+ "ASR"
],
"severity": "High",
- "subcategory": "Firewall",
- "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
- "waf": "Performance"
+ "subcategory": "Backup",
+ "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
+ "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
+ "service": "Cognitive Services",
"services": [
- "ServiceBus"
+ "Backup"
],
- "severity": "Low",
- "subcategory": "Firewall",
- "text": "Use web categories to allow or deny outbound access to specific topics.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Backup Your ChatGPT conversations",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
+ "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
+ "service": "Cognitive Services",
"services": [],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "Performance"
+ "subcategory": "DevOps",
+ "text": "CI/CD for custom speech",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
- "services": [
- "DNS",
- "Firewall"
- ],
+ "category": "Operations Management",
+ "checklist": "Cognitive Services Review Checklist",
+ "guid": "3687a046-7a1f-4893-9bda-43324f248116",
+ "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
+ "service": "Cognitive Services",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "QnA Service",
+ "text": "Move a knowledge base using export-import",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
+ "service": "Azure Service Fabric",
+ "services": [],
"severity": "Medium",
- "subcategory": "Firewall",
- "text": "Enable Azure Firewall DNS proxy configuration.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Security"
+ "subcategory": "Cluster architecture",
+ "text": "Use Standard SKU for production scenarios.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
+ "category": "Standard clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
+ "service": "Azure Service Fabric",
"services": [
- "Monitor",
- "Firewall"
+ "VM"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
+ "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
+ "service": "Azure Service Fabric",
"services": [
- "Backup"
+ "ACR"
],
- "severity": "Low",
- "subcategory": "Firewall",
- "text": "Implement backups for your firewall rules",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
+ "service": "Azure Service Fabric",
"services": [
- "ACR",
- "Firewall"
+ "APIM"
],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
- "services": [
- "DDoS",
- "Firewall",
- "VNet"
- ],
- "severity": "High",
- "subcategory": "Firewall",
- "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
+ "service": "Azure Service Fabric",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Workload architecture",
+ "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
+ "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
+ "service": "Azure Service Fabric",
"services": [
- "VNet"
+ "VM"
],
- "severity": "High",
- "subcategory": "PaaS",
- "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
+ "service": "Azure Service Fabric",
"services": [
- "PrivateLink"
+ "VM"
],
"severity": "Medium",
- "subcategory": "PaaS",
- "text": "Use Private Link, where available, for shared Azure PaaS services.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Cluster architecture",
+ "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
- "services": [
- "ExpressRoute",
- "PrivateLink"
- ],
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
+ "service": "Azure Service Fabric",
+ "services": [],
"severity": "Medium",
- "subcategory": "PaaS",
- "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "subcategory": "Cluster and workload architectures",
+ "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
+ "waf": "Cost"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
+ "service": "Azure Service Fabric",
"services": [
+ "APIM",
"VNet"
],
- "severity": "High",
- "subcategory": "PaaS",
- "text": "Don't enable virtual network service endpoints by default on all subnets.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
+ "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"services": [
- "DNS",
- "NVA",
- "PrivateLink",
- "Firewall"
+ "AKV",
+ "Entra",
+ "Storage",
+ "VM"
],
"severity": "Medium",
- "subcategory": "PaaS",
- "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "subcategory": "Cluster architecture",
+ "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
- "services": [
- "ExpressRoute",
- "VPN",
- "VNet"
- ],
- "severity": "High",
- "subcategory": "Segmentation",
- "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "001cbb6f-d88d-4431-8434-d01333397776",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
+ "service": "Azure Service Fabric",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
+ "service": "Azure Service Fabric",
"services": [
- "VNet"
+ "ACR"
],
- "severity": "High",
- "subcategory": "Segmentation",
- "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "severity": "Medium",
+ "subcategory": "Cluster architecture",
+ "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "services": [
- "VNet"
- ],
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
+ "link": "",
+ "service": "Azure Service Fabric",
+ "services": [],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Delegate subnet creation to the landing zone owner.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "subcategory": "Workload architecture",
+ "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
+ "link": "",
+ "service": "Azure Service Fabric",
"services": [
- "ACR",
- "VNet"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "subcategory": "Workload architecture",
+ "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"services": [
- "Entra",
- "NVA",
- "VNet"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "subcategory": "Workload architecture",
+ "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "services": [
- "NetworkWatcher",
- "VNet"
- ],
+ "category": "Managed clusters",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
+ "service": "Azure Service Fabric",
+ "services": [],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "subcategory": "Cluster and workload architectures",
+ "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
- "services": [
- "VNet"
- ],
+ "category": "Application Deployment",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
+ "services": [],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "subcategory": "DevOps",
+ "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "services": [
- "VWAN"
- ],
- "severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
- },
- {
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "category": "BC and DR",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"services": [
- "ACR",
- "VWAN"
+ "TrafficManager",
+ "FrontDoor",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Performance"
+ "subcategory": "Disaster Recovery",
+ "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
+ "category": "BC and DR",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"services": [
- "VWAN",
- "Firewall"
+ "ACR"
],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
- "services": [
- "VWAN"
- ],
+ "category": "BC and DR",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
+ "services": [],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "subcategory": "High Availability",
+ "text": "Use more than 1 app instance for your apps",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
+ "category": "Operations",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
"services": [
- "VWAN",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "subcategory": "Monitoring",
+ "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
- "services": [
- "VWAN"
- ],
+ "category": "Operations",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
+ "services": [],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "subcategory": "Scalability",
+ "text": "Set up autoscaling in Spring Cloud Gateway",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
- "services": [
- "ExpressRoute",
- "VWAN",
- "VPN"
- ],
- "severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "category": "Operations",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Scalability",
+ "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
- "services": [
- "VWAN"
- ],
+ "category": "Operations",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
+ "services": [],
"severity": "Medium",
- "subcategory": "Virtual WAN",
- "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "subcategory": "Support",
+ "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "974a759c-763e-47d2-9161-3a7649907e0e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ASB_v1.docx",
"services": [
- "VWAN"
+ "ServiceBus"
],
- "severity": "High",
- "subcategory": "Virtual WAN",
- "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Leverage FTA Handbook.",
"waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "49907e0e-338e-4e25-9c17-d32e8aaab757",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/operational-excellence",
"services": [
- "AzurePolicy"
+ "ServiceBus"
],
- "severity": "High",
- "subcategory": "Governance",
- "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Implement geo-replication on the sender and receiver side to protect against outages and disasters",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "1549ab81-53d8-49f8-ad17-b84b33b5a67f",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "RBAC",
- "AzurePolicy"
+ "ServiceBus",
+ "Storage",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "If you need mission-critical messaging with queues and topics, Service Bus Premium is recommended with Geo-Disaster Recovery.",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "7b9ed5b3-1f38-4c40-9a82-2c2463cf0f18",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "Subscriptions",
- "AzurePolicy"
+ "ServiceBus"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Implement high availability for the Service Bus namespace",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "ac699ef1-d5a8-43de-9de3-2c1881470607",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "AzurePolicy"
+ "ServiceBus"
],
"severity": "High",
- "subcategory": "Governance",
- "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Ensure related messages are delivered in guaranteed order",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "c5c0e4e6-1465-48d2-958e-d67139b82110",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "Subscriptions",
- "AzurePolicy"
+ "ServiceBus"
],
"severity": "Low",
- "subcategory": "Governance",
- "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Evaluate different Java Messaging Service (JMS) features through the JMS API",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "2df26ee4-11e6-4f88-9e52-f4722dd68c5b",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "AzurePolicy"
+ "ServiceBus"
],
- "severity": "High",
- "subcategory": "Governance",
- "text": "Use built-in policies where possible to minimize operational overhead.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Best Practices",
+ "text": "Use .NET Nuget packages to communicate with Service Bus messaging entities",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "5c2521e5-4a69-4b9d-939a-c4e7c68d1d75",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "Subscriptions",
- "Entra",
- "RBAC",
- "AzurePolicy"
+ "ServiceBus"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Implement resilience for transient fault handling when sending or receiving messages",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "description": "This will be turned on automatically for a new SB namespace created from the portal with the Premium SKUs in a zone-enabled region. Both the Service Bus metadata and the messages data are replicated across datacenters in the availability zones configuration",
+ "guid": "338ee253-c17d-432e-aaaa-b7571549ab81",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#availability-zones",
"services": [
- "Subscriptions",
- "AzurePolicy"
+ "ServiceBus",
+ "ACR"
],
- "severity": "Medium",
- "subcategory": "Governance",
- "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Best Practices",
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "description": "If enabled, Implements namespace metadata replication to a secondary region. Does not replicate queue/topic message data. Premium sku only.",
+ "guid": "53d89f89-d17b-484b-93b5-a67f7b9ed5b3",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery",
"services": [
- "AzurePolicy"
+ "ServiceBus",
+ "ASR",
+ "Storage"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Security"
+ "subcategory": "Geo-Disaster Recovery",
+ "text": "Plan for Metadata replication during regional failure",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "description": "If an outage cannot be tolerated, do not use the build-in metadata replication option. Leverage a replication pattern to replicate Service Bus messages across two or more sets of cross-region namespaces",
+ "guid": "1f38c403-a822-4c24-93cf-0f18ac699ef1",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-federation-overview",
"services": [
- "Subscriptions",
- "AzurePolicy"
+ "ServiceBus",
+ "ASR",
+ "ACR"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
- "waf": "Security"
+ "subcategory": "Geo-Disaster Recovery",
+ "text": "Plan for Message replication during regional failure",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus uses a message broker to handle messages that are sent to a Service Bus queue or topic. By default, all messages that are sent to a queue or topic are handled by the same message broker process. This architecture can place a limitation on the overall throughput of the message queue. However, you can also partition a queue or topic when it is created",
+ "guid": "d5a83de4-de32-4c18-a147-0607c5c0e4e6",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/data-partitioning-strategies#partitioning-azure-service-bus",
"services": [
- "AzurePolicy"
+ "ServiceBus",
+ "Storage"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "For applications which require high throughput, use Patritioning ",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "14658d24-58ed-4671-99b8-21102df26ee4",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters",
"services": [
- "AzurePolicy"
+ "ServiceBus"
],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Evaluate Premier-tier benefits of Azure Service Bus",
+ "waf": "Reliability"
},
{
- "category": "Governance",
- "checklist": "Azure Landing Zone Review",
- "guid": "29fd366b-a180-452b-9bd7-954b7700c667",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "11e6f883-e52f-4472-8dd6-8c5b5c2521e5",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-messaging-exceptions",
"services": [
- "Cost",
- "TrafficManager",
- "Monitor"
+ "ServiceBus"
],
- "severity": "Medium",
- "subcategory": "Optimize your cloud investment",
- "text": "Configure 'Actual' and 'Forecasted' Budget Alerts.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Best Practices",
+ "text": "Ensure that Service Bus Messaging Exceptions are handled properly",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "AzurePolicy",
- "Monitor",
- "RBAC",
- "Entra"
+ "ServiceBus",
+ "PrivateLink",
+ "Storage"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Operations"
+ "subcategory": "Best Practices",
+ "text": "Connect to Service Bus with the Advanced Messaging Queue Protocol (AMQP) and use Service Endpoints or Private Endpoints when possible.",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "category": "Operations Management",
+ "checklist": "Service Bus Review Checklist",
+ "guid": "f4564b4d-974a-4759-a763-e7d261613a76",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-performance-improvements?tabs=net-standard-sdk-2",
"services": [
- "Monitor"
+ "ServiceBus"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "severity": "High",
+ "subcategory": "Best Practices",
+ "text": "Review the Best Practices for performance improvements using Service Bus Messaging",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
"services": [
- "Monitor",
- "ARS",
- "AzurePolicy",
- "Storage"
+ "ServiceBus"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Data Protection",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"services": [
- "Monitor",
- "AzurePolicy",
- "VM"
+ "ServiceBus"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "subcategory": "Data Protection",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"services": [
- "VM"
+ "AzurePolicy",
+ "ServiceBus",
+ "TrafficManager",
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Operational compliance",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "subcategory": "Identity and Access Management",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
+ "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
+ "service": "Service Bus",
"services": [
- "VM"
+ "ServiceBus",
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Operational compliance",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "subcategory": "Identity and Access Management",
+ "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
"services": [
- "Monitor",
- "NetworkWatcher"
+ "ServiceBus",
+ "Storage",
+ "Subscriptions",
+ "Entra",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Network Watcher to proactively monitor traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Identity and Access Management",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"services": [
- "Monitor"
+ "ServiceBus",
+ "Monitor",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Monitoring",
- "text": "Use resource locks to prevent accidental deletion of critical shared services.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/effect-deny",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"services": [
- "Monitor",
- "RBAC",
- "AzurePolicy"
+ "ServiceBus",
+ "PrivateLink",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Monitoring",
- "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.",
- "training": "https://learn.microsoft.com/azure/role-based-access-control/deny-assignments?tabs=azure-portal",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "category": "Security",
+ "checklist": "Service Bus Review Checklist",
+ "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"services": [
- "Monitor"
+ "ServiceBus"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-service-health/",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Stream Analytics Review Checklist",
+ "guid": "32e52e36-11c8-418b-8a0b-c511e43a18a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-stream_analytics_v1.docx",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availablity ",
+ "text": "Leverage FTA Resiliency Handbook for Stream Analytics",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "services": [
- "Monitor"
- ],
+ "category": "Operations Management",
+ "checklist": "Stream Analytics Review Checklist",
+ "description": "Azure Stream Analytics provides high availability (99.9% SLA) for jobs and clusters within a region, the details of which are transparent to the end customer. If failures occur within the service, per the documentation �Azure Stream Analytics guarantees exactly once event processing and at-least-once delivery of events, so events are never lost.�",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://azure.microsoft.com/en-in/products/stream-analytics",
+ "services": [],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned.",
- "training": "https://learn.microsoft.com/en-gb/training/modules/incident-response-with-alerting-on-azure/7-actions-and-alert-processing-rules",
- "waf": "Operations"
+ "subcategory": "High Availablity ",
+ "text": "Understand High Availability 99% SLA and use it to plan your DR strategy",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
- "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
- "services": [
- "Monitor"
- ],
+ "category": "Operations Management",
+ "checklist": "Stream Analytics Review Checklist",
+ "description": "Azure Stream Analytics resources (jobs, clusters, etc.) are regional and do not provide automatic geo-failover. However, you can achieve geo-redundancy by deploying identical Stream Analytics jobs in multiple Azure regions. Each job connects to local input and output sources. It is the responsibility of your application to both send input data into the two regional inputs and reconcile between the two regional outputs.",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498e6d",
+ "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy",
+ "services": [],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/",
- "waf": "Operations"
+ "subcategory": "Geo Redundancy",
+ "text": "Plan for Geo Redudancy of the service",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
- "services": [
- "Monitor"
- ],
+ "category": "Operations Management",
+ "checklist": "Stream Analytics Review Checklist",
+ "guid": "b9d37dac-43bc-46cd-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy",
+ "services": [],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Monitor Logs for insights and reporting.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "Operations"
+ "subcategory": "Geo Redundancy",
+ "text": "Depending on your availablity requirement, configure Active/Active configuration or Active/Passive configuration ",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
- "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "32d41e36-11c8-417b-8afb-c410d4391898",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor",
- "Storage"
+ "SQL",
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-extensions/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Restrict use of local users on sql workloads on Synapse",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "cd289bed-6b17-4cb8-8454-61e1aee3453a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/synapse-service-identity?context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Monitor alerts for the generation of operational alerts.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "859c3900-4514-41eb-b010-475d695abd74",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "ec823923-7a15-42d6-ac5e-402925388e5d",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor"
+ "Entra",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied.",
- "training": "https://learn.microsoft.com/training/paths/az-104-monitor-backup-resources/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse also includes Synapse role-based access control (RBAC) roles to manage different aspects of Synapse Studio. Leverage these built-in roles to assign permissions to users, groups, or other security principals to manage who can Publish code artifacts and list or access published code artifacts,Execute code on Apache Spark pools and integration runtimes,Access linked (data) services that are protected by credentials,Monitor or cancel job executions, review job output and execution logs.",
+ "guid": "a9c27d9c-42bb-46cd-8c79-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-understand-what-role-you-need",
+ "service": "Azure Synapse Analytics",
"services": [
+ "Entra",
+ "Storage",
+ "RBAC",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use Azure RBAC to control access on storage and Synapse RBAC to control access on workspace level depending on the personas of the team to fine grain the access on data and compute",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "aa45be6a-8f2d-4896-b0e3-775e6e94e610",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-monitor",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "7f42c78e-78cb-46a2-8ad1-a0916e6a8d8f",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/row-level-security?view=sql-server-ver16&context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor",
- "AzurePolicy"
+ "SQL",
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Deploy AMBA to establish monitoring for platform components of your landing zone - AMBA is a framework solution that is available and provides an easy way to scale alerting by using Azure Policy.",
- "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Implement RLS, CLS and data masking on sql workloads in dedicated sql pool to add additional layer of security",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770",
- "link": "https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create your Azure Synapse workspace, you can choose to associate it to a Microsoft Azure Virtual Network. The Virtual Network associated with your workspace is managed by Azure Synapse. This Virtual Network is called a Managed workspace Virtual Network. This can be selected when deploying a workspace",
+ "guid": "e2436b03-36db-455e-8796-0eee0bdf4cc2",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-vnet?view=sql-server-ver16",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Monitoring Agent (AMA). The Log Analytics agent is deprecated since August 31,2024",
- "training": "https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview#installation",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use managed vnet workspace to restrict the access over public internet",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "0d83fd81-952c-4d47-a6cb-3a930925ef2e",
- "link": "https://learn.microsoft.com/en-gb/azure/storage/common/redundancy-migration?tabs=portal",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "To protect any sensitive data, it's recommended to disable public access to the workspace endpoints entirely. By doing so, it ensures all workspace endpoints can only be accessed using�private endpoints.",
+ "guid": "efc4d761-c31d-425f-bbb4-7a393a040ed3",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-private-endpoints?view=sql-server-ver16",
+ "service": "Azure Synapse Analytics",
"services": [
- "Cost",
- "Storage"
+ "PrivateLink"
],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Ensure that storage accounts are zone or region redundant, Redundancy ensures storage accounts meet availability and durability targets amidst failures, weighing lower costs against higher availability. Locally redundant storage offers the least durability at the lowest cost.",
- "training": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Configure private endpoints to connect to the external services and disable public access",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If public access needs to be enabled, it's highly recommended to configure the IP firewall rules to allow inbound connections only from the specified list of public IP addresses.",
+ "guid": "294798b1-178a-42c5-a46c-eb544350d092",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-ip-firewall",
+ "service": "Azure Synapse Analytics",
"services": [],
- "severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Enable cross-region replication in Azure for BCDR with paired regions.",
- "training": "https://learn.microsoft.com/training/modules/provide-disaster-recovery-replicate-storage-data/",
- "waf": "Reliability"
+ "subcategory": " ",
+ "text": "If enabling public access highly recommended to configure IP firewall rules",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "d234292b-7528-4537-a551-c5bf4e4f1854",
+ "link": "https://learn.microsoft.com/azure/data-factory/create-self-hosted-integration-runtime?tabs=data-factory",
+ "service": "Azure Synapse Analytics",
"services": [
- "Backup"
+ "VM",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Data Protection",
- "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
- "services": [
- "AzurePolicy",
- "VM"
- ],
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This can be done only when deploying the workspace, but Python libraries installed from public repositories like PyPI are not supported. (Think about the limitation before enabling it)",
+ "guid": "287d5cdc-126c-4c03-8af5-b1fc6898a535",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/how-to-create-a-workspace-with-data-exfiltration-protection",
+ "service": "Azure Synapse Analytics",
+ "services": [],
"severity": "Medium",
- "subcategory": "Operational compliance",
- "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "subcategory": " ",
+ "text": "Enable Data Exfiltration Protection (DEP)",
"waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "First layer of encryption is done by Microsoft managed keys, you can add a second layer of encryption using Customer managed Keys",
+ "guid": "e337897e-31b6-47d6-9be5-962a1193846d",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/workspaces-encryption",
+ "service": "Azure Synapse Analytics",
"services": [
- "Monitor",
- "AzurePolicy",
- "VM"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Operational compliance",
- "text": "Monitor VM security configuration drift via Azure Policy.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "subcategory": " ",
+ "text": "Data Encryption at rest using Customer managed Keys for workspace",
"waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse leverages TLS to ensure data is encrypted in motion. SQL dedicated pools support TLS 1.0, TLS 1.1, and TLS 1.2 versions for encryption wherein Microsoft-provided drivers use TLS 1.2 by default. Serverless SQL pool and Apache Spark pool use TLS 1.2 for all outbound connections.",
+ "guid": "697cc391-ed16-4b2d-886f-0a1241bddde6",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/guidance/security-white-paper-data-protection#data-in-transit",
+ "service": "Azure Synapse Analytics",
"services": [
- "ACR",
- "ASR",
- "VM"
+ "SQL"
],
"severity": "Medium",
- "subcategory": "Protect and Recover",
- "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Data Encryption in transit ",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Keyvaults to store your secrets and credentials",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25e4d5",
+ "service": "Azure Synapse Analytics",
"services": [
- "ASR"
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Protect and Recover",
- "text": "Use native PaaS service disaster recovery capabilities. Perform failover testing with these capabilities.",
- "training": "https://learn.microsoft.com/en-us/training/modules/explore-iaas-paas-platform-tools-for-high-availability-disaster-recovery/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Store passwords, secerts and keys in Azure key vault",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
+ "category": " ",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "You can store credentials or secret values in an Azure Key Vault and use them during pipeline execution to pass to your activities.",
+ "guid": "a3aec2c4-e243-46b0-936d-b55e17960eee",
+ "link": "https://learn.microsoft.com/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities",
"services": [
- "Backup"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Protect and Recover",
- "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use Azure Key Vault secrets in pipeline activities"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "0bdf4cc2-efc4-4d76-8c31-d25ffbb47a39",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "AppGW",
- "FrontDoor"
+ "Entra"
],
"severity": "High",
- "subcategory": "App delivery",
- "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Restrict use of local users whereever necessary",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed identities eliminate the need to manage credentials. Managed identities provide an identity for the service instance when connecting to resources that support Microsoft Entra authentication.",
+ "guid": "3a040ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://learn.microsoft.com/azure/data-factory/data-factory-service-identity",
+ "service": "Azure Data Factory",
"services": [
- "WAF",
- "Sentinel",
- "AppGW",
- "FrontDoor"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "App delivery",
- "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
- "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
- "services": [],
- "severity": "Medium",
- "subcategory": "Access control",
- "text": "Determine the incident response plan for Azure services before allowing it into production.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-incident-readiness/",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "service": "Azure Data Factory",
+ "services": [
+ "Entra",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security-zero-trust",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "4e4f1854-287d-45cd-a126-cc032af5b1fc",
+ "service": "Azure Data Factory",
"services": [],
"severity": "Medium",
- "subcategory": "Access control",
- "text": "Apply a zero-trust approach for access to the Azure platform.",
- "training": "https://learn.microsoft.com/training/modules/introduction-zero-trust-best-practice-frameworks/",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Disable access over public internet and configure either firewall rules or trusted services rules"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6898a535-e337-4897-b31b-67d67be5962a",
+ "service": "Azure Data Factory",
"services": [
- "AKV"
+ "VM",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Encryption and keys",
- "text": "Use Azure Key Vault to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create an Azure integration runtime within a Data Factory managed virtual network, the integration runtime is provisioned with the managed virtual network. It uses private endpoints to securely connect to supported data stores.",
+ "guid": "1193846d-697c-4c39-8ed1-6b2d186f0a12",
+ "service": "Azure Data Factory",
"services": [
- "AKV"
+ "PrivateLink",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Use managed vnet IR to restrict the access over public internet for Azure Integration Runtime",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Network Security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed private endpoints are private endpoints created in the Data Factory managed virtual network that establishes a private link to Azure resources. Data Factory manages these private endpoints on your behalf.",
+ "guid": "41bddde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/data-factory/managed-virtual-network-private-endpoint#managed-private-endpoints",
+ "service": "Azure Data Factory",
"services": [
- "AKV",
- "AzurePolicy"
+ "PrivateLink",
+ "EventHubs",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Configure managed private endpoints to connect to resources using managed azure IR",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": " ",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "By using Azure Private Link, you can connect to various platform as a service (PaaS) deployments in Azure via a private endpoint. A private endpoint is a private IP address within a specific virtual network and subnet",
+ "guid": "b47a393a-0804-4272-a479-8b1578b219a4",
+ "link": "https://learn.microsoft.com/azure/data-factory/data-factory-private-link",
"services": [
- "AKV",
- "RBAC",
- "Entra"
+ "PrivateLink",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Configure Private Links to connect to sources in customer Vnet and data factory"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "6ceb5443-5135-4922-9442-93bb628637a5",
+ "service": "Azure Data Factory",
"services": [
"AKV"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Data Encryption at rest by Microsoft managed keys",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "5119b08e-8f58-4543-a7e9-cec166cd072a",
+ "service": "Azure Data Factory",
"services": [
"AKV"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Establish an automated process for key and certificate rotation.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Data Encryption in transit by Microsoft managed keys",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you specify a customer-managed key, Data Factory uses�both�the factory system key and the CMK to encrypt customer data. Missing either would result in Deny of Access to data and factory.",
+ "guid": "f9b241a9-98a5-435e-9378-97e71ca7da8c",
+ "link": "https://learn.microsoft.com/azure/data-factory/enable-customer-managed-key",
+ "service": "Azure Data Factory",
"services": [
- "AKV",
- "PrivateLink",
- "VNet"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "subcategory": " ",
+ "text": "Data Encryption in transit by BYOK (Customer managed keys)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "faa62a15-9495-46da-a7dc-3a23267b2258",
+ "link": "https://learn.microsoft.com/azure/data-factory/store-credentials-in-key-vault, https:/learn.microsoft.com/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities",
+ "service": "Azure Data Factory",
"services": [
- "AKV",
- "Monitor",
- "Entra"
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Store passwords, secrets in Azure Key Vault",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "You can store credentials or secret values in an Azure Key Vault and use them during pipeline execution to pass to your activities.",
+ "guid": "6f4a1652-bddd-4ea8-a487-cdec4861bc3b",
+ "link": "https://learn.microsoft.com/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities",
+ "service": "Azure Data Factory",
"services": [
- "AKV",
- "AzurePolicy"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
- "waf": "Security"
+ "subcategory": " ",
+ "text": "Use Azure Key Vault secrets in pipeline activities"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "16183687-a047-47a2-8994-5bda43334f24",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "You can encrypt and store credentials for any of your on-premises data stores (linked services with sensitive information) on a machine with self-hosted integration runtime.",
+ "guid": "c14aeb7e-66e8-4d9a-9bec-218e6436b173",
+ "link": "https://learn.microsoft.com/azure/data-factory/encrypt-credentials-self-hosted-integration-runtime",
+ "service": "Azure Data Factory",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Encrypt credentials for on-premises using SHIR data stores in Azure Data Factory"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6db55f57-9603-4334-adf9-cc23418db612",
+ "service": "Microsoft Purview",
"services": [
- "AKV"
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Define roles and responsibilities to manage Microsoft Purview in control plane and data plane",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Azure RBACs for this",
+ "guid": "8126504b-b47a-4393-a080-427294798b15",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
"services": [
- "AKV"
+ "Entra",
+ "Subscriptions",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Define roles and tasks required to deploy and manage Microsoft Purview inside an Azure subscription (control plane)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Purview roles for this.",
+ "guid": "78b219a4-6ceb-4544-9513-5922744293bb",
+ "link": "https://learn.microsoft.com/purview/classic-data-governance-permissions#roles, https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
"services": [
- "ACR",
- "AKV",
- "ASR"
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Define roles and task needed to perform data management and governance using Microsoft Purview. (Data plane for Data Map and Data Catalog.)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "628637a5-5119-4b08-b8f5-854387e9cec1",
+ "service": "Microsoft Purview",
"services": [
- "AKV"
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Encryption and keys",
- "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "subcategory": " ",
+ "text": "Assign roles to Microsoft Entra groups instead of assigning roles to individual users.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "66cd072a-f9b2-441a-a98a-535e737897e7",
+ "link": "https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-overview",
+ "service": "Microsoft Purview",
"services": [
"Entra"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "subcategory": " ",
+ "text": "Use Azure�Active Directory Entitlement Management�to map user access to Microsoft Entra groups using Access Packages.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "1ca7da8c-faa6-42a1-9949-56da97dc3a23",
+ "service": "Microsoft Purview",
"services": [
- "Monitor",
- "ARS",
- "Storage"
+ "Entra",
+ "RBAC"
],
- "severity": "Medium",
- "subcategory": "Operations",
- "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Enforce multifactor authentication for Microsoft Purview users, especially, for users with privileged roles such as collection admins, data source admins or data curators.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "267b2258-6f4a-4165-8bdd-dea8a487cdec",
+ "service": "Microsoft Purview",
"services": [
- "Subscriptions",
- "Defender"
+ "Entra"
],
"severity": "High",
- "subcategory": "Operations",
- "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "subcategory": " ",
+ "text": "Use Microsoft Entra ID to provide authentication and authorization to all users, security groups registered in Entra, service principal and managed identities inside collections in Microsoft Purview",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "4861bc3b-c14a-4eb7-b66e-8d9a3bec218e",
+ "service": "Microsoft Purview",
"services": [
- "Subscriptions",
- "Defender"
+ "Entra"
],
"severity": "High",
- "subcategory": "Operations",
- "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "subcategory": " ",
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6436b173-6db5-45f5-9960-3334bdf9cc23",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end",
+ "service": "Microsoft Purview",
"services": [
- "Subscriptions",
- "Defender"
+ "PrivateLink"
],
- "severity": "High",
- "subcategory": "Operations",
- "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Enable�end-to-end network isolation�using Private Link Service. (Microsoft Purview Data Map)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "418db612-8126-4504-ab47-a393a0804272",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access",
+ "service": "Microsoft Purview",
"services": [],
- "severity": "High",
- "subcategory": "Operations",
- "text": "Enable Endpoint Protection on IaaS Servers.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Use�Microsoft Purview Firewall�to disable Public access. (Microsoft Purview Data Map)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "94798b15-78b2-419a-96ce-b54435135922",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
"services": [
- "Monitor",
- "Defender"
+ "PrivateLink",
+ "VM",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "subcategory": " ",
+ "text": "Deploy�Network Security Group (NSG) rules�for subnets where Azure data sources private endpoints, Microsoft Purview private endpoints and self-hosted runtime VMs are deployed. (Microsoft Purview Data Map)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "744293bb-6286-437a-9511-9b08e8f58543",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Microsoft Purview",
"services": [
- "Monitor",
- "Entra"
+ "NVA",
+ "PrivateLink",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "subcategory": " ",
+ "text": "Implement Microsoft Purview with private endpoints managed by a Network Virtual Appliance, such as�Azure Firewall�for network inspection and network filtering. (Microsoft Purview Data Map)",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This private endpoint is also a prerequisite for the portal private endpoint. The Microsoft Purview�portal�private endpoint is required to enable connectivity to Microsoft Purview governance portal using a private network. Microsoft Purview can scan data sources in Azure or an on-premises environment by using ingestion private endpoints. Limitations on using private endpoints https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "87e9cec1-66cd-4072-af9b-241a998a535e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-network",
+ "service": "Microsoft Purview",
"services": [
- "ACR",
- "Entra"
+ "PrivateLink",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Operations",
- "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Deploy private endpoints for Microsoft Purview accounts to add another layer of security, so only client calls that are originated from within the virtual network are allowed to access the Microsoft Purview account",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
- "services": [
- "Entra"
- ],
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access. Limitation to be reviewed: https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "b7bcdb3b-51eb-42ec-84ed-a6e59d8d9a2e",
+ "service": "Microsoft Purview",
+ "services": [],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "subcategory": " ",
+ "text": "Block public access using Microsoft Purview firewall",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
+ "category": "Network security",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "db217e67-6abf-4669-aa48-e5a96f2223ec",
+ "link": "https://learn.microsoft.com/azure/private-link/disable-private-endpoint-network-policy, https:/learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
"services": [
- "Entra"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Operations",
- "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "subcategory": " ",
+ "text": "Use Network Security Groups to filter network traffic to and from Azure resources in an Azure virtual network",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "874a748b-662d-46d1-9051-2a66498f6dfe",
- "link": "https://learn.microsoft.com/azure/event-grid/set-alerts",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-security#apply-security-best-practices-for-self-hosted-runtime-vms",
+ "guid": "e8cb1231-8ca5-4017-b158-e3fb3aa3c2de",
+ "service": "Microsoft Purview",
"services": [
- "Monitor"
+ "VM",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Operations",
- "text": "Use an Azure Event Grid-based solution for log-oriented, real-time alerts.",
- "training": "https://learn.microsoft.com/training/modules/azure-event-grid/",
+ "severity": "High",
+ "subcategory": " ",
+ "text": "If you have sensitive data that cannot leave the boundary of your on-prem vnet it is highly recommended to use SHIR VMs inside your corporate vnet to extract your metadata ",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Metadata is extracted and stored in Microsoft Purview Data Map, if you are not using managed storage account for your Purview account they are open to be accessed by all so implement proper RBACs and retrict the access of Data to only intended users. Applicable to Accounts deployed after December 15, 2023 (or deployed using API version 2023-05-01-preview onwards",
+ "guid": "7f3165c3-a87a-405b-9a20-9949bda47778",
+ "service": "Microsoft Purview",
"services": [
- "Storage"
+ "Storage",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Overview",
- "text": "Enable secure transfer to storage accounts.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Use Azure RBACs to restrict the access of your storage account (not managed by MS) only to intended users.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "f24d1167-85c2-4fa5-9c56-a948008be7d7",
+ "service": "Microsoft Purview",
"services": [
- "Storage"
+ "AKV"
],
- "severity": "High",
- "subcategory": "Overview",
- "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Data in rest is encrypted by microsoft managed keys",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "6f704104-85c1-441f-96d3-c9819911645e",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "27f7b9e9-1be1-4f38-aff3-9812bd463cbb",
+ "service": "Microsoft Purview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Data in transit is encrypted by TLS 1.3",
+ "waf": "Security"
+ },
+ {
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "bc8ac199-ebb9-41a4-9d90-dae2cc881370",
+ "service": "Microsoft Purview",
"services": [
+ "AKV",
"Entra"
],
"severity": "High",
- "subcategory": "Secure privileged access",
- "text": "Separate privileged admin accounts for Azure administrative tasks.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-secure-privileged-access/",
+ "subcategory": " ",
+ "text": "Always use Azure key vaults to store all credentials if not using managed identities or without password need methods",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
+ "category": "Protection against accidential deletion",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6f7c0cba-fe61-4465-add4-57e927139b82",
+ "service": "Microsoft Purview",
"services": [],
"severity": "Medium",
- "subcategory": "Service enablement framework",
- "text": "Plan how new azure services will be implemented.",
+ "subcategory": " ",
+ "text": "Prevent accidental deletion of Microsoft Purview accounts by applying resource Locks",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure Landing Zone Review",
- "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
- "services": [],
+ "category": " ",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-collections#design-recommendations",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4722d928",
+ "link": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access",
+ "service": "Microsoft Purview",
+ "services": [
+ "Entra",
+ "Subscriptions"
+ ],
"severity": "Medium",
- "subcategory": "Service enablement framework",
- "text": "Plan how service request will be fulfilled for Azure services.",
+ "subcategory": " ",
+ "text": "Plan for a break glass strategy for your Microsoft Entra tenant, Azure subscription and Microsoft Purview accounts to prevent tenant-wide account lockout.",
"waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "e85f4226-bf06-4e35-8a8b-7aee4d2d633a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/platform-automation-devops",
- "services": [],
+ "category": "Additional security recommendation",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "15f51296-5398-4e6d-bd23-7dd142b16c21",
+ "service": "Microsoft Purview",
+ "services": [
+ "Defender"
+ ],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Integrate with Microsoft 365 and Microsoft Defender for Cloud",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Separate admin accounts from normal user accounts.",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "service": "Azure Databricks",
+ "services": [
+ "Entra"
+ ],
"severity": "High",
- "subcategory": "DevOps Team Topologies",
- "text": "Ensure you have a cross functional DevOps Platform Team to build, manage and maintain your Azure Landing Zone architecture.",
- "training": "https://learn.microsoft.com/training/modules/choose-an-agile-approach/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "634146bf-7085-4419-a7b5-f96d2726f6da",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
- "services": [],
- "severity": "Low",
- "subcategory": "DevOps Team Topologies",
- "text": "Aim to define functions for Azure Landing Zone Platform team.",
- "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
- "waf": "Operations"
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Databricks supports Microsoft Entra ID conditional access, which allows administrators to control where and when users are permitted to sign in to Azure Databricks. Conditional access policies can restrict sign-in to your corporate network or can require multi-factor authentication (MFA).",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/#single-sign-on",
+ "service": "Azure Databricks",
+ "services": [
+ "Entra",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Configure single sign-on and unified login. Enable multi-factor authentication.",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "a9e65070-c59e-4112-8bf6-c11364d4a2a5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Customers can use the Token Management API or UI controls to enable or disable personal access tokens (PATs) for REST API authentication, limit the users who are allowed to use PATs, set the maximum lifetime for new tokens, and manage existing tokens. Highly-secure customers typically provision a maximum token lifetime for new tokens for a workspace. This feature requires the Premium pricing tier.",
+ "guid": "352beee0-79b5-488d-bfc5-972cd4cd21b0",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/access-control/tokens",
+ "service": "Azure Databricks",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Use token management.",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If you have Databricks administrators who are also normal users of the Databricks platform (for example, there�s a lead data engineer who administers the platform and also does data engineering work), Databricks recommends creating a separate account for administrative tasks. It�s important to note that as part of the Azure RBAC model, users that are given Contributor or above permissions to the Resource Group for a deployed Azure Databricks workspace automatically become administrators when they login to that workspace. Therefore, the same considerations outlined above should be applied to Azure portal users too.",
+ "guid": "77036e5e-6b4b-4fd3-b503-547c1447dc56",
+ "service": "Azure Databricks",
"services": [
+ "Entra",
"RBAC"
],
- "severity": "Low",
- "subcategory": "DevOps Team Topologies",
- "text": "Aim to define functions for application workload teams to be self-sufficient and not require DevOps Platform Team support. Achieve this through the use of custom RBAC role.",
- "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Separate admin accounts from normal user accounts",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "165eb5e9-b434-448a-9e24-178632186212",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
- "services": [],
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "SCIM (System for Cross-domain Identity Management) allows you to sync users and groups from Microsoft Entra ID to Azure Databricks. There are three major benefits of this approach: 1. When you remove a user, the user is automatically removed from Databricks. 2. Users can also be disabled temporarily via SCIM. Customers have used this capability for scenarios where customers believe that an account may be compromised and need to investigate 3. Groups are automatically synchronized Please refer to the documentation for detailed instructions on how to configure SCIM for Azure Databricks. This feature requires the Premium pricing tier",
+ "guid": "028a71ff-f1ce-415d-b3f0-d5e872d42e36",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/users-groups/scim/",
+ "service": "Azure Databricks",
+ "services": [
+ "Entra"
+ ],
"severity": "Medium",
- "subcategory": "DevOps Team Topologies",
- "text": "Use a CI/CD pipeline to deploy IaC artifacts and ensure the quality of your deployment and Azure environments.",
- "training": "https://learn.microsoft.com/training/modules/manage-multiple-environments-using-bicep-azure-pipelines/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "SCIM synchronization of users and groups.",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "0cadb8c7-8fa5-4fbf-8f39-d1fadb3b0460",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "services": [],
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Using either cluster policies or the older cluster ACLs, admins can define what users or groups within the organization are able to create clusters. Cluster ACLs allow you to specify which users can attach a notebook to a given cluster. Note that if a user shares a notebook already attached to a standard mode cluster, the recipient will also be able to execute code on that cluster. This does not apply to clusters that enforce user isolation: SQL Warehouses, high concurrency with table ACLs clusters, and high concurrency with credential passthrough clusters. Customers who use Unity Catalog can also enable single-user clusters to enforce isolation clusters.",
+ "guid": "11cc57b4-a4b1-4410-b43a-58a9c2289b3d",
+ "service": "Azure Databricks",
+ "services": [
+ "EventHubs",
+ "AzurePolicy",
+ "SQL",
+ "Storage",
+ "Entra"
+ ],
"severity": "Medium",
- "subcategory": "DevOps Team Topologies",
- "text": "Include unit tests for IaC and application code as part of your build process.",
- "training": "https://learn.microsoft.com/training/modules/run-quality-tests-build-pipeline/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Limit cluster creation rights.",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
+ "category": " ",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Account admins can configure a workspace setting called RestrictWorkspaceAdmins to restrict workspace admins to only change a job owner to themselves and the job run as setting to a service principal that they have the Service Principal User role on.",
+ "guid": "6b57dfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/workspace-settings/restrict-workspace-admins",
"services": [
- "AKV",
- "VM"
+ "RBAC"
],
"severity": "High",
- "subcategory": "DevOps Team Topologies",
- "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Restrict workspace admins"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "a52e0c98-76b9-4a09-a1c9-6b2babf22ac4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/subscription-vending",
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It�s important to note that even if customers use Azure Key Vault to store their secrets, access controls still need to be defined within Azure Databricks. This is because the same service identity is used to retrieve the secret for all users of an Azure Databricks workspace.",
+ "guid": "8b662d6c-15f5-4129-9539-8e6ded237dd1",
+ "service": "Azure Databricks",
"services": [
- "Subscriptions"
+ "AKV",
+ "Entra"
],
- "severity": "Low",
- "subcategory": "DevOps Team Topologies",
- "text": "Implement automation for new landing zone for applications and workloads through subscription vending.",
- "waf": "Operations"
- },
- {
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "cfe363b5-f579-4284-bc56-a42153e4c10b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
- "services": [],
"severity": "High",
- "subcategory": "Development Lifecycle",
- "text": "Ensure a version control system is used for source code of applications and IaC developed. Microsoft recommends Git.",
- "training": "https://learn.microsoft.com/training/paths/intro-to-vc-git/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Store passwords, secrets in Azure Key Vault",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "c7245dd4-af8a-403a-8bb7-890c1a7cfa9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
- "services": [],
- "severity": "Low",
- "subcategory": "Development Lifecycle",
- "text": "Follow a branching strategy to allow teams to collaborate better and efficiently manage version control of IaC and application Code. Review options such as Github Flow.",
- "training": "https://learn.microsoft.com/training/modules/manage-git-branches-workflows/",
- "waf": "Operations"
+ "category": " ",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "42b16c21-d799-49a6-96f4-389a8f42c78e",
+ "services": [
+ "AKV"
+ ],
+ "severity": "High",
+ "subcategory": " ",
+ "text": "Regenerate/rotate keys if using them periodically"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "12aeea20-9165-4b3e-bdf2-6795fcd3cdbe",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
- "services": [],
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Clusters with user isolation include enforcement such that each user runs as a different non-privileged user account on the cluster host. Languages are also limited to those that can be implemented in an isolated manner (SQL and Python), and Spark APIs must be on an allowlist of those we believe to be isolation-safe.",
+ "guid": "78c06a73-a22a-4495-9e7a-8dc4a20e27c3",
+ "service": "Azure Databricks",
+ "services": [
+ "SQL",
+ "Entra"
+ ],
"severity": "Medium",
- "subcategory": "Development Lifecycle",
- "text": "Adopt a pull request strategy to help keep control of code changes merged into branches.",
- "training": "https://learn.microsoft.com/training/modules/review-azure-infrastructure-changes-using-bicep-pull-requests/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use clusters that support user isolation.",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "2676ae46-65ca-444e-8695-fdddeace4cb1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform",
- "services": [],
+ "category": "Identity and Access Management",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It is against security best practices to tie production workloads to individual user accounts, and so we recommend configuring Service Principals within Databricks. Service Principles separate administrator and user actions from the workload and prevent workloads from being impacted if a user leaves an organization. With Databricks, you can configure jobs to run as service principals and generate Personal Access Tokens for Service Principals.",
+ "guid": "e29711b1-352b-4eee-879b-588defc5972c",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/access-control/",
+ "service": "Azure Databricks",
+ "services": [
+ "Entra",
+ "RBAC"
+ ],
"severity": "Medium",
- "subcategory": "Development Lifecycle",
- "text": "Establish a process for using code to implement quick fixes. Always register quick fixes in your team's backlog so each fix can be reworked at a later point, and you can limit technical debt.",
- "training": "https://learn.microsoft.com/training/modules/branch-merge-git/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Use service principals to run production jobs. Use proper access control for workspace level (ACLs), account level (RBACs) and data level (Unity catalog) security controls",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "2cdc9d99-dbcc-4ad4-97f5-e7d358bdfa73",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
- "services": [],
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "By default, DBFS is a filesystem that is accessible to all users of the given workspace and can be accessed via API. This is not necessarily a major data exfiltration concern as you can limit access to accessing data via the DBFS API or Databricks cli using IP access lists or private network access. However, as use of Azure Databricks grows and more users join a workspace, those users would have access to any data stored in DBFS, creating the potential for undesired information sharing. Databricks recommends that our customers do not store production data in DBFS.",
+ "guid": "d4cd21b0-7703-46e5-b6b4-bfd3d503547c",
+ "service": "Azure Databricks",
+ "services": [
+ "Storage"
+ ],
"severity": "High",
- "subcategory": "Development Strategy",
- "text": "Leverage Declarative Infrastructure as Code Tools such as Azure Bicep, ARM Templates or Terraform to build and maintain your Azure Landing Zone architecture. Both from a Platform and Application workload perspective.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-infrastructure-as-code-using-bicep/",
- "waf": "Operations"
+ "subcategory": " ",
+ "text": "Avoid storing production data in DBFS.",
+ "waf": "Security"
},
{
- "category": "Platform Automation and DevOps",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc87a3bc-c572-4ad2-92ed-8cabab66160f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/landing-zone-security#secure",
- "services": [],
- "severity": "High",
- "subcategory": "Security",
- "text": "Integrate security into the already combined process of development and operations in DevOps to mitigate risks in the innovation process.",
- "training": "https://learn.microsoft.com/training/paths/az-400-implement-security-validate-code-bases-compliance/",
- "waf": "Operations"
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "For the storage accounts that you manage, it is your responsibility to ensure that the storage accounts are protected according to your requirements. Examples might include: Encryption with your customer-managed key, Restrict access to trusted networks with a storage firewall, Anonymous public access is not allowed",
+ "guid": "1447dc56-028a-471f-bf1c-e15dd3f0d5e8",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Azure Databricks",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Encrypt storage and restrict access.",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "fda1dae2-dc95-4d48-a6c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore#geo-backups-and-disaster-recovery",
+ "category": "Data Protection",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Add a customer-managed key for select data stored within the Azure Databricks control plane, such as notebooks, secrets, Databricks SQL queries, and Databricks SQL query history and for the root storage account used for DBFS. Azure Databricks requires access to this key for ongoing operations. You can revoke access to the key to prevent Azure Databricks from accessing encrypted data within the control plane (or in our backups). This is like a �nuclear option� where the workspace ceases to function, but it provides an emergency control for extreme situations. This feature requires the Premium pricing tier.",
+ "guid": "72d42e36-11cc-457b-9a4b-1410e43a58a9",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Azure Databricks",
"services": [
+ "AKV",
+ "SQL",
+ "Storage",
"Backup"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Enable Geo Backup ",
- "waf": "Reliability"
+ "subcategory": " ",
+ "text": "Add a customer-managed key for managed services and workspace storage",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "89e558b9-37d4-4974-b111-2dbd7baf12e7",
- "link": "https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/how-to-use-ci-cd-integration-to-automate-the-deploy-of-a-synapse/ba-p/2248060",
- "services": [],
+ "category": "Networking",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Configure IP access lists that restrict the IP addresses that can authenticate to Databricks at account console and workspace level by checking if the user or API client is coming from a known good IP address range such as a VPN or office network. Established user sessions do not work if the user moves to a bad IP address, such as when disconnecting from the VPN. ",
+ "guid": "277de183-b1ac-4252-a9a9-b64608489a8f",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/front-end/ip-access-list",
+ "service": "Azure Databricks",
+ "services": [
+ "VPN"
+ ],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Integrate with Azure DevOps to deploy Multiple environments",
- "waf": "Reliability"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "b94ef6e0-47d2-4da2-a82b-1cd6d2f54b29",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "services": [],
- "severity": "High",
- "subcategory": "DR",
- "text": "BCDR for Azure Synapse pipelines ",
- "waf": "Reliability"
+ "subcategory": " ",
+ "text": "Enable IP access lists to restrict access to certain IP addresses.",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "769e3a69-1e88-438a-a936-667e13c00567",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "services": [],
- "severity": "High",
- "subcategory": "DR",
- "text": "Use Zone Redudant pipelines in regions supporting Availablity Zones",
- "waf": "Reliability"
+ "category": "Networking",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Private Link provides a private network route from one Azure environment to another. Private Link can be configured both between Azure Databricks users and the control plane, and also between the control plane and the data plane. Between Databricks users and the control plane, Private Link provides strong controls that limit the source for inbound requests. If a company already routes traffic through an Azure environment, they can use Private Link so that the communication between users and the Azure Databricks control plane does not traverse public IP addresses. This feature requires the Premium pricing tier. Use Azure Private Link to connect from Azure Databricks to your Azure resources. Not only does Private Link ensure",
+ "guid": "82db8eb9-d1ba-473b-86a5-a57eba8dd4b3",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/classic/private-link",
+ "service": "Azure Databricks",
+ "services": [
+ "PrivateLink"
+ ],
+ "severity": "Medium",
+ "subcategory": " ",
+ "text": "Configure and use Azure Private Link to access Azure resources.",
+ "waf": "Security"
},
{
"category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "4b1e944a-4598-437e-b7ad-6c6d3b365a5c",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/cicd/source-control",
- "services": [],
- "severity": "Low",
- "subcategory": "DevOps",
- "text": "Create Scripts for all DLL Statements and save in Git Repository ",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
+ "services": [
+ "SQL"
+ ],
+ "severity": "Medium",
+ "subcategory": "Best Practices",
+ "text": "Leverage Flexible Server",
"waf": "Reliability"
},
{
"category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "7acbe48a-be54-4cd7-af2e-87768358c559",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/spark/apache-spark-development-using-notebooks",
- "services": [],
- "severity": "Low",
- "subcategory": "DevOps",
- "text": "When working with Spark Notebooks, make sure to integrate with Git or Azure DevOps",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
+ "services": [
+ "SQL"
+ ],
+ "severity": "High",
+ "subcategory": "Best Practices",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
"category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "775c6ee9-5b86-4ad8-a44c-e3b2b38b875b",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore",
- "services": [],
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
+ "services": [
+ "SQL"
+ ],
"severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Use Dedicated pools",
+ "subcategory": "Best Practices",
+ "text": "Leverage Data-in replication for cross-region DR scenarios",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/analytics/azure-synapse",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b71ca41b-3a80-48f3-a6cd-22cdf197c1cf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
"services": [],
"severity": "Medium",
- "subcategory": "DR",
- "text": "Use Database restore points for Azure Synapse",
- "waf": "Reliability"
+ "subcategory": "App delivery",
+ "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "6abca2a4-fda1-4dae-8dc9-5d48c6c791dc",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/sql/on-demand-workspace-overview",
- "services": [],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
+ "services": [
+ "AppGW"
+ ],
"severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Use Serverless Pools when required",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "Ensure you are using Application Gateway v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "a0f6c565-89e5-458b-a37d-4974e1112dbd",
- "link": "https://learn.microsoft.com/azure/synapse-analytics/quickstart-deployment-template-workspaces",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
"services": [
- "Storage"
+ "LoadBalancer"
],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Use Infrastructure as a Code template to do repeatable deployments",
- "waf": "Reliability"
+ "subcategory": "Load Balancer",
+ "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure Synapse Review Checklist",
- "guid": "7baf12e7-b94e-4f6e-847d-2da2982b1cd6",
- "link": "https://learn.microsoft.com/azure/cosmos-db/synapse-link",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
+ "services": [
+ "LoadBalancer"
+ ],
+ "severity": "Medium",
+ "subcategory": "Load Balancer",
+ "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
+ "services": [
+ "AppGW",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
+ "services": [
+ "VNet",
+ "NVA",
+ "Subscriptions",
+ "AppGW",
+ "Entra",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/application-gateway/tutorial-protect-application-gateway-ddos",
+ "service": "App Gateway",
+ "services": [
+ "DDoS"
+ ],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"services": [],
"severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Make sure to re-eshtablish any Synapse Links",
- "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "subcategory": "App Gateway",
+ "text": "Configure autoscaling with a minimum amount of instances of two.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"services": [
- "AppSvc"
+ "AppGW",
+ "ACR"
],
- "severity": "Low",
- "subcategory": "High Availability",
- "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Deploy Application Gateway across Availability Zones",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
- "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"services": [
- "AppSvc",
- "Backup",
- "ASR"
+ "AppGW",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
- "waf": "Reliability"
+ "subcategory": "App delivery",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
"services": [
- "ACR",
- "AppSvc"
+ "TrafficManager"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
+ "subcategory": "Traffic Manager",
+ "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"services": [
- "AppSvc",
- "Monitor"
+ "Entra",
+ "AVD"
+ ],
+ "severity": "Low",
+ "subcategory": "App delivery",
+ "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "services": [
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
- "waf": "Reliability"
+ "subcategory": "App delivery",
+ "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
"services": [
- "AppSvc",
- "Backup"
+ "LoadBalancer"
],
"severity": "High",
- "subcategory": "Multi-tenant service",
- "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
+ "subcategory": "Load Balancer",
+ "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Monitor"
+ "AppGW",
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "ASR"
+ "AppGW",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Low",
- "subcategory": "High Availability",
- "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "App Gateway",
+ "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
"services": [
- "AppSvc"
+ "AppGW",
+ "WAF"
],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure App Service Review",
- "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "ammp": true,
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
"services": [
- "AppSvc"
+ "AppGW",
+ "AzurePolicy",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "App Gateway",
+ "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Monitor"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Monitor"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "waf": "Security"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "services": [
- "AppSvc",
- "Monitor"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
+ "services": [],
"severity": "Low",
- "subcategory": "Monitoring",
- "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
- "waf": "Reliability"
+ "subcategory": "App Gateway",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "AKV"
+ "AppGW",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "AKV",
- "Entra"
+ "AppGW",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "AKV",
- "Entra"
+ "AppGW",
+ "WAF"
],
- "severity": "High",
- "subcategory": "Data Protection",
- "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
+ "services": [
+ "AppGW",
+ "Sentinel",
+ "WAF"
+ ],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Subscriptions"
+ "AppGW",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
- "waf": "Security"
+ "subcategory": "App Gateway",
+ "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"services": [
- "TrafficManager",
- "AppSvc"
+ "AzurePolicy",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Data Protection",
- "text": "Do not store sensitive data on local disk",
- "waf": "Security"
+ "subcategory": "App Gateway",
+ "text": "Use WAF Policies instead of the legacy WAF configuration.",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"services": [
- "ACR",
- "AppSvc",
- "Entra"
+ "VPN",
+ "ExpressRoute",
+ "AppGW",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Identity and Access Control",
- "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
+ "subcategory": "App Gateway",
+ "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
- "services": [
- "AppSvc",
- "Entra"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways'| extend compliant = (properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443') |where properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443'|distinct id,name,compliant",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
+ "services": [],
"severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Deploy code to App Service from a trusted and secure environment.",
+ "subcategory": "App Gateway",
+ "text": "You should encrypt traffic to the backend servers.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Entra"
+ "WAF"
],
"severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
+ "subcategory": "App Gateway",
+ "text": "You should use a Web Application Firewall.",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "services": [
- "AKV",
- "AppSvc",
- "Entra"
- ],
- "severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Redirect HTTP to HTTPS",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
- "services": [
- "ACR",
- "AppSvc",
- "Entra"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
+ "services": [],
"severity": "High",
- "subcategory": "Identity and Access Control",
- "text": "Pull container images from Azure Container Registry using a Managed Identity.",
+ "subcategory": "App Gateway",
+ "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
- "services": [
- "AppSvc",
- "Entra",
- "Monitor"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "App Gateway",
+ "text": "Create custom error pages to display a personalized user experience",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
+ "services": [],
"severity": "Medium",
- "subcategory": "Logging and Monitoring",
- "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
+ "subcategory": "App Gateway",
+ "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Monitor",
- "Entra"
+ "FrontDoor"
],
"severity": "Medium",
- "subcategory": "Logging and Monitoring",
- "text": "Send App Service activity logs to Log Analytics",
+ "subcategory": "App Gateway",
+ "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Use transport layer load balancing",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "App Gateway",
+ "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "NVA",
- "Firewall",
- "Monitor",
- "VNet"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Network Security",
- "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
+ "subcategory": "App Gateway",
+ "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"services": [
- "AppSvc",
- "Storage",
- "NVA",
- "Firewall",
- "PrivateLink",
- "VNet"
+ "AppGW"
],
"severity": "Low",
- "subcategory": "Network Security",
- "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
+ "subcategory": "App Gateway",
+ "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
"waf": "Security"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "fda1dae2-dc95-4d48-a6c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore#geo-backups-and-disaster-recovery",
"services": [
- "AppSvc",
- "PrivateLink"
+ "Backup"
],
- "severity": "High",
- "subcategory": "Network Security",
- "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Enable Geo Backup ",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
- "services": [
- "AppSvc",
- "FrontDoor",
- "WAF",
- "Monitor",
- "AppGW"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "89e558b9-37d4-4974-b111-2dbd7baf12e7",
+ "link": "https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/how-to-use-ci-cd-integration-to-automate-the-deploy-of-a-synapse/ba-p/2248060",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DevOps",
+ "text": "Integrate with Azure DevOps to deploy Multiple environments",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "b94ef6e0-47d2-4da2-a82b-1cd6d2f54b29",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "services": [],
"severity": "High",
- "subcategory": "Network Security",
- "text": "Use a Web Application Firewall (WAF) in front of App Service.",
- "waf": "Security"
+ "subcategory": "DR",
+ "text": "BCDR for Azure Synapse pipelines ",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc",
- "PrivateLink"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "769e3a69-1e88-438a-a936-667e13c00567",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "services": [],
"severity": "High",
- "subcategory": "Network Security",
- "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
- "waf": "Security"
+ "subcategory": "DR",
+ "text": "Use Zone Redudant pipelines in regions supporting Availablity Zones",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
- "services": [
- "AppSvc",
- "AzurePolicy"
- ],
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "4b1e944a-4598-437e-b7ad-6c6d3b365a5c",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/cicd/source-control",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "DevOps",
+ "text": "Create Scripts for all DLL Statements and save in Git Repository ",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "7acbe48a-be54-4cd7-af2e-87768358c559",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/spark/apache-spark-development-using-notebooks",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "DevOps",
+ "text": "When working with Spark Notebooks, make sure to integrate with Git or Azure DevOps",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "775c6ee9-5b86-4ad8-a44c-e3b2b38b875b",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore",
+ "services": [],
"severity": "Medium",
- "subcategory": "Network Security",
- "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
- "waf": "Security"
+ "subcategory": "High Availablity",
+ "text": "Use Dedicated pools",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
- "services": [
- "WAF",
- "AppSvc"
- ],
- "severity": "High",
- "subcategory": "Network Security",
- "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
- "waf": "Security"
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/analytics/azure-synapse",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DR",
+ "text": "Use Database restore points for Azure Synapse",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "6abca2a4-fda1-4dae-8dc9-5d48c6c791dc",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/sql/on-demand-workspace-overview",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "High Availablity",
+ "text": "Use Serverless Pools when required",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "a0f6c565-89e5-458b-a37d-4974e1112dbd",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/quickstart-deployment-template-workspaces",
"services": [
- "AppSvc",
"Storage"
],
+ "severity": "Medium",
+ "subcategory": "DevOps",
+ "text": "Use Infrastructure as a Code template to do repeatable deployments",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Operations Management",
+ "checklist": "Azure Synapse Review Checklist",
+ "guid": "7baf12e7-b94e-4f6e-847d-2da2982b1cd6",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/synapse-link",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "High Availablity",
+ "text": "Make sure to re-eshtablish any Synapse Links",
+ "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "services": [],
"severity": "High",
- "subcategory": "Network Security",
- "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
+ "category": "BC and DR",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
"services": [
"AppSvc"
],
"severity": "High",
- "subcategory": "Network Security",
- "text": "Turn off remote debugging in production environments.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "category": "Application Deployment",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "CI/CD",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "AppSvc",
- "Defender"
+ "AKV",
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Network Security",
- "text": "Enable Defender for Cloud - Defender for App Service",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Deployment best practices",
+ "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "category": "BC and DR",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
"services": [
- "AppSvc",
- "NVA",
- "EventHubs",
- "WAF",
- "DDoS",
- "AppGW",
- "VNet"
+ "AKV",
+ "ACR"
],
"severity": "Medium",
- "subcategory": "Network Security",
- "text": "Enable DDOS Protection Standard on the WAF VNet",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "category": "BC and DR",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
"services": [
- "ACR",
- "AppSvc",
- "PrivateLink",
- "VNet"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Network Security",
- "text": "Pull container images over a Virtual Network from Azure Container Registry.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
+ "category": "BC and DR",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
"services": [
- "AppSvc"
+ "AKV",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Penetration Testing",
- "text": "Conduct a penetration test on the web application.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
"services": [
- "AppSvc"
+ "AKV",
+ "Backup",
+ "Storage",
+ "Subscriptions",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Vulnerability Management",
- "text": "Deploy validated and vulnerability-scanned code.",
- "waf": "Security"
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
- "AppSvc"
+ "AKV",
+ "ASR"
],
"severity": "High",
- "subcategory": "Vulnerability Management",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
- "waf": "Security"
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
- "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
- "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
- "AppSvc"
+ "AKV",
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
+ "severity": "Low",
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
"waf": "Reliability"
},
{
- "category": "Operations",
- "checklist": "Azure App Service Review",
- "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
- "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "AppSvc",
- "Monitor"
+ "AKV",
+ "Backup",
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
+ "severity": "Low",
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
"waf": "Reliability"
},
{
- "category": "Governance and Security",
- "checklist": "Azure App Service Review",
- "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
- "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "ACR",
- "AppSvc",
+ "AKV",
"Backup",
- "AzurePolicy"
+ "ASR"
],
- "severity": "High",
- "subcategory": "Compliance",
- "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
- "waf": "Governance"
+ "severity": "Low",
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure App Service Review",
- "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
- "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/",
- "service": "App Services",
+ "category": "Management",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"services": [
- "Cost",
- "AppSvc",
- "Monitor"
+ "AKV",
+ "EventHubs",
+ "ASR"
],
- "severity": "Low",
- "subcategory": "Cost Monitoring",
- "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "waf": "Reliability"
},
{
- "category": "Cost Governance",
- "checklist": "Azure App Service Review",
- "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
- "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
- "service": "App Services",
+ "category": "Security",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"services": [
- "Cost",
- "AppSvc",
- "ARS",
- "Storage"
+ "AKV",
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Cost Optimization",
- "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
- "waf": "Cost"
+ "subcategory": "Identity and Access Management",
+ "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
+ "waf": "Security"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "When you are creating a SQL Server on Azure VM, carefully consider the type of workload necessary. If you are migrating an existing environment, collect a performance baseline to determine your SQL Server on Azure VM requirements. If this is a new VM, then create your new SQL Server VM based on your vendor requirements.",
- "guid": "1fc3fc14-eea6-4e69-b8d9-a3eec218e687",
- "link": "https://learn.microsoft.com/sql/dma/dma-sku-recommend-sql-db?view=sql-server-ver16",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD control plane does not offer a financially backed service level agreement. We strive to attain at least 99.9% availability for the Azure Virtual Desktop service URLs. The availability of the session host virtual machines in your subscription is covered by the Virtual Machines SLA. Dependent resources/services and infrastructure availability must be also considered to properly satisfy global high-availability requirements.",
+ "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
+ "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
"services": [
- "SQL",
- "VM"
+ "ASR",
+ "Subscriptions",
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "VM Size",
- "text": "Collect the target workload's performance characteristics and use them to determine the appropriate VM size for your business.",
- "waf": "Performance"
+ "subcategory": "Compute",
+ "text": "Determine the expected High Availability SLA for applications/desktops published through AVD",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "The memory optimized virtual machine sizes are a primary target for SQL Server VMs and the recommended choice by Microsoft. The memory optimized virtual machines offer stronger memory-to-CPU ratios and medium-to-large cache options.Consider Ebdsv5-series series first for most SQL Server workloads.",
- "guid": "e04abe1f-8d39-4fda-9776-8424c116775c",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-vm-size?view=azuresql#memory-optimized",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "'Active-Active' model can be achieved with multiple host pools in different regions. A single Host Pool with VMs from different regions is not recommended. If multiple pools for same users will be used, the problem of how to synchronize/replicate user profiles must be solved. FSLogix Cloud Cache could be used, but need to be carefully reviewed and planned, or customers can decide to do not synchronize/replicate at all. 'Active-Passive' can be achieved using Azure Site Recovery (ASR) or on-demand Pool deployment with automated mechanism. For a detailed discussion on multi-region BCDR, please read the companion article in the 'More Info' column and this FSLogix related page: https://learn.microsoft.com/fslogix/concepts-container-recovery-business-continuity.",
+ "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr",
"services": [
- "SQL",
- "VM"
+ "Storage",
+ "ASR",
+ "VM",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "VM Size",
- "text": "Use memory optimized virtual machine sizes for the best performance of SQL Server workloads.",
- "waf": "Performance"
+ "subcategory": "Compute",
+ "text": "Assess Geo Disaster Recovery requirements for AVD Host Pools",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "To find the most effective configuration for SQL Server workloads on an Azure VM, start by measuring the storage performance of your business application. Once storage requirements are known, select a virtual machine that supports the necessary IOPS and throughput with the appropriate memory-to-vCore ratio.",
- "guid": "2ea55b56-ad48-4408-be72-734b476ba18f",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance#counters-to-measure-application-performance-requirements",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Before approaching Azure Virtual Desktop BCDR planning and design, it is important to initially consider which applications consumed through AVD are critical. You may want to separate them from non-critical apps and use a separate Host Pool with a different disaster recovery approach and capabilities.",
+ "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "SQL",
- "Storage",
- "VM"
+ "ASR",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Determine storage bandwidth and latency requirements for SQL Server data, log, and tempdb files before choosing the disk type.",
- "waf": "Performance"
+ "severity": "Low",
+ "subcategory": "Compute",
+ "text": "Separate critical applications in different AVD Host Pools",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "This provides more dedicated disk IOPS and throughput on the disk level and also allows you to configure the Azure disk host caching setting for each disk to the optimal setting for that data type.",
- "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Each Host Pool can be deployed using Availability Zones (AZ) or Availability Set (AS). To maximize resiliency, usage of AZ is recommended: at Host Pool creation time you can decide to spread Host Pool Session Hosts across all available AZ. Usage of AS will not protect from single datacenter failure, then should be used only in regions where AZ are not available. More details on AZ and AVD in the companion article. For a comparison between AZ and AS you can read here: https://learn.microsoft.com/azure/virtual-machines/availability.",
+ "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262",
"services": [
- "SQL",
- "Storage"
+ "ASR",
+ "ACR",
+ "AVD"
],
"severity": "High",
- "subcategory": "Storage",
- "text": "Place data, log, and tempdb files on separate drives",
- "waf": "Performance"
+ "subcategory": "Compute",
+ "text": "Plan the best resiliency option for AVD Host Pool deployment",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Premium SSD is always recommend as a minimum for SQL Server in order to obtain better performance and lower latency. P30 and P40 are recommended because disk caching is not supported for disks 4 TiB and larger ( P50 and above) and they provide the optimal price to performance ratio",
- "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Backup can be used to protect Host Pool VMs. For Pooled Pools, this is not necessary since should be stateless. Instead, this option can be considered for Personal Host Pools.",
+ "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "SQL",
- "Storage"
+ "Backup",
+ "VM",
+ "ASR",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Storage",
- "text": "For the data drive, use premium P30 and P40 or smaller disks to ensure the availability of cache support",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Compute",
+ "text": "Assess the requirement to backup AVD Session Host VMs",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Log files have primarily write-heavy operations. Therefore, they do not benefit from the ReadOnly cache. Hence evaluate your price vs performance vs capacity and chose the right storage disk.",
- "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Even for Personal Pools, usage of Availability Zones, when available, is recommended. Three possible in-region DR strategies are possible, it is recommended to select the best one based on cost, RTO/RPO, and if it is really necessary to save the entire VM OS disk: (1) create each session host in a specific zone (AZ) and then use Azure Site Recovery (ASR) to replicate to a different zone. (2) Use Azure Backup to backup and restore the specific session host in a different AZ. (3) Create a new session host in a different AZ and rely on FSLogix and/or OneDrive to make data and settings available on the new machine. All options require administrator intervention for DR and direct user assignment at Host Pool level, then must be planned and configured in advance.",
+ "guid": "5da58639-ca3a-4961-890b-29663c5e10d",
+ "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery",
"services": [
- "SQL",
- "Storage",
- "Cost"
+ "Backup",
+ "Cost",
+ "ASR",
+ "VM",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Storage",
- "text": "For the log drive plan for capacity and test performance versus cost while evaluating the premium P30 - P80 disks",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Compute",
+ "text": "Prepare a local DR strategy for Personal Host Pool Session Hosts",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Placing TempDB on the D drive can help performance. Consider the size required and always test performance.",
- "guid": "12f70983-f630-4472-8ee6-9d6b5c2622f5",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If custom images are used to deploy AVD Host Pool VMs, it is important to ensure those artifacts are available in all regions where AVD is deployed. Azure Compute Gallery service can be used to replicate images across all regions where a Host Pool is deployed, with redundant storage and in multiple copies. Please be aware that the Azure Compute Gallery service isn't a global resource. For disaster recovery scenarios, the best practice is to have at least two galleries, in different regions.",
+ "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery",
"services": [
- "SQL",
+ "VM",
"Storage",
- "VM"
+ "ASR",
+ "ACR",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Place tempdb on the local ephemeral SSD (default D:\\) drive for most SQL Server workloads that are not part of Failover Cluster Instance (FCI) after choosing the optimal VM size.",
- "waf": "Performance"
+ "severity": "Low",
+ "subcategory": "Dependencies",
+ "text": "Plan for Golden Image cross-region availability",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Striping Data and Log disk can increase bandwidth. Ensure that VM size also matches expected output",
- "guid": "4b69bad3-4aad-45e8-a78e-1d76667313c4",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If users of the AVD infrastructure need on-premises resource access, high availability of network infrastructure required to connect is also critical and should be considered. Resiliency of authentication infrastructure needs to be assessed and evaluated. BCDR aspects for dependent applications and other resources need to be considered to ensure availability in the secondary DR location.",
+ "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "SQL",
- "Storage",
- "VM"
+ "ASR",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Storage",
- "text": "Stripe multiple Azure data disks using Storage Spaces to increase I/O bandwidth",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Dependencies",
+ "text": "Assess Infrastructure & Application dependencies ",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Your storage caching policy varies depending on the type of SQL Server data files that are hosted on the drive.Enable Read-only caching for the disks hosting SQL Server data files.Reads from cache will be faster than the uncached reads from the data disk.Set the caching policy to None for disks hosting the transaction log. There is no performance benefit to enabling caching for the Transaction log disk.",
- "guid": "05674b5e-985b-4859-a773-e7e261623b77",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Not all data inside FSLogix user profiles may deserve protection from disaster. Additionally, if external storage is used, for example OneDrive or File Servers/Shares, what is remaining in the FSLogix profile is minimal and could be lost in some extreme circumstances. In other cases, data inside the profile can be rebuilt from other storages (for example Outlook Inbox in cached mode).",
+ "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
+ "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt",
"services": [
- "SQL",
"Storage",
- "AzurePolicy"
+ "ASR",
+ "AVD"
],
- "severity": "High",
+ "severity": "Medium",
"subcategory": "Storage",
- "text": "Set host caching to read-only for data file disks and none for log file disks.",
- "waf": "Performance"
+ "text": "Assess which data need to be protected in the Profile and Office Containers",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Check that you storage is in the same region as your VM. For exaplme if your VM is in EAST US 2 ensure your storage is in East US 2.",
- "guid": "5a917e1f-348e-4f35-9c27-d42e8bbac868",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Preventing data loss for critical user data is important, first step is to assess which data need to be saved and protected. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary. Appropriate mechanism must be considered to provide protection for critical user data. Azure Backup service can be used to protect Profile and Office Containers data when stored on Azure Files Standard and Premium tiers. Azure NetApp Files Snapshots and Policies can be used for Azure NetApp Files (all tiers).",
+ "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "SQL",
+ "AzurePolicy",
+ "Backup",
"Storage",
- "VM"
+ "ASR",
+ "AVD"
],
- "severity": "High",
+ "severity": "Medium",
"subcategory": "Storage",
- "text": "Provision the storage account in the same region as the SQL Server VM",
- "waf": "Performance"
+ "text": "Build a backup protection strategy for Profile and Office Containers",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "SQL Server uses extents to store data. These are 64KB in size. Therefore, on a SQL Server machine, the NTFS allocation unit size for hosting SQL database files should be 64 KB.",
- "guid": "155abb91-63e9-4908-ae28-c84c33b6b780",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
- "services": [
- "SQL",
- "Storage"
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "In AVD, multiple replication mechanisms and strategies can be used for user data residing in FSLogix containers: [Profile Pattern #1]: Native Azure storage replication mechanisms, for example Azure Files Standard GRS replication, Azure NetApp Files Cross Region Replication. Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files is recommended. LRS with local-only resiliency can be used if no zone/region protection is required. NOTE: Azure Files Share Standard is LRS/ZRS/GRS, but with 100TB large support enabled only LRS/ZRS are supported. [Profile Pattern #2]: FSLogix Cloud Cache is built in automatic mechanism to replicate containers between different (up to 4) storage accounts. Cloud Cache should be used only when:(1) User Profile or Office containers data availability required high-availability SLA is critical and need to be resilient to region failure. (2) Selected storage option is not able to satisfy BCDR requirements. For example, with Azure File Share Premium tier, or Azure File Share Standard with Large File Support enabled, GRS is not available. (3) When replication between disparate storage is required. [Profile Pattern #3]: Only set up geo disaster recovery for application data and not for user data/profile containers: store important application data in separate storages, like OneDrive or other external storage with its own built-in DR mechanism.",
+ "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
+ "services": [
+ "Storage",
+ "ASR",
+ "AVD"
],
- "severity": "High",
+ "severity": "Medium",
"subcategory": "Storage",
- "text": "Format your data disk to use 64 KB block size (allocation unit size) for all data files placed on a drive other than the temporary D:\\ drive",
- "waf": "Performance"
+ "text": "Assess Profile Container storage replication requirements and resiliency for BCDR purpose",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "It is recommended that you determine BCDR needs and requirements ensuring that you are able to meet you SLAs of the environment.",
- "guid": "8b9fe5c4-2049-4d41-9a92-3c3474d11028",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#azure-only-disaster-recovery-solutions",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "For local disaster recovery, Azure Backup for Azure Files can be used. For cross-region geo disaster recovery: GRS for Azure Files is only available with standard SKU and no large share support, then not suitable in most customer scenarios. If geo-replication is required with Azure File Share Premium, replication with FSLogix Cloud Cache can be evaluated, or 'in-region' Availability Zone (AZ) only resiliency should be considered.",
+ "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
+ "link": "https://docs.microsoft.com/azure/backup/backup-afs",
"services": [
- "SQL",
- "VM"
+ "Backup",
+ "Storage",
+ "ASR",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "HADR",
- "text": "Determine HA/DR requirements for each VM to be migrated.",
+ "subcategory": "Storage",
+ "text": "Review Azure Files disaster recovery strategy",
"waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "When depoying High Availability you need to use availability sets or availability zones to avoid unexpected outages.",
- "guid": "ac6aae01-e6a8-44de-9df4-3d1992481718",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#high-availability-nodes-in-an-availability-set",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Zone Redundant Storage will maximize in-region resiliency for the user profile data. ZRS is supported for premium file shares through the 'FileStorage' storage account kind. ZRS is supported in standard general-purpose v2 storage accounts. Usage of zone redundant storage must be paired with zone redundant deployment of Session Hosts in each Host Pool. ",
+ "guid": "10d4e875-d502-4142-a795-f2b6eff34f88",
+ "link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage",
"services": [
- "SQL",
- "VM"
+ "Storage",
+ "ASR",
+ "AVD"
],
"severity": "High",
- "subcategory": "HADR",
- "text": "Place your VMs in an availability set or different availability zones.",
+ "subcategory": "Storage",
+ "text": "Use Zone Redundant Storage (ZRS) for Azure Files to maximize resiliency",
"waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Prefered option when deploying an Availability Group. The recommended solution is to use multi-subnets when deploying Always on Availability Groups.",
- "guid": "d5d1e5f6-2565-49d3-958f-d77249c93111",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli",
+ "category": "Business Continuity and Disaster Recovery",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "For local disaster recovery, Azure NetApp Files (ANF) native backup is available. ANF is essentially locally redundant, then for cross-region geo disaster recovery it is necessary to use an additional mechanism that is Cross-Region Replication (CRR) https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering. Currently, ANF does not provide replication nor redundancy across different Availability Zones (AZ), only the possibility to select in which single AZ to place the ANF volume: https://learn.microsoft.com/azure/azure-netapp-files/manage-availability-zone-volume-placement.",
+ "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering",
"services": [
- "SQL",
- "VM",
- "LoadBalancer",
- "VNet"
+ "Backup",
+ "Storage",
+ "ASR",
+ "ACR",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "HADR",
- "text": "Deploy your SQL Server VMs to multiple subnets whenever possible to avoid the dependency on an Azure Load Balancer or a distributed network name (DNN) to route traffic to your HADR solution. ( If one is implementing FCI or AG)",
+ "subcategory": "Storage",
+ "text": "Review Azure NetApp Files disaster recovery strategy",
"waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "High availability and disaster recovery (HADR) features, such as the Always On availability group and the failover cluster instance rely on underlying Windows Server Failover Cluster technology. Review the best practices for modifying your HADR settings to better support the cloud environment.",
- "guid": "2d027fe4-12f7-4098-9f63-04722ee69d6b",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#hadr-configuration",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Applications can be preinstalled in the golden image/s, can be attached using MSIX & AppAttach feature or distributed to the session hosts after host pool deployment using traditional software distribution methods.",
+ "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
"services": [
- "SQL",
- "ASR"
+ "AVD"
],
"severity": "High",
- "subcategory": "HADR",
- "text": "Change the cluster to less aggressive parameters to avoid unexpected outages from transient network failures or Azure platform maintenance. ( If one is implementing FCI or AG)",
- "waf": "Reliability"
+ "subcategory": "Golden Images",
+ "text": "Determine how applications will be deployed in AVD Host Pools",
+ "waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Ensure that quorum is set correct for the number of instances deployed.",
- "guid": "5c2622f5-4b69-4bad-94aa-d5e8c78e1d76",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/hadr-cluster-best-practices?view=azuresql-vm&tabs=windows2012#quorum-voting",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Multiple golden images can be required to support different OS versions and/or settings, different groups of applications that must be separated and cannot be included in a single image.",
+ "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
"services": [
- "SQL"
+ "AVD"
],
- "severity": "High",
- "subcategory": "HADR",
- "text": "Configure cluster quorum voting to use 3 or more odd number of votes. Don't assign votes to DR regions. ( If one is implementing FCI or AG)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Golden Images",
+ "text": "Estimate the number of golden images that will be required",
+ "waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "On Azure virtual machines, clusters use a load balancer to hold an IP address that needs to be on one cluster node at a time. In this solution, the load balancer holds the IP address for the virtual network name (VNN) listener for the Always On availability group when the SQL Server VMs are in a single subnet.",
- "guid": "667313c4-0567-44b5-b985-b859c773e7e2",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Determine which Guest OS will be used to deploy each Host Pool: Windows 10 vs. Windows Server, Marketplace vs. Custom images",
+ "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#operating-systems-and-licenses",
"services": [
- "SQL",
- "VM",
- "LoadBalancer",
- "VNet"
+ "AVD"
],
- "severity": "High",
- "subcategory": "HADR",
- "text": "When using the virtual network name (VNN) and Azure Load Balancer to connect to your HADR solution, specify MultiSubnetFailover = true in the connection string, even if your cluster only spans one subnet. ( If one is implementing FCI or AG)",
+ "severity": "Medium",
+ "subcategory": "Golden Images",
+ "text": "Determine which OS image/s you will use for Host Pool deployment",
"waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "SQL Server, Azure SQL Database, and Azure SQL Managed Instance support row and page compression for rowstore tables and indexes, and support columnstore and columnstore archival compression for columnstore tables and indexes.",
- "guid": "61623b77-5a91-47e1-b348-ef354c27d42e",
- "link": "https://learn.microsoft.com/sql/relational-databases/data-compression/data-compression?view=sql-server-ver16",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure VM custom images can be created and stored in different ways: in an Azure Compute Gallery, as a managed image object or as a managed disk in the storage. The recommended way is to use Azure Compute Gallery.",
+ "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries",
"services": [
- "SQL",
- "Storage"
+ "Storage",
+ "VM",
+ "AVD"
],
"severity": "Low",
- "subcategory": "SQL Server",
- "text": "Enable database page compression where appropriate.",
- "waf": "Performance"
+ "subcategory": "Golden Images",
+ "text": "Select the proper store for custom images",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "By default, data and log files are initialized to overwrite any existing data left on the disk from previously deleted files. Data and log files are first initialized by zeroing the files (filling with zeros).In SQL Server, for data files only, instant file initialization (IFI) allows for faster execution of the previously mentioned file operations, since it reclaims used disk space without filling that space with zeros. Instead, disk content is overwritten as new data is written to the files.",
- "guid": "8bbac868-155a-4bb9-863e-9908ae28c84c",
- "link": "https://learn.microsoft.com/sql/relational-databases/databases/database-instant-file-initialization?view=sql-server-ver16",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If custom images will be used, plan for an automated build process. If no pre-existing software factory exists, consider using Custom Image Templates and/or Azure Image Builder to automate the build process.",
+ "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/create-custom-image-templates",
"services": [
- "SQL",
- "Storage"
+ "AVD"
],
- "severity": "High",
- "subcategory": "SQL Server",
- "text": "Enable instant file initialization for data files.",
+ "severity": "Low",
+ "subcategory": "Golden Images",
+ "text": "Design your build process for custom images",
"waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Recommended for best performance and availability migrate all databases to data and log disks",
- "guid": "33b6b780-8b9f-4e5c-9204-9d413a923c34",
- "link": "https://learn.microsoft.com/sql/relational-databases/databases/move-database-files?view=sql-server-ver16",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "There are some known best practices and recommendations for the golden image customization, be sure to check the referenced article.",
+ "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image",
"services": [
- "SQL"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "SQL Server",
- "text": "Move all databases to data disks, including system databases.",
+ "subcategory": "Golden Images",
+ "text": "If custom image will be used, check recommended best practices for AVD on how to build custom image",
"waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "b824546c-e1ae-4e34-93ae-c8239248725d",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#sql-server-features",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "FSLogix stack installed in AVD session hosts does not provide auto-update capability. For this reason, it is recommended to download the latest version of FSLogix and include in the golden image update process.",
+ "guid": "ed5c9027-dd1a-4343-86ca-52b199223186",
+ "link": "https://learn.microsoft.com/fslogix/how-to-install-fslogix",
"services": [
- "SQL",
- "Storage",
- "VM"
+ "AVD"
],
- "severity": "Low",
- "subcategory": "SQL Server",
- "text": "Move SQL Server error log and trace file directories to data disks.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Golden Images",
+ "text": "Include the latest version of FSLogix in the golden image update process",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "d68c5b5c-2925-4394-a69a-9d2799c42bb6",
- "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options#use-",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "This tool-set has been created to automatically apply setting referenced in white paper 'Optimizing Windows 10, version 2004 for a Virtual Desktop Infrastructure (VDI) role': https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Usage of the tool and/or optimizations mentioned in the white-paper should be considered. ",
+ "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
+ "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
"services": [
- "SQL",
- "VM"
+ "RBAC",
+ "AVD"
],
- "severity": "High",
- "subcategory": "SQL Server",
- "text": "Set max SQL Server memory limit to leave enough memory for the Operating System.",
+ "severity": "Low",
+ "subcategory": "Golden Images",
+ "text": "Evaluate the usage of Virtual-Desktop-Optimization-Tool",
"waf": "Performance"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "8d1d7555-6246-4b43-a563-b4dc74a748b6",
- "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If OneDrive is used and included in a golden image, be sure to follow the configuration procedure reported in the companion article in the 'More Info' section. Not in scope in this AVD checklist, but OneDrive optimizations like 'Known Folder Redirection' and 'Files On-Demand' should be evaluated used to reduce the space used in FSLogix profiles and provide a better user experience. OneDrive today is not supported for Remote Apps.",
+ "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode",
"services": [
- "SQL",
- "VM"
+ "Storage",
+ "AVD"
],
- "severity": "High",
- "subcategory": "SQL Server",
- "text": "Enable lock pages in memory.",
- "waf": "Performance"
+ "severity": "Low",
+ "subcategory": "Golden Images",
+ "text": "Determine if Microsoft OneDrive will be part of AVD deployment",
+ "waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "633ad2a0-916a-4664-a8fa-d0e278ee293c",
- "link": "https://learn.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Be sure to review the requirements and configuration procedure contained in the companion article in the 'More Info' column. Since Teams automatic updates will be disabled, it is recommended to check and include Teams latest version in the golden image update process.",
+ "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
"severity": "Low",
- "subcategory": "SQL Server",
- "text": "Enable Query Store on all production SQL Server databases following best practices.",
+ "subcategory": "Golden Images",
+ "text": "Determine if Microsoft Teams will be part of AVD deployment",
"waf": "Performance"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "1bc352ba-aab7-4571-a49a-b8093dc9ec9d",
- "link": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD can support users with different language and localization requirements in the same host pool. This can be done customizing golden images to ensure users can select whichever language they need. The procedure to configure additional language packs in Windows 11 is documented in the reference article.",
+ "guid": "7c336f3b-822a-498e-8cd1-667d1150df4a",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/windows-11-language-packs",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
- "severity": "High",
- "subcategory": "SQL Server",
- "text": "Ensure that all tempdb best practices are followed.",
- "waf": "Performance"
+ "severity": "Low",
+ "subcategory": "Golden Images",
+ "text": "Assess the requirement to support multiple languages",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "1bb73b36-a5a6-47fb-a9ed-5b35478c3479",
- "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "It is highly recommended to use separate storage accounts/shares to store MSIX packages. If necessary, storage can scale out independently and not being impacted by profile I/O activities. Azure offers multiple storage options that can be used for MISX app attach. We recommend using Azure Files or Azure NetApp Files as those options offer the best value between cost and management overhead. ",
+ "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
"services": [
- "SQL",
- "VM"
+ "Cost",
+ "Storage",
+ "AVD"
],
- "severity": "High",
- "subcategory": "SQL Server",
- "text": "Schedule SQL Server Agent jobs to run DBCC CHECKDB, index reorganize, index rebuild, and update statistics jobs.",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "MSIX & AppAttach",
+ "text": "Do not use the same storage account/share as FSLogix profiles",
+ "waf": "Performance"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.",
- "guid": "816b2863-cffe-41ca-a599-ef0d5a73dd4c",
- "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "In the referenced article, we reported few but important performance considerations for MSIX usage in AVD context, be sure to carefully review.",
+ "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "SQL Server",
- "text": "Limit autogrowth of the database and Disable autoshrink",
- "waf": "Operations"
+ "subcategory": "MSIX & AppAttach",
+ "text": "Review performance considerations for MSIX",
+ "waf": "Performance"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Constrained vCPU virtual machines (VMs) are a type of VM where the vCPU count can be constrained to a half or a quarter of the original VM size. This allows customers to reduce the cost of software licensing while maintaining the same memory, storage, and I/O bandwidth",
- "guid": "e36c1c81-770a-4fbc-9c0d-43918648d285",
- "link": "https://learn.microsoft.com/azure/virtual-machines/constrained-vcpu",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "MSIX app attach requires read-only permissions to access the file share. If you're storing your MSIX applications in Azure Files, then for your session hosts, you'll need to assign all session host VMs both storage account role-based access control (RBAC) and file share New Technology File System (NTFS) permissions on the share.",
+ "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
"services": [
- "SQL",
"Storage",
+ "RBAC",
"VM",
- "Cost"
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Cost Optimization",
- "text": "Optimize SQL Server License cost with Constrained vCPU VM's",
- "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "MSIX & AppAttach",
+ "text": "Check proper session host permissions for MSIX share",
+ "waf": "Security"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Azure Hybrid Benefit allows you to exchange your existing licenses for discounted rates on Azure SQL Database and Azure SQL Managed Instance. Y",
- "guid": "7ed67178-b824-4546-ae1a-ee3453aec823",
- "link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "3rd-party software vendor must provide a MSIX package, it is not recommended for customer to attempt the conversion procedure without proper support from the application owner.",
+ "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
"services": [
- "SQL",
- "Cost"
+ "AVD"
],
"severity": "Low",
- "subcategory": "Cost Optimization",
- "text": "Leverage Azure Hybrid benefit to maximize the value of your on premises licenses in the cloud",
+ "subcategory": "MSIX & AppAttach",
+ "text": "MSIX packages for 3rd-party applications",
"waf": "Cost"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "The SQL Server IaaS Agent extension (SqlIaasExtension) runs on SQL Server on Azure Windows Virtual Machines (VMs) to automate management and administration tasks.",
- "guid": "9248725d-d68c-45b5-a292-5394a69a9d27",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql-vm&tabs=azure-cli",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "MSIX app attach doesn't support auto-update for MSIX applications, so they should be disabled.",
+ "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Azure",
- "text": "Register with the SQL IaaS Agent Extension to unlock a number of feature benefits.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "severity": "Low",
+ "subcategory": "MSIX & AppAttach",
+ "text": "Disable auto-update for MSIX packages",
"waf": "Operations"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Accelerated Networking provides consistent ultra-low network latency via Azure's in-house programmable hardware and technologies",
- "guid": "99c42bb6-8d1d-4755-9624-6b438563b4dc",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "In order to leverage MSIX & App Attach, guest OS image for AVD Host pool must be Windows 10/11 Enterprise or Windows 10/11 Enterprise Multi-session, version 2004 or later.",
+ "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Azure",
- "text": "Ensure Accelerated Networking is enabled on the virtual machine.",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "MSIX & AppAttach",
+ "text": "Review operating systems support",
+ "waf": "Reliability"
},
{
- "category": "SQL Server on Azure VM",
- "checklist": "SQL Migration Review",
- "description": "Microsoft Defender detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases on the SQL server.",
- "guid": "74a748b6-633a-4d2a-8916-a66498fad0e2",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Once selected the VM SKU that will be used for Host Pool deployment, it is recommended to use Gen2 type of the SKU for higher security and improved capabilities.",
+ "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
+ "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2",
"services": [
- "SQL",
"VM",
- "Defender"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Azure",
- "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture of your virtual machine deployment.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Session Host",
+ "text": "Evaluate the usage of Gen2 VM for Host Pool deployment",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "There are some PaaS limitations that are introduced in SQL Managed Instance and some behavior changes compared to SQL Server. It is important to review and understand these differences.",
- "guid": "78ee293c-1bc3-452b-aaab-7571849ab809",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server?view=azuresql",
+ "category": "Compute",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "MMR redirects the media content from Session Host to your local machine for faster processing and rendering. It only works when you play media content on Microsoft Edge or Google Chrome. See linked URL for more details.",
+ "guid": "adecb27f-dc40-40f5-aca2-0090f633b1c9",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/multimedia-redirection",
"services": [
- "SQL",
- "EventHubs"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Pre Migration",
- "text": "Review the major differences between SQL Server and Managed Instance",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Session Host",
+ "text": "Consider using MMR (MultiMedia Redirection) to get better video performance on browser",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. It is important to review these limits.",
- "guid": "3dc9ec9d-1bb7-43b3-9a5a-67fba9ed5b35",
- "link": "https://docs.microsoft.com/azure/azure-sql/managed-instance/resource-limits",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. A host pool can be one of two types: Personal and Pooled. Which type to use, and how many, is a key design decision that must be documented and validated. See companion article in 'More Info' column for more details.",
+ "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools",
"services": [
- "SQL"
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "Pre Migration",
- "text": "Review capacity limits for SQL MI",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Performance"
+ "subcategory": "Capacity Planning",
+ "text": "Determine the Host Pool type to use",
+ "waf": "Cost"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "The instance settings between managed instance and your source SQL Server can be different . It is important to review those differences that can impact performance.",
- "guid": "8bc178bd-c5a0-46ca-9144-351e19dd3442",
- "link": "https://medium.com/azure-sqldb-managed-instance/compare-environment-settings-on-sql-server-and-azure-sql-that-may-impact-performance-e90c21fa9b08",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Use your design criteria to determine the number of Host Pools to deploy. This will be based on factors such as different OS images, multi-region support, guest VM hardware differences (such as GPU support or no), different user expectations and uptime requirements (examples might be 'Executives', 'Office Workers', 'Developers', etc.), and Host Pool RDP settings (such as drive redirection support). These will determine the number of host pools as well as how many hosts will be in each pool.",
+ "guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools",
"services": [
- "SQL"
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "Pre Migration",
- "text": "Compare instance settings on SQL Server and Azure SQL MI that may impact performance",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "subcategory": "Capacity Planning",
+ "text": "Estimate the number of different Host Pools to deploy ",
"waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Assess on-premises SQL Server instance(s) migrating to Azure SQL Managed Instance. The assessment workflow helps you to detect issues that block the migration itself and also partially supported and unsupported features",
- "guid": "9eb72281-37a1-451c-9bb4-e4f1814287d5",
- "link": "https://docs.microsoft.com/azure/dms/ads-sku-recommend",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Confirm that the difference between automatic and direct assignment is well understood and the selected option is appropriate for the scenario in question. Automatic is the default setting.",
+ "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
"services": [
- "SQL"
- ],
- "severity": "High",
- "subcategory": "Pre Migration",
- "text": "Run Data Migration assistant or Azure Data Studio Migration Extension to detect compatibility issues that can impact database functionality on Managed Instance",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "AVD"
+ ],
+ "severity": "Low",
+ "subcategory": "Capacity Planning",
+ "text": "For Personal Host Pool type, select the proper assignment type",
"waf": "Operations"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "The SKU recommendation feature can evaluate the source SQL Server performance and utilization characteristics to recommend a right-sized Azure SQL Managed Instance to assist with your migration journey.",
- "guid": "ca8c26c9-b32a-4b5b-afc6-898a135e3378",
- "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Check which one to use and available options, autoscale ignores existing load-balancing algorithms.",
+ "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
"services": [
- "SQL"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Pre Migration",
- "text": "Select the right compute resources for your workload by leveraging the SKU recommendation tools.",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "severity": "Low",
+ "subcategory": "Capacity Planning",
+ "text": "For Pooled Host Pool type, select the best load balancing method",
"waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Review Unsupported Features, Migration Blockers and Breaking Changes for each database from the Assessment",
- "guid": "97e31c67-d68c-4b69-82ac-19f906d697c8",
- "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "The number of cores increase, the system's synchronization overhead also increases. Especially for multiple user's sign-in simultaneously. Make sure not to use a VM that is too large for the session host",
+ "guid": "b3724959-4943-4577-a3a9-e10ff6345f24",
+ "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
"services": [
- "SQL"
+ "VM",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Pre Migration",
- "text": "Review and address the issues highlighted in DMA/Azure Data Studio",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Capacity Planning",
+ "text": "For Pooled Host Pool type, VMs shouldn't have more than 32 cores",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "The SQL Managed Instance default DNS zone .database.windows.net can be changed with your own. However, the managed instance hostname part of its FQDN should remain the same.",
- "guid": "eaded26b-dd18-46f0-ac25-1b999a68af87",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/frequently-asked-questions-faq?view=azuresql-mi#can-a-managed-instance-have-the-same-name-as-a-sql-server-on-premises-instance",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD does not support assigning both the RemoteApp and Desktop Application Group (DAG) in a single host pool to the same set of users. Doing so will cause a single user to have two user sessions in a single host pool. Users aren't supposed to have two active sessions at the same time in the same host pool using the same profile.",
+ "guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups",
"services": [
- "SQL",
- "DNS"
+ "Storage",
+ "AVD"
],
"severity": "High",
- "subcategory": "Pre Migration",
- "text": "Plan for connection string changes as changing a managed instance name is not supported",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
- "waf": "Operations"
+ "subcategory": "Capacity Planning",
+ "text": "Do not use the same Host Pool to offer both full desktops (DAG) and Remote Apps to the same set of users",
+ "waf": "Security"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "There are addional requirements in configuring a vnet and subnet hosting the managed instance.",
- "guid": "c9a7f821-b8eb-48c0-aa77-e25e4d5aeaa8",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-existing-add-subnet?view=azuresql-mi",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "There is a limit of 500 Application Groups that can be created in AVD for each Microsoft Entra ID (former Azure AD) tenant. The limit can be increased (see the companion link for details) but it is not recommended.",
+ "guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits",
"services": [
- "SQL",
- "VNet"
+ "Entra",
+ "ACR",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Pre Migration",
- "text": "Review managed instance VNet requirements",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Operations"
+ "subcategory": "Capacity Planning",
+ "text": "Estimate the number of Application Groups required across all Host Pools in the Microsoft Entra ID tenant",
+ "waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Though it's possible to deploy managed instances to a subnet with a number of IP addresses that's less than the output of the subnet formula, always consider using bigger subnets instead. Using a bigger subnet can help avoid future issues stemming from a lack of IP addresses, such as the inability to create additional instances within the subnet or scale existing instances.",
- "guid": "dc4e2436-bb33-46d7-85f1-7960eee0b9b5",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-subnet-determine-size?view=azuresql-mi",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Applications are grouped under Application Groups as containers for publishing and assigning permissions: we recommend that you do not publish more than 50 applications per application group.",
+ "guid": "fa9f2895-473d-439b-ab8e-5a5cf92c7f32",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations",
"services": [
- "SQL",
- "VNet"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Deployment",
- "text": "Ensure managed instance subnet has sufficient IP addresses available",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Capacity Planning",
+ "text": "Estimate the number of Applications for each Application Group",
+ "waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. SQL Managed Instance can be deployed on multiple hardware configurations.",
- "guid": "c8defc4d-721d-431d-850f-b707ae9eab40",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/resource-limits?view=azuresql-mi#service-tier-characteristics",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "FSLogix is not required for Personal Host Pools since each VM is statically assigned to a single user, then no immediate needs for a roaming profile solution. In some usage scenarios FSLogix can help. For example, a VM can be re-assigned, or user moved to another desktop, or roaming profile can be used to save user profile in a different location for DR purposes.",
+ "guid": "38b19ab6-0693-4992-9394-5590883916ec",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop",
"services": [
- "SQL"
+ "Storage",
+ "VM",
+ "AVD"
+ ],
+ "severity": "Low",
+ "subcategory": "Capacity Planning",
+ "text": "Evaluate the usage of FSLogix for Personal Host Pools",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Use the link provided to set a starting point for SKU decision, then validate using a performance test. Ensure a minimum of four cores for Production is selected per Session Host (multi-session)",
+ "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
+ "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
+ "services": [
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "Pre Migration",
- "text": "Plan between General Purpose and Business Critical tiers of MI",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "subcategory": "Capacity Planning",
+ "text": "Run workload performance test to determine the best Azure VM SKU and size to use",
"waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "The auto-failover groups feature allows you to manage the replication and failover of user databases in a managed instance to a managed instance in another Azure region. Auto-failover groups are designed to simplify deployment and management of geo-replicated databases at scale.",
- "guid": "ed329079-8bc1-478b-bc5a-06ca7144351e",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-sql-mi?view=azuresql-mi&tabs=azure-powershell",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "It is critical to check AVD capacity and limits reported in the referenced article. Additional limits and thresholds apply for network, compute, storage and service management. ",
+ "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations",
"services": [
- "SQL"
+ "Storage",
+ "AVD"
],
"severity": "High",
- "subcategory": "Pre Migration",
- "text": "Based on your RPO/RTO's , determine if Auto failover Group needs to be implemented. If so, plan for the deployment attributes of the second instance.",
- "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/",
+ "subcategory": "Capacity Planning",
+ "text": "Verify AVD scalability limits for the environment",
"waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "There are multiple ways to connect your application to the managed instance. Review and understand the pros and cons and decide on the best approach for your application.",
- "guid": "5d226886-d30b-466c-97be-595190f83845",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Host Pools with GPU require special configuration, please be sure to review the referenced article.",
+ "guid": "c936667e-13c0-4056-94b1-e945a459837e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
"services": [
- "SQL"
+ "AVD"
],
"severity": "Low",
- "subcategory": "Pre Migration",
- "text": "Review the Connectivity Design between Database and Application, test & validate it",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Operations"
+ "subcategory": "Capacity Planning",
+ "text": "Determine if Session Hosts will require GPU",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Compare migration options to choose the path that's appropriate to your business needs.",
- "guid": "c586cb29-1ec1-46a1-b076-ef9f141acdce",
- "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview?view=azuresql-mi#migration-tools",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Whenever is possible, it is recommended to leverage VM SKUs with Accelerated Networking feature. This feature does require specific VM SKU/size and OS versions, please see the list and requirement in the companion article.",
+ "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
"services": [
- "SQL"
+ "VM",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Pre Migration",
- "text": "Plan for the Migration Method. Depending on the DB Size and Application downtime window, select the preferred Migration Method.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Capacity Planning",
+ "text": "Use Azure VM SKUs able to leverage Accelerated Networking",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "After you verify that data is the same on both source and target, you can cut over from the source to the target environment. It's important to plan the cutover process with business / application teams to ensure minimal interruption during cutover doesn't affect business continuity.",
- "guid": "579377bc-db37-451a-a2ac-1fad66e15d4d",
- "link": "https://learn.microsoft.com/azure/dms/tutorial-sql-server-managed-instance-online#performing-migration-cutover",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "For proper planning and deployment, it is important to assess the maximum number of concurrent and total users for each Host Pool. Additionally, users from different regions may require different Host Pools to ensure the best user experience.",
+ "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
"services": [
- "SQL"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Pre Migration",
- "text": "Plan the cutover process with business / application teams to ensure minimal interruption during cutover and it does not affect business continuity.",
- "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
- "waf": "Reliability"
+ "subcategory": "Clients & Users",
+ "text": "Assess how many users will connect to AVD and from which regions",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "A time zone of a managed instance can be set during instance creation only. The default time zone is UTC",
- "guid": "4a2adb1c-3d23-426a-b225-ca44e1695fdd",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/timezones-overview?view=azuresql#set-a-time-zone",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "The dependencies on resources external to the AVD pool should be assessed and reviewed, for example Active Directory, external file shares or other storage, on-premises services and resources, network infrastructure components like VPN and or ExpressRoute, external services and 3rd-party components. For all these resources, latency from the AVD Host Pool needs to be evaluated and connectivity considered. Additionally, BCDR considerations need to be applied to these dependencies as well.",
+ "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json",
"services": [
- "SQL"
+ "VPN",
+ "Storage",
+ "ExpressRoute",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Deployment",
- "text": "Ensure you customize your time zone setting at the instance creation time. One cannot change it later.",
- "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Clients & Users",
+ "text": "Assess external dependencies for each Host Pool",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Server-level collation in Azure SQL Managed Instance can be specified when the instance is created and cannot be changed later.Default server-level collation is SQL_Latin1_General_CP1_CI_AS.",
- "guid": "deace4cb-1deb-44c6-90c3-fc14eebb3693",
- "link": "https://learn.microsoft.com/sql/relational-databases/collations/set-or-change-the-server-collation?view=sql-server-ver16",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD offers a variety of client types (fat, thin, web) to connect over different platforms (Windows, MacOS, iOS, Android). Review limitations of each client and compare multiple options when possible.",
+ "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/users/connect-windows",
"services": [
- "SQL"
+ "AVD"
],
- "severity": "High",
- "subcategory": "Deployment",
- "text": "Ensure you select the right collation setting at the instance creation time. One cannot change it later",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Clients & Users",
+ "text": "Review user client OS used and AVD client type",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "When you're migrating a database protected by Transparent Data Encryption (TDE) to Azure SQL Managed Instance using the native restore option, the corresponding certificate from the SQL Server instance needs to be migrated before database restore.",
- "guid": "829e3eec-2183-4687-a007-7a2b5945bda4",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/tde-certificate-migrate?view=azuresql-mi&tabs=azure-powershell",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Depending on the user locations, and AVD region deployment, users may have a non-optimal experience, hence is important to test as soon as possible in a small PoC environment. Run the 'Azure Virtual Desktop Experience Estimator' tool to select the best Azure region to deploy Host Pools. Beyond 150ms latency, user experience may be not optimal.",
+ "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
+ "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
"services": [
- "SQL",
- "VM"
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Deployment",
- "text": "For TDE Enabled Database, corresponding certificate from the on-premises or Azure VM SQL Server needs to be migrated before database restore",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Clients & Users",
+ "text": "Run a PoC to validate end-to-end user experience and impact of network latency",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "System databases can be restored only from backups that are created on the version of SQL Server that the server instance is currently running. This is not the case when you are migrating to SQL Managed Instance.Azure PowerShell and DBATools PowerShell libraries enable you to easily script and automate and customize all parts of the migration process.",
- "guid": "3334fdf9-1c23-4418-8b65-275269440b4b",
- "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide?view=azuresql-mi#backup-and-restore",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "RDP settings can currently only be configured at the host pool level, not per user/group. If different settings are required for different set of users, it is recommended to create multiple Host Pools.",
+ "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
"services": [
- "SQL",
- "Backup"
+ "AVD"
],
"severity": "Low",
- "subcategory": "Migration",
- "text": "Restore of system databases is not supported. To migrate instance-level objects (stored in master or msdb databases), we recommend to script them out and run T-SQL scripts on the destination instance.",
- "waf": "Operations"
+ "subcategory": "Clients & Users",
+ "text": "Assess and document RDP settings for all user groups",
+ "waf": "Security"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "When using migration options that continuously replicate / sync data changes from source to the target, the source data and schema can change and drift from the target. During data sync, ensure that all changes on the source are captured and applied to the target during the migration process.",
- "guid": "e3d3e084-3276-4d4b-bc01-5bcf219e4a1e",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD is a non-regional service, Host Pools can be created in any region, automatic redirection from closest front-end will happen automatically.",
+ "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
+ "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
"services": [
- "SQL"
+ "AVD"
],
"severity": "High",
- "subcategory": "Migration",
- "text": "Ensure that all changes on the source are captured and applied to the target during the migration process.",
- "waf": "Operations"
+ "subcategory": "General",
+ "text": "Determine in which Azure regions AVD Host Pools will be deployed.",
+ "waf": "Performance"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Ensure that the application is able to succesffuly connect to the managed instance post migration of the databases.",
- "guid": "b5887952-5d22-4688-9d30-b66c57be5951",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD must store metadata to support the service; this is stored in the specified geography. However, this is independent of the regions where Host Pools are located.",
+ "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/data-locations",
"services": [
- "SQL"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Migration",
- "text": "Test Application Connectivity to MI and Databases",
- "waf": "Operations"
+ "subcategory": "General",
+ "text": "Determine metadata location for AVD service",
+ "waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "High availability is a fundamental part of SQL Managed Instance platform that works transparently for your database applications. Failovers from primary to secondary nodes in case of node degradation or fault detection, or during regular monthly software updates are an expected occurrence for all applications using SQL Managed Instance in Azure.",
- "guid": "90f83845-c586-4cb2-a1ec-16a1d076ef9f",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/user-initiated-failover?view=azuresql",
+ "category": "Foundation",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Check for specific VM SKUs, especially if you need GPU or high-specs SKUs, and eventually Azure NetApp Files if used.",
+ "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
+ "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
"services": [
- "SQL"
+ "Storage",
+ "VM",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Post Migration",
- "text": "Consider executing a manual failover on SQL Managed Instance to test for fault and failover resiliency.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "severity": "Low",
+ "subcategory": "General",
+ "text": "Check Azure quotas and availability for specific VM sizes and types in the selected regions",
"waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Ensuring that your applications are failover resilient prior to deploying to production will help mitigate the risk of application faults in production and will contribute to application availability for your customers.",
- "guid": "141acdce-5793-477b-adb3-751ab2ac1fad",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-configure-sql-mi?view=azuresql&tabs=azure-portal#test-failover",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AD DCs in Azure are recommended (at least two in different AZ) to reduce latency for users logging into AVD session hosts, and eventually for Azure NetApp Files and AD integration. A DC need to be able to talk to DCs for ALL child domains. As alternative, on-premise connectivity must be used to reach AD DCs.",
+ "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
+ "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
"services": [
- "SQL",
- "LoadBalancer",
- "EventHubs"
+ "Storage",
+ "Entra",
+ "VNet",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Post Migration",
- "text": "If failover groups have been implemented, Test Manual Failover and Failback and test application connectivity behavior during failover/failback",
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Create at least two Active Directory Domain Controllers (DCs) in Azure VNet environment close to AVD Host Pool",
"waf": "Reliability"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "This provides more dedicated disk IOPS and throughput",
- "guid": "aa359272-8e6e-4205-8726-76ae46691e88",
- "link": "https://techcommunity.microsoft.com/t5/azure-sql-blog/storage-performance-best-practices-and-considerations-for-azure/ba-p/305525",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Recommended to create a separate OU per Host Pool under a separate OU hierarchy. These OUs will contain machine accounts of AVD Session Hosts. ",
+ "guid": "6db55f57-9603-4334-adf9-cc23418db612",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
"services": [
- "SQL",
- "Storage"
+ "Entra",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Post Migration",
- "text": "Optimize Storage Performance for General Purpose Managed Instance",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Create a specific OU in Active Directory for each Host Pool",
+ "waf": "Operations"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "Many organizations have policies that require that certificates or encryption keys be created and managed internally. If your organization has a similar policy, this architecture might apply to you. If your customers require internal management of these items, the architecture also might apply to you.",
- "guid": "35ad9422-23e1-4381-8523-081a94174158",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Carefully review, and potentially block/filter inheritance of GPOs to the OUs containing AVD Host Pools. ",
+ "guid": "7126504b-b47a-4393-a080-327294798b15",
+ "link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
"services": [
- "SQL",
- "AKV",
- "AzurePolicy",
- "Backup"
+ "Entra",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Post Migration",
- "text": "Enable Customer managed TDE for taking your own copy only full backups",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Review Domain GPOs that will be applied to OU and impacting Host Pool Session Hosts functionalities",
+ "waf": "Operations"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "The maintenance window feature provides you with the ability to onboard Azure SQL resource to prescheduled time blocks outside of business hours.",
- "guid": "33ef7ad7-c6d3-4733-865c-7acbe44bbe60",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/planned-maintenance?view=azuresql",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If Active Directory Domain GPOs are used, it is recommended to configure FSLogix using the built-in provided GPO ADMX template referenced in the companion article in the 'More Info' column",
+ "guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f",
+ "link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates",
"services": [
- "SQL"
+ "Entra",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Post Migration",
- "text": "Plan for Azure maintenance events",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "subcategory": "Active Directory",
+ "text": "Configure FSLogix settings using the built-in provided GPO ADMX template",
"waf": "Operations"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "By using the long-term retention (LTR) feature, you can store specified SQL Database and SQL Managed Instance full backups in Azure Blob storage with configured redundancy for up to 10 years.",
- "guid": "9d89f2e8-7778-4424-b516-785c6fa96b96",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "It is recommended to have a specific dedicated account with minimal permissions, and without the default 10 joins limitation. Review the companion article for more details.",
+ "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts",
"services": [
- "SQL",
- "ARS",
- "Backup",
- "Storage"
+ "Entra",
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Post Migration",
- "text": "Configure Long Term backup retention, view backups and restore from backups",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Create a dedicated user account with only permissions to join VM to the domain",
+ "waf": "Security"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "By using Azure Hybrid Benefit, you can achieve cost savings, modernise and maintain a flexible hybrid environment while optimising business applications.",
- "guid": "ad88408f-3727-434c-a76b-a28021459014",
- "link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Avoid granting access per user, instead use AD groups and replicate them using Active Directory Connector (ADC) in Microsoft Entra ID (former Azure AD). ",
+ "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups",
"services": [
- "SQL",
- "Cost"
+ "Entra",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Post Migration",
- "text": "Take advantage of Azure Hybrid Benefit and Azure Reservations where applicable.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)",
+ "waf": "Security"
},
{
- "category": "SQL Managed Instance",
- "checklist": "SQL Migration Review",
- "description": "If you don't have threat protection Advanced Threat Protection is part of the Microsoft Defender for SQL offering, which is a unified package for advanced SQL security capabilities.",
- "guid": "65d38e53-f9cc-4bd8-9926-6acca274faa1",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-overview?view=azuresql",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If Azure Files Active Directory (AD) integration is used, as part of the configuration procedure, an AD account to represent the storage account (file share) will be created. You can choose to register as a computer account or service logon account, see FAQ for details. For computer accounts, there is a default password expiration age set in AD at 30 days. Similarly, the service logon account may have a default password expiration age set on the AD domain or Organizational Unit (OU). For both account types, we recommend you check the password expiration age configured in your AD environment and plan to update the password of your storage account identity of the AD account before the maximum password age. You can consider creating a new AD Organizational Unit (OU) in AD and disabling password expiration policy on computer accounts or service logon accounts accordingly.",
+ "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
+ "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
"services": [
- "SQL",
- "Defender"
+ "Entra",
+ "Storage",
+ "AzurePolicy",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Post Migration",
- "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "severity": "High",
+ "subcategory": "Active Directory",
+ "text": "Review your organization password expiration policy for accounts used by Azure Files AD integration",
"waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "You can configure this using Active Directory Connect (ADC) or Azure AD Domain Services (for hybrid or cloud organizations). Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
+ "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
+ "services": [
+ "Entra",
+ "AVD"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "subcategory": "Active Directory",
+ "text": "A Windows Server Active Directory forest/domain must be in sync with Microsoft Entra ID",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Microsoft Entra ID) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.",
+ "guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338",
+ "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable",
+ "services": [
+ "Storage",
+ "Entra",
+ "AVD"
+ ],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
- },
- {
- "category": "BC and DR",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
- "services": [],
- "severity": "High",
- "subcategory": "High Availability",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "subcategory": "Microsoft Entra ID",
+ "text": "Configure Azure Files share for Microsoft Entra ID (former Azure AD) Kerberos authentication on Microsoft Entra ID Joined scenario",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "An Azure subscription must be parented to the same Microsoft Entra ID (former Azure AD) tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Microsoft Entra ID Domain Services instance.",
+ "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
+ "services": [
+ "Entra",
+ "Subscriptions",
+ "VNet",
+ "AVD"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Learn how to trigger a manual failover.",
+ "subcategory": "Requirements",
+ "text": "A Microsoft Entra ID tenant must be available with at least one subscription linked",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Virtual Desktop supports different types of identities depending on which configuration you choose. Please review the supported scenarios mentioned in the 'More Info' article and document the design decision accordingly in the 'Comment' column. Critically, external identities (B2B or B2C) are not supported. Be sure to review also the list of supported scenarios in https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios.",
+ "guid": "b4ce4781-7557-4a1f-8043-332ae199d44c",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication",
+ "services": [
+ "Entra",
+ "AVD"
+ ],
"severity": "High",
- "subcategory": "High Availability",
- "text": "Learn how to fail back after a failover.",
- "waf": "Reliability"
+ "subcategory": "Requirements",
+ "text": "Review and document your identity scenario",
+ "waf": "Security"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
- "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
- "service": "VMSS",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Users need accounts that are in Microsoft Entra ID (former Azure AD). If you're also using AD DS or Azure AD Domain Services in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Microsoft Entra ID with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Microsoft Entra ID. If you're using Microsoft Entra ID with Azure AD Domain Services, user accounts are synchronized one way from Microsoft Entra ID to Azure AD Domain Services. This synchronization process is automatic. AVD also supports Microsoft Entra ID native accounts with some restrictions. External identities (B2B or B2C) are not supported.",
+ "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
"services": [
- "VM"
+ "Entra",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "VM Scale Sets",
- "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Requirements",
+ "text": "Assess User Account types and requirements",
+ "waf": "Security"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
- "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Microsoft Entra ID (former Azure AD) authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using AD FS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.",
+ "guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso",
"services": [
- "Backup",
- "VM"
+ "Entra",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Virtual Machines",
- "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
+ "severity": "Medium",
+ "subcategory": "Requirements",
+ "text": "If Single-Sign On (SSO) is a requirement, review the supported scenarios and prerequisites",
"waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
- "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Microsoft Entra ID (former Azure AD) Joined or Azure AD Domain Services joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.",
+ "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
"services": [
- "VM"
+ "Entra",
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "Virtual Machines",
- "text": "Use Premium or Ultra disks for production VMs",
- "waf": "Reliability"
+ "subcategory": "Requirements",
+ "text": "Select the proper AVD Session Host domain join type",
+ "waf": "Security"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
- "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
- "service": "VM",
+ "category": "Identity",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Compare self-managed Windows Active Directory Domain Services, Microsoft Entra ID (former Azure AD), and managed Azure AD Domain Services (AAD-DS)",
+ "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
+ "link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
"services": [
- "VM"
+ "Entra",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Virtual Machines",
- "text": "Ensure Managed Disks are used for all VMs",
+ "severity": "Low",
+ "subcategory": "Requirements",
+ "text": "Before using Azure AD Domain Services (AAD-DS) for AVD, be sure to review the limitations.",
"waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
- "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD provides administrative templates for Intune and Active Directory GPO. Using these templates it is possible to centrally control several AVD configuration settings: Graphics related data logging, Screen capture protection, RDP Shortpath for managed networks, Watermarking. See companion article in 'More Info' colum for details. NOTE: FSLogix has its own separate template.",
+ "guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template",
"services": [
- "SQL",
- "Storage",
- "VM"
+ "Entra",
+ "Monitor",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Virtual Machines",
- "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Use built-in provided administrative templates for AVD settings configuration",
+ "waf": "Operations"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
- "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Determine if a configuration management tool is already in place to manage Host Pool VM configuration after initial deployment, For example SCCM/SCOM, Intune/ConfigurationManager, 3rd-party solutions.",
+ "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/management",
"services": [
- "ACR",
- "Storage",
- "VM"
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Virtual Machines",
- "text": "Leverage Availability Zones for your VMs in regions where they are supported",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Plan AVD Session Hosts configuration management strategy",
+ "waf": "Operations"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
- "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "We recommend using Microsoft Intune, if requirements can be satisfied, to manage your Azure Virtual Desktop environment. Review supported scenarios and requirements to enable Intune for AVD Session Host management in the referenced article in the More Info column. Document your choice in the 'Comment' column. In that article, review the different requirements and capabilities for single-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop and multi-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session AVD.",
+ "guid": "63a08be1-6004-4b4a-a79b-f3239faae113",
+ "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop",
"services": [
- "VM"
+ "Monitor",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Virtual Machines",
- "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Evaluate Intune for AVD Session Hosts management",
+ "waf": "Operations"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
- "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "The scaling tool provides a low-cost automation option for customers who want to optimize their session host VM costs. You can use the scaling tool to schedule VMs to start and stop based on Peak and Off-Peak business hours, scale out VMs based on number of sessions per CPU core, scale in VMs during Off-Peak hours, leaving the minimum number of session host VMs running. Not available yet for Personal Host Pool type.",
+ "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios",
"services": [
- "ASR",
- "VM"
+ "Cost",
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Virtual Machines",
- "text": "Avoid running a production workload on a single VM",
+ "severity": "Medium",
+ "subcategory": "Management",
+ "text": "Assess the requirements for host pool auto-scaling capability",
"waf": "Reliability"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
- "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Start VM On Connect lets you reduce costs by enabling end users to turn on their session host virtual machines (VMs) only when they need them. You can then turn off VMs when they're not needed. You can configure Start VM on Connect for personal or pooled host pools using the Azure portal or PowerShell. Start VM on Connect is a host pool wide setting.",
+ "guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect",
"services": [
- "AVS",
- "ASR",
- "VM"
+ "Monitor",
+ "Cost",
+ "VM",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Virtual Machines",
- "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Consider the usage of Start VM on Connect for Personal Host Pools",
+ "waf": "Cost"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
- "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "'Start VM On Connect' provides a smart way to automatically start previously stopped Session Hosts but does not provide a mechanism to shut down when not in used. Administrators are encouraged to configure additional policies to sign users out of their sessions and run Azure automation scripts to de-allocate VMs. Users should be not allowed to shut down their Personal Hosts since will not be able to de-allocate Azure VMs, then billing will still be active with no cost reduction.",
+ "guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them",
"services": [
- "VM"
+ "AzurePolicy",
+ "Monitor",
+ "Cost",
+ "VM",
+ "AVD"
],
"severity": "Low",
- "subcategory": "Virtual Machines",
- "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Evaluate the implementation of an ad-hoc mechanism to shut down Personal AVD Session Hosts",
+ "waf": "Cost"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
- "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
- "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Virtual Desktop billing is mainly based on cost associated to compute, networking and storage resources consumed by Host Pools. In addition to this, costs can be generated by dependent resources, for example VPN or ExpressRoute or vWAN, Active Directory Domain Controllers, DNS, etc. There is no direct cost associated to AVD objects like workspaces, host pools or application groups. To make AVD associated costs more evident and grouped by Host Pool, it is recommended to use 'cm-resource-parent' tag. ",
+ "guid": "51bcafca-476a-48fa-9b91-9645a7679f20",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources",
"services": [
- "ASR",
- "VM"
+ "Monitor",
+ "ExpressRoute",
+ "VPN",
+ "DNS",
+ "Storage",
+ "Cost",
+ "VWAN",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Virtual Machines",
- "text": "Increase quotas in DR region before testing failover with ASR",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Review and adopt suggested Azure Tags for Azure Virtual Desktop",
+ "waf": "Cost"
},
{
- "category": "Compute",
- "checklist": "Resiliency Review",
- "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
- "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
- "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
- "service": "VM",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Advisor analyzes your configurations and telemetry to offer personalized recommendations to solve common problems. With these recommendations, you can optimize your Azure resources for reliability, security, operational excellence, performance, and cost.",
+ "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations",
"services": [
- "VM"
+ "Monitor",
+ "Cost",
+ "Entra",
+ "AVD"
],
"severity": "Low",
- "subcategory": "Virtual Machines",
- "text": "Utilize Scheduled Events to prepare for VM maintenance",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Periodically check Azure Advisor recommendations for AVD",
+ "waf": "Operations"
},
{
- "category": "Data",
- "checklist": "Resiliency Review",
- "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
- "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Customers have several options: Microsoft Configuration Manager, this article explains how to automatically apply updates to a Azure Virtual Desktop session hosts running Windows 10/11: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates, Microsoft Intune: https://docs.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session, Azure Update Management and WSUS for Windows Server OS only (client OS not supported: https://learn.microsoft.com/azure/automation/update-management/operating-system-requirements), 3rd Party tools. Outside an emergency security patching situation, it is recommended to move away from an 'in-place' update strategy patching strategy and adopt a re-imaging approach.",
+ "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
+ "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session",
"services": [
- "Storage"
+ "Monitor",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Storage Accounts",
- "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Plan for a Session Host emergency patching and update strategy",
+ "waf": "Operations"
},
{
- "category": "Data",
- "checklist": "Resiliency Review",
- "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
- "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "The Scheduled Agent Updates feature lets you create up to two maintenance windows per Host Pool to update AVD components at a convenient time. It is recommended to specify maintenance windows then upgrading Session Hosts will not happen during peak business hours. Scheduled Agent Updates is disabled by default. This means that, unless you enable this setting, the agent can get updated at any time by the agent update flighting service.",
+ "guid": "c067939b-e5ca-4698-b9ce-3bd91843e73f",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/scheduled-agent-updates",
"services": [
- "Storage"
+ "Monitor",
+ "AVD"
],
"severity": "Low",
- "subcategory": "Storage Accounts",
- "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "subcategory": "Management",
+ "text": "Configure the Scheduled Agent Updates feature",
"waf": "Reliability"
},
{
- "category": "Data",
- "checklist": "Resiliency Review",
- "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
- "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Host pools are a collection of one or more identical virtual machines within Azure Virtual Desktop environment. We highly recommend you create a validation host pool where service updates are applied first. This allows you to monitor service updates before the service applies them to your standard or non-validation environment.",
+ "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
"services": [
- "Storage"
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Storage Accounts",
- "text": "Enable soft delete for Storage Account Containers",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Management",
+ "text": "Create a validation (canary) Host Pool",
+ "waf": "Operations"
},
{
- "category": "Data",
- "checklist": "Resiliency Review",
- "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
- "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "An AVD Host Pool can be deployed in several ways: Azure Portal, ARM templates, Azure CLI tool, Powershell, manual VM creation with registration token, Terraform, 3rd-party tools. It is important to adopt proper method/s to support automatic deployment through automation and CI/CD tools.",
+ "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops",
"services": [
- "Storage"
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Storage Accounts",
- "text": "Enable soft delete for blobs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Management",
+ "text": "Determine Host Pool deployment strategy",
+ "waf": "Operations"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
- "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "service": "Azure Backup",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "After you register a VM to a host pool within the Azure Virtual Desktop service, the agent regularly refreshes the VM's token whenever the VM is active. The certificate for the registration token is valid for 90 days. Because of this 90-day limit, we recommend VMs to be online for 20 minutes every 90 days so that the machine can refresh its tokens and update the agent and side-by-side stack components.",
+ "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/faq",
"services": [
- "Backup"
+ "Monitor",
+ "VM",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "subcategory": "Management",
+ "text": "Turn on Session Host VMs at least every 90 days for token refresh",
+ "waf": "Operations"
+ },
+ {
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Virtual Desktop Insights is a dashboard built on Azure Monitor Workbooks that helps IT professionals understand their Azure Virtual Desktop environments. Read the referenced article to learn how to set up Azure Monitor for Azure Virtual Desktop to monitor your AVD environments.",
+ "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/insights",
+ "services": [
+ "Monitor",
+ "AVD"
+ ],
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Enable monitoring for AVD",
"waf": "Reliability"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
- "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
- "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
- "service": "Azure Backup",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Azure Virtual Desktop uses Azure Monitor and Log Analytics for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories: Management, Feed, Connections, Host Registration, Errors, Checkpoints. ",
+ "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
"services": [
- "Backup"
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Backup",
- "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Enable diagnostic settings for Workspaces, Host Pools, Application Groups and Host VMs to Log Analytics workspace",
"waf": "Reliability"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
- "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
- "service": "Azure Backup",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "See the referenced article and this additional one to setup proper monitoring and alerting for storage: https://docs.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
+ "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
+ "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
"services": [
+ "Monitor",
"Storage",
- "Backup"
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Backup",
- "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Create alerts on the profile storage to be alerted in case of high usage and throttling",
"waf": "Reliability"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Clearly define your organization's business continuity and disaster recovery requirements for your Azure environment. This includes identifying the critical applications, data, and services that need to be protected, as well as specifying the desired recovery objectives and strategies.",
- "guid": "72e52e36-11dd-458c-9a4b-1521e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-business-continuity-disaster-recovery",
+ "category": "Monitoring and Management",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "You can use Azure Service Health to monitor service issues and health advisories for Azure Virtual Desktop. Azure Service Health can notify you with different types of alerts (for example, email or SMS), help you understand the effect of an issue, and keep you updated as the issue resolves.",
+ "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
"services": [
- "ASR"
+ "Monitor",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Design",
- "text": "Define business continuity and disaster recovery requirements",
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Configure Azure Service Health for AVD alerts ",
"waf": "Reliability"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Ensure that your Azure architectures are designed with a focus on reliability. Consider implementing fault-tolerant mechanisms, redundancy, and resiliency patterns to minimize the impact of failures and maximize the availability of your applications and services.",
- "guid": "c2399c4d-7b67-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/architecture/reliability/architect",
- "services": [],
- "severity": "High",
- "subcategory": "Design",
- "text": "Implement reliability best practices in Azure architectures",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If required to connect to on-premises environment, assess the current connectivity option or plan for the required connectivity (ExpressRoute, Azure S2S or 3rd-party NVA VPN). ",
+ "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
+ "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
+ "services": [
+ "NVA",
+ "VPN",
+ "ExpressRoute",
+ "AVD"
+ ],
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Determine if hybrid connectivity is required to connect to on-premises environment",
"waf": "Reliability"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "IaC configurations can play a role in your disaster recovery plan, particularly in situations where recovery time is not time-sensitive. In the event of infrastructure recreation in a second region, IaC can be used to reproduce the necessary infrastructure.",
- "guid": "fe237de2-43b1-46c3-8d7a-a9b7570449aa",
- "link": "https://learn.microsoft.com/azure/well-architected/devops/automation-infrastructure",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD Host Pools can be deployed in either Azure Virtual WAN or traditional 'Hub & Spoke' network topologies. It is recommended to deploy each Host Pool in a separate 'spoke' VNet, using 'hub' is not recommended.",
+ "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity",
"services": [
- "RBAC",
- "ASR"
+ "VNet",
+ "VWAN",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Implement Infrastructure as Code (IaC) for Rapid Infrastructure Recovery",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Determine Azure Virtual Network (VNet) placement for each AVD Host Pool",
+ "waf": "Performance"
},
{
- "category": "General",
- "checklist": "Resiliency Review",
- "description": "Azure offers region pairs that are geographically separated and can be used for cross-region replication and disaster recovery. These region pairs provide redundancy and protection against regional or large-scale disasters.",
- "guid": "dcb1f7d5-769a-4e56-aba3-8d4a85e2213d",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Evaluate the bandwidth requirements, ensure VPN/ER bandwidth will be enough, ensure proper routing and firewall rules are in place, test end-to-end latency. ",
+ "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
+ "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
"services": [
- "ASR"
+ "VPN",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Multi-region",
- "text": "Plan for cross-region recovery by leveraging region pairs",
+ "subcategory": "Networking",
+ "text": "Assess which on-premises resources are required from AVD Host Pools",
"waf": "Reliability"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "By deploying an Application Gateway with a minimum instance count of two, you will have at least two instances available under normal circumstances. In the event that one of the instances encounters a problem, the other instance will handle the traffic while a new instance is being created. This approach significantly reduces the risk of service disruption and ensures a seamless experience for your users.",
- "guid": "93c76286-37a5-451c-9b04-e4f1854387e5",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant#autoscaling-and-high-availability",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Several options are available. You can use Azure Firewall or equivalent 3rd-party NVA, Network Security Group (NSG) and/or Proxy servers. NSG is not able to enable/disable by URL, only ports and protocols. Proxy should be used only as explicit setting in user browser. Details on using Azure Firewall Premium with AVD are reported in the companion article in the 'More Info' column. Be sure to allow proper access to required AVD URLs. Forced Tunneling to on-premises is not recommended.",
+ "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
+ "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
"services": [
- "AppGW"
+ "NVA",
+ "VNet",
+ "Firewall",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Application Gateways",
- "text": "Deploy Application Gateways with a minimum instance count of 2 to avoid instance provisioning downtime",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Need to control/restrict Internet outbound traffic for AVD hosts?",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "The v2 SKU offers several advantages and critical new features that enhance the availability and resilience of your application infrastructure. One notable feature supported by the v2 SKU is zone redundancy, which allows an Application Gateway deployment to span multiple Availability Zones.",
- "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Required URLs for AVD control plane access by session hosts are documented here: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list. A check tool is available to verify connectivity from the session hosts: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool. Forced Tunneling to on-premises is not recommended.",
+ "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/safe-url-list",
"services": [
- "AppGW",
- "Storage"
+ "AVD"
],
"severity": "High",
- "subcategory": "Application Gateways",
- "text": "Deploy Azure Application Gateway v2 for zone redundancy support",
+ "subcategory": "Networking",
+ "text": "Ensure AVD control plane endpoints are accessible",
"waf": "Reliability"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "Azure Front Door provides automatic failover capabilities, ensuring continuity in the event of a primary region becoming unavailable. However, during the failover process, there may be a brief period (typically 20-60 seconds) when clients cannot reach the application. It is essential to review the Azure Front Door service level agreement (SLA) to determine whether relying solely on Front Door meets your business requirements for high availability. ",
- "guid": "97e31c67-d68c-4f6a-92a1-194956d697dc",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/multi-region#azure-front-door",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Consider the usage of Azure Defender Endpoint or similar 3rd-party agents to control user web navigation, see the Security section for more details.",
+ "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-worldwide",
"services": [
- "FrontDoor"
+ "Defender",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Azure Front Door",
- "text": "Consider a redundant traffic management solution in conjunction with Azure Front Door",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Need to control/restrict Internet outbound traffic only for users on AVD hosts? ",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "By implementing Traffic Manager, you can configure it to continuously monitor the health of your application endpoints and automatically redirect traffic to an alternate endpoint when necessary. This automation minimizes downtime and provides a more seamless experience for your users during disaster recovery scenarios.",
- "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a",
- "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Custom UDR and NSG can be applied to AVD Host Pool subnets, for example to redirect to Azure Firewall or NVA, or to filter/block network traffic. In this case is recommended to carefully review to ensure optimal path for outbound traffic to AVD control plane is used. Service Tags can now be used with UDR and NSG, then AVD management plane traffic can be easily allowed: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list.",
+ "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
+ "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
"services": [
- "TrafficManager",
- "Monitor",
- "DNS",
- "ASR"
+ "NVA",
+ "VNet",
+ "Firewall",
+ "AVD"
],
"severity": "Low",
- "subcategory": "DNS",
- "text": "Plan for automated failover using Traffic Manager for DNS Traffic",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Review custom UDR and NSG for AVD Host Pool subnets",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
- "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "service": "DNS",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Network traffic from AVD Session Host VMs to AVD control plane should be as direct as possible. Redirecting this traffic through a Proxy or Firewall with deep packet inspection and/or SSL termination could cause serious issues and bad customer experience. It is recommended to bypass Proxy and Firewall just for the AVD control plane. User generated traffic surfing the web instead, should be filtered by Firewall and/or redirected to a Proxy. For details and guidelines, please see the companion article in the 'More Info' column.",
+ "guid": "cc6edca0-aeca-4566-9e92-cf246f1465af",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support",
"services": [
- "ACR",
- "DNS",
- "ASR"
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "DNS",
- "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Do not use Proxy servers, SSL termination and Deep Packet Inspection for AVD control plane traffic",
"waf": "Reliability"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
- "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
- "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
- "service": "Data Gateways",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "It is recommended to assess and review networking bandwidth requirements for users, based on the specific workload type. The referenced article provide general estimations and recommendations, but specific measure are required for proper sizing. ",
+ "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth",
"services": [
- "ACR"
+ "VM",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Data Gateways",
- "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Networking",
+ "text": "Check the network bandwidth required for each user and in total for the VM SKU",
+ "waf": "Performance"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "When using ExpressRoute, it's important to design for high availability by incorporating redundancy in both the partner and customer networks. This can include multiple ExpressRoute circuits, redundant connections from your network to Microsoft, and ensuring your on-premises network equipment has redundant connections.",
- "guid": "c0e7c28d-c936-4657-802b-ff4564b0d934",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If Azure Files SMB share will be used to store user profiles via FSLogix, the usage of Private Endpoint (PE) for private access to the storage is recommended. AVD Session Hosts will access the storage using a private IP in the same VNet, a separate subnet is recommended. This feature has an additional cost that must be evaluated. If PE will not be used, at least Service Endpoint is recommended (no cost associated).",
+ "guid": "ec27d589-9178-426d-8df2-ff60020f30a6",
+ "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints",
"services": [
- "ExpressRoute"
+ "VNet",
+ "Storage",
+ "PrivateLink",
+ "Cost",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "Ensure redundancy within both the partner network and customer network when utilizing ExpressRoute for high availability",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Evaluate usage Private Endpoint for Azure Files share",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "The primary circuit should handle regular traffic while the backup circuit stays ready to take over if the primary circuit fails. Utilize BGP attributes to influence routing and designate your primary and backup circuits effectively.",
- "guid": "a359c373-e7dd-4616-83a3-64a907ebae48",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "category": "Networking",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Connections to Azure Virtual Desktop can use TCP or UDP. RDP Shortpath is a feature of AVD that establishes a direct UDP-based transport between a supported Windows Remote Desktop client and session host. if clients have line of sight to AVD session hosts from internal network (VPN usage is not recommended), this feature can provide lower latency and best performances as explained in https://learn.microsoft.com/azure/virtual-desktop/rdp-shortpath?tabs=managed-networks#key-benefits.",
+ "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath",
"services": [
- "ExpressRoute",
- "Backup"
+ "VPN",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "ExpressRoute",
- "text": "When using multiple ExpressRoute circuits ensure that routing allows for a primary and backup",
- "waf": "Reliability"
+ "subcategory": "Networking",
+ "text": "Evaluate usage of RDP ShortPath for clients connecting from managed internal networks",
+ "waf": "Performance"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "S2S VPN connection can provide a cost-effective, resilient backup solution in the event of an ExpressRoute circuit failure. By using S2S VPN as a failover, you can maintain connectivity to your Azure resources without relying solely on ExpressRoute.",
- "guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d",
- "link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Security mechanisms provided by GPO should be used, if available. For example, it is possible to impose desktop screen lock and idle session disconnection time. Existing GPOs applied to on-premises environment should be reviewed and eventually applied also to secure also AVD Hosts when joined to the domain.",
+ "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#establish-maximum-inactive-time-and-disconnection-policies",
"services": [
- "ExpressRoute",
- "VPN",
- "Backup",
- "Cost"
+ "AVD"
],
- "severity": "Low",
- "subcategory": "ExpressRoute",
- "text": "Consider deploying site-to-site VPN as a backup for your ExpressRoute private peering",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Active Directory",
+ "text": "Review Active Directory GPO to secure RDP sessions",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "Standard Load Balancer SKU offers an SLA of 99.99% and a higher level of service availability compared to the Basic Load Balancer SKU.",
- "guid": "778468d5-5a78-45d6-be96-c96ad8844cf3",
- "link": "https://learn.microsoft.com/azure/load-balancer/skus",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Microsoft Defender for Endpoint supports Azure Virtual Desktop for Windows 10/11 Enterprise multi-session. Check article for onboarding non-persistent virtual desktop infrastructure (VDI) devices: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
+ "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus",
"services": [
- "LoadBalancer"
+ "Defender",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Load Balancers",
- "text": "Leverage the Standard SKU for Load Balancers that handle traffic to production applications",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Host Configuration",
+ "text": "Ensure anti-virus and anti-malware solutions are used",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "By configuring the load balancer with a zone-redundant frontend, it can serve zonal resources in any zone with a single IP address. As long as at least one zone remains healthy within the region, the IP address associated with the frontend can survive one or more zone failures. It is recommended to have multiple zonal resources, such as virtual machines from different zones, in the backend pool of the load balancer. ",
- "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Disks in Azure are already encrypted at rest by default with Microsoft managed keys. Host VM OS disk encryption is possible and supported using Azure Disk Encryption (ADE - BitLocker) and Disk Encryption Set (DES - Server Side Encryption), the latter is recommended. Encryption of FSLogix storage using Azure Files can be done using SSE on Azure Storage. For OneDrive encryption, see this article: https://docs.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
+ "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview",
"services": [
- "LoadBalancer",
- "VM"
+ "AKV",
+ "Storage",
+ "VM",
+ "AVD"
],
"severity": "Low",
- "subcategory": "Load Balancers",
- "text": "For load balancers, consider using a zone-redundant frontend with multiple zonal resources in the backend",
- "waf": "Reliability"
+ "subcategory": "Host Configuration",
+ "text": "Assess disk encryption requirements for AVD Session Hosts",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "When designing health probes for your Azure Load Balancer, it is important to follow best practices to ensure reliable and accurate monitoring of your backend instances.",
- "guid": "dccbd979-2a6b-4cca-8b5f-ea1ebf3dd95d",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview#design-guidance",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Trusted launch are Gen2 Azure VMs with enhanced security features aimed to protect against bottom of the stack threats through attack vectors such as rootkits, boot kits, and kernel-level malware. Recommended to enable and leverage Secure Boot, Virtual TPM (vTPM) and Integrity Monitoring.",
+ "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch",
"services": [
- "LoadBalancer",
- "Monitor"
+ "Monitor",
+ "VM",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Load Balancers",
- "text": "Select the right protocol, appropriate intervals and timeouts, representative paths and probe responses when defining Load Balancer Health Probes",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Host Configuration",
+ "text": "Enable Trusted launch in Azure Gen2 VM Session Hosts",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
- "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Trusted Launch and Gen2 VM are not only security and performance enhancing features but also system requirements for Windows 11. When building an AVD environment based on Windows 11, it is essential to enable these features.",
+ "guid": "135d3899-4b31-44d3-bc8f-028871a359d8",
+ "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements",
"services": [
- "NVA"
+ "VM",
+ "AVD"
],
"severity": "High",
- "subcategory": "NVAs",
- "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
- "waf": "Reliability"
+ "subcategory": "Host Configuration",
+ "text": "Enable Trusted Launch and use Gen2 image are system requirements for Windows 11",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "By deploying VPN Gateways in an active-active mode, you can distribute VPN traffic across multiple gateways, improving reliability and ensuring continuous connectivity in case of failures or maintenance.",
- "guid": "927139b8-2110-42db-b6ea-f11e6f843e53",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Displayed content will be automatically blocked or hidden in screenshots. Keep in mind screen sharing will also be blocked when using Teams or other collaboration software which use screen sharing.",
+ "guid": "a49dc137-7896-4343-b2bc-1a31bf1d30b6",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/screen-capture-protection",
"services": [
- "VPN",
- "ACR"
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "VPN Gateways",
- "text": "Deploy Azure VPN Gateways in an active-active mode to ensure high availability and redundancy for your VPN connections.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Host Configuration",
+ "text": "Consider enabling screen capture protection to prevent sensitive information from being captured",
+ "waf": "Security"
},
{
- "category": "Network",
- "checklist": "Resiliency Review",
- "description": "Zone-redundant SKUs ensure that your VPN gateways are physically and logically separated within a region, providing resiliency and scalability. This deployment configuration safeguards your on-premises network connectivity to Azure from zone-level failures.",
- "guid": "f4722d92-8c1b-41cd-921f-54b29b9de39a",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/about-zone-redundant-vnet-gateways",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If not absolutely required, redirecting drives, printers, and USB devices to a user's local device in a remote desktop session should be disabled or highly restricted. Restrict Windows Explorer access by hiding local and remote drive mappings is also a secure measure to adopt preventing users from discovering unwanted information about system configuration and users.",
+ "guid": "7ce2cd20-85b4-4f82-828e-6558736ede6a",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#other-security-tips-for-session-hosts",
"services": [
- "VPN"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "VPN Gateways",
- "text": "Use zone-redundant SKUs when deploying VPN Gateways to enhance resilience and protect against zone-level failures",
- "waf": "Reliability"
+ "subcategory": "Host Configuration",
+ "text": "Restrict device redirection and drive mapping",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Stream Analytics Review Checklist",
- "guid": "32e52e36-11c8-418b-8a0b-c511e43a18a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-stream_analytics_v1.docx",
- "services": [],
- "severity": "High",
- "subcategory": "High Availablity ",
- "text": "Leverage FTA Resiliency Handbook for Stream Analytics",
- "waf": "Reliability"
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "When choosing a deployment model, you can either provide remote users access to entire virtual desktops or only select applications. Remote applications, or RemoteApps, provide a seamless experience as the user works with apps on their virtual desktop. RemoteApps reduce risk by only letting the user work with a subset of the remote machine exposed by the application.",
+ "guid": "4e25d70e-3924-44f4-b66f-d6cdd4f4a973",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview",
+ "services": [
+ "AVD"
+ ],
+ "severity": "Medium",
+ "subcategory": "Management",
+ "text": "When possible, prefer Remote Apps over Full Desktops (DAG)",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Stream Analytics Review Checklist",
- "description": "Azure Stream Analytics provides high availability (99.9% SLA) for jobs and clusters within a region, the details of which are transparent to the end customer. If failures occur within the service, per the documentation �Azure Stream Analytics guarantees exactly once event processing and at-least-once delivery of events, so events are never lost.�",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://azure.microsoft.com/en-in/products/stream-analytics",
- "services": [],
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Web content filtering feature provided by Web Protection capability in Microsoft Defender for Endpoint, can be used to to control user web navigation. If this tool is used, configuration of web filtering for user Internet browsing is recommended. Access by the Guest OS system to required AVD control plane URLs must be guaranteed.",
+ "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview",
+ "services": [
+ "Defender",
+ "AVD"
+ ],
"severity": "Medium",
- "subcategory": "High Availablity ",
- "text": "Understand High Availability 99% SLA and use it to plan your DR strategy",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Need to control/restrict user Internet navigation from AVD session hosts?",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Stream Analytics Review Checklist",
- "description": "Azure Stream Analytics resources (jobs, clusters, etc.) are regional and do not provide automatic geo-failover. However, you can achieve geo-redundancy by deploying identical Stream Analytics jobs in multiple Azure regions. Each job connects to local input and output sources. It is the responsibility of your application to both send input data into the two regional inputs and reconcile between the two regional outputs.",
- "guid": "fc833934-8b26-42d6-ac5f-512925498e6d",
- "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy",
- "services": [],
- "severity": "Medium",
- "subcategory": "Geo Redundancy",
- "text": "Plan for Geo Redudancy of the service",
- "waf": "Reliability"
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "We recommend you don't grant your users admin access to virtual desktops. If you need software packages, we recommend you make them available through configuration management utilities.",
+ "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/security-guide",
+ "services": [
+ "AVD"
+ ],
+ "severity": "High",
+ "subcategory": "Management",
+ "text": "Ensure AVD users will not have local administrator privileges on AVD Hosts",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Stream Analytics Review Checklist",
- "guid": "b9d37dac-43bc-46cd-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy",
- "services": [],
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "We recommend you enable Defender for Cloud for the subscriptions, virtual machines, key vaults, and storage accounts used by AVD. With this tool is possible to assess and manage vulnerabilities, assess compliance with common frameworks like PCI, strengthen the overall security of your AVD environment and measure it over time using 'Secure Score': https://learn.microsoft.com/azure/virtual-desktop/security-guide#improve-your-secure-score.",
+ "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud",
+ "services": [
+ "AKV",
+ "Storage",
+ "Subscriptions",
+ "Defender",
+ "VM",
+ "AVD"
+ ],
"severity": "Medium",
- "subcategory": "Geo Redundancy",
- "text": "Depending on your availablity requirement, configure Active/Active configuration or Active/Passive configuration ",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Enable Microsoft Defender for Cloud to manage AVD Session Hosts security posture",
+ "waf": "Security"
},
{
- "category": "Governance",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Enabling audit log collection lets you view user and admin activity related to Azure Virtual Desktop and store in a central repository like Log Analytics workspace. ",
+ "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs",
"services": [
- "AKV",
- "Backup"
+ "Entra",
+ "Monitor",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Deployment best practices",
- "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Management",
+ "text": "Enable diagnostic and audit logging",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Assign the least privilege required by defining administrative, operations, and engineering roles to Azure RBAC roles. To limit access to high privilege roles within your Azure Virtual Desktop landing zone, consider integration with Azure Privileged Identity Management (PIM). Maintaining knowledge of which team is responsible for each particular administrative area helps you determine Azure role-based access control (RBAC) roles and configuration.",
+ "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/rbac",
"services": [
- "ACR",
- "AKV"
+ "Entra",
+ "RBAC",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "High Availability",
- "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Management",
+ "text": "Assess the requirement to use custom RBAC roles for AVD management",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "AVD users should not have permission to install application. If required, Windows Defender Application Control (WDAC) can be used to control which drivers and applications are allowed to run on their Windows clients. ",
+ "guid": "b9ea80c8-0628-49fc-ae63-125aa4c0a284",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#windows-defender-application-control",
"services": [
- "AKV"
+ "Defender",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
- "waf": "Reliability"
+ "subcategory": "Management",
+ "text": "Restrict users from installing un-authorized applications",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article. Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
+ "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
"services": [
- "AKV",
- "AzurePolicy"
+ "Entra",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "High Availability",
- "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
- "waf": "Reliability"
+ "subcategory": "Microsoft Entra ID",
+ "text": "Evaluate the usage of Multi-Factor Authentication (MFA) and Conditional Access (CA) for AVD users",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "category": "Security",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If Zero Trust is a requirement, review the companion article in the 'More Info' column. It provides steps to apply the principles of Zero Trust to an Azure Virtual Desktop deployment.",
+ "guid": "221102d0-90af-49fc-b2b7-8d3fe397e43",
+ "link": "https://learn.microsoft.com/security/zero-trust/azure-infrastructure-avd",
"services": [
- "Backup",
- "Storage",
- "AKV",
- "Subscriptions",
- "ASR"
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Business continuity and disaster recovery",
- "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "subcategory": "Zero Trust",
+ "text": "Review and Apply Zero Trust principles and guidance",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If used, make sure to check the list of best practices and recommendations described in the referenced article.",
+ "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop",
"services": [
- "AKV",
- "ASR"
+ "Storage",
+ "AVD"
],
- "severity": "High",
- "subcategory": "Business continuity and disaster recovery",
- "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Azure Files",
+ "text": "Check best-practices for Azure Files",
+ "waf": "Performance"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "SMB Multichannel enables clients to use multiple network connections that provide increased performance while lowering the cost of ownership. Increased performance is achieved through bandwidth aggregation over multiple NICs and utilizing Receive Side Scaling (RSS) support for NICs to distribute the IO load across multiple CPUs.",
+ "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
+ "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
"services": [
- "AKV",
- "ASR"
+ "Cost",
+ "Storage",
+ "ACR",
+ "AVD"
],
"severity": "Low",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
- "waf": "Reliability"
+ "subcategory": "Azure Files",
+ "text": "Enable SMB multichannel when using a premium file share to host FSLogix profile containers.",
+ "waf": "Performance"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "If a second region is required for DR purposes verify NetApp availability in there as well.",
+ "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
+ "link": "https://azure.microsoft.com/global-infrastructure/services/",
"services": [
- "AKV",
- "Backup",
- "ASR"
+ "Storage",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "severity": "Medium",
+ "subcategory": "Azure NetApp Files",
+ "text": "If NetApp Files storage is required, check storage service availability in your specific region.",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "CA option is a recommended setting in the FSLogix scenario, as it enables a more resilient SMB session between the Session Host and NetApp Files.",
+ "guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container",
"services": [
- "AKV",
- "Backup",
- "ASR"
+ "Storage",
+ "AVD"
],
- "severity": "Low",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "severity": "Medium",
+ "subcategory": "Azure NetApp Files",
+ "text": "If NetApp Files storage is used enable CA (Continuous Availability) option to increase resiliency",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "An Active Directory Site should be created for the Azure virtual network environment where Azure NetApp Files (ANF) subnet will be created, and that site name should be specified in the ANF connection property when executing the join procedure as explained in the reference article.",
+ "guid": "6647e977-db49-48a8-bc35-743f17499d42",
+ "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
"services": [
- "AKV",
- "ASR",
- "EventHubs"
+ "Storage",
+ "VNet",
+ "AVD"
],
- "severity": "Medium",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "severity": "High",
+ "subcategory": "Azure NetApp Files",
+ "text": "If Azure NetApp Files storage is used, check Active Directory Site name setting in the Active Directory Connection configuration",
"waf": "Reliability"
},
{
- "category": "Security",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Possible options: Standard HDD, Standard SSD, or Premium SSD. Ephemeral disks are not supported, Ultra-Disks not recommended. Recommended to evaluate Premium for OS disk if user density is not low, and if Cloud Cache will be used. ",
+ "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
+ "link": "https://docs.microsoft.com/azure/virtual-machines/disks-types",
"services": [
- "AKV",
- "RBAC",
- "Entra"
+ "Storage",
+ "AVD"
],
"severity": "Medium",
- "subcategory": "Identity and Access Management",
- "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
- "waf": "Security"
+ "subcategory": "Capacity Planning",
+ "text": "Determine which type of managed disk will be used for the Session Hosts",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
- "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Possible options are: Azure NetApp Files, Azure Files, VM based File Server. File-server it is not recommended. Azure Files Premium typically a good starting point. NetApp usually required for large scale / high-performant environment. For a detailed comparison see the article in the 'More Info' column.",
+ "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
"services": [
- "Cost",
- "Storage"
+ "Storage",
+ "VM",
+ "AVD"
],
- "subcategory": "Replication",
- "text": "Leverage External Tables and Continuous data export overview to reduce costs",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Capacity Planning",
+ "text": "Determine which storage backend solution will be used for FSLogix Profiles",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
- "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
- "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Every Host Pool should use a separate set of storage accounts/volumes (at least one) and shares. Users should have a different profile for each Host Pool since settings and configurations are specific to each Host Pool. Additionally, accessing different Host Pools at the same time can cause errors on the shared user profile VHD/X. Usage of different storage accounts/volumes for multiple shares is also recommended to scale independently.",
+ "guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
"services": [
- "Storage"
+ "Storage",
+ "AVD"
],
- "subcategory": "Replication",
- "text": "To share data, explore Leader-follower cluster configuration",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Capacity Planning",
+ "text": "Do not share storage and profiles between different Host Pools",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
- "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "As a starting point for estimating profile container storage performance requirements we recommend to assume 10 IOPS per user in the steady state and 50 IOPS per user during sign-in/sign-out. Space requirements is simply obtained based on the maximum profiles size in FSLogix per the total number of users for each Host Pool. Multiple storage accounts can be used for the same Host Pool if required.",
+ "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
+ "link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-",
"services": [
- "ASR"
+ "Storage",
+ "AVD"
],
- "subcategory": "Replication",
- "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "severity": "High",
+ "subcategory": "Capacity Planning",
+ "text": "Verify storage scalability limits and Host Pool requirements",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Avoid introducing additional latency and costs associated with cross-region network traffic where possible.",
+ "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
+ "link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
"services": [
+ "Cost",
"Storage",
- "RBAC"
+ "AVD"
],
- "subcategory": "Replication",
- "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Capacity Planning",
+ "text": "For optimal performance, the storage solution and the FSLogix profile container should be in the same Azure region.",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
- "service": "Azure Data Explorer",
- "services": [],
- "subcategory": "Replication",
- "text": "Ingest data into each cluster in parallel",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "The recommendation in Azure Virtual Desktop is to use Profile Container without Office Container (ODFC) split unless you are planning for specific Business Continuity and Disaster Recovery (BCDR) scenarios as described in the Disaster Recovery section below. https://docs.microsoft.com/fslogix/profile-container-office-container-cncpt ",
+ "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
+ "link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers",
+ "services": [
+ "Storage",
+ "ASR",
+ "AVD"
+ ],
+ "severity": "High",
+ "subcategory": "FSLogix",
+ "text": "Do not use Office Containers (ODFC) if not strictly required and justified",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
- "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Make sure to configure the following antivirus exclusions for FSLogix Profile Container virtual hard drives, as documented in the referenced article in the 'More Info' column.",
+ "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
+ "link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions",
"services": [
- "ACR"
+ "Storage",
+ "AVD"
],
- "subcategory": "DR Configuration",
- "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "FSLogix",
+ "text": "Configure the recommended antivirus exclusions for FSLogix (includes not scanning VHD(x) files on connect).",
+ "waf": "Security"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
- "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Profile containers have a default max size of 30GB. If large Profile Containers are anticipated, and customers wants to try to keep them small, consider using OneDrive to host Office 365 files outside the FSLogix profile.",
+ "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
+ "link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference",
"services": [
- "ACR"
+ "Storage",
+ "AVD"
],
- "subcategory": "DR Configuration",
- "text": "For critical applications, create Active-Active configuration in two paired regions",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "FSLogix",
+ "text": "Review and confirm configured maximum profile size in FSLogix",
+ "waf": "Cost"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
- "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
- "service": "Azure Data Explorer",
- "services": [],
- "subcategory": "DR Configuration",
- "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Defaults and recommended settings are reported in the companion article in the 'More Info' column. If not recommended keys and/or values must be used, be sure to review with a Microsoft AVD expert and clearly document your choices.",
+ "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
+ "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples",
+ "services": [
+ "AKV",
+ "Storage",
+ "ACR",
+ "AVD"
+ ],
+ "severity": "High",
+ "subcategory": "FSLogix",
+ "text": "Review FSLogix registry keys and determine which ones to apply",
"waf": "Reliability"
},
{
- "category": "BC and DR",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
- "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Concurrent or multiple connections are not recommended in Azure Virtual Desktop. Concurrent connections are also not supported by Session Hosts running in an Azure Virtual Desktop Host Pool. OneDrive, if used, doesn't support concurrent or multiple connections using the same container, under any circumstance. For multiple connections, usage of the same profile disk is not recommended.",
+ "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
+ "link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections",
"services": [
- "Cost",
"Storage",
- "AzurePolicy",
- "ASR"
+ "AVD"
],
- "subcategory": "DR Configuration",
- "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "severity": "High",
+ "subcategory": "FSLogix",
+ "text": "Avoid usage of concurrent or multiple connections",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
- "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "Cloud Cache uses OS drive as local cache storage and may generate lot of pressure on the VM disk. Depending on the VM SKU and size used, the VM temporary drive can be a viable and performant solution where to relocate Cloud Cache cached content. Before adopting this solution, tests should be executed to confirm performance and stability. More details on Cloud Cache can be found here: https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache. ",
+ "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
+ "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference",
"services": [
- "AzurePolicy"
+ "Storage",
+ "VM",
+ "AVD"
],
- "subcategory": "IaC",
- "text": "Wrap DevOps and source control around all your code",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "FSLogix",
+ "text": "If FSLogix Cloud Cache is used, consider moving the cache directory to the VM temporary drive.",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
- "services": [],
- "subcategory": "IaC",
- "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
- "waf": "Reliability"
+ "category": "Storage",
+ "checklist": "Azure Virtual Desktop Review",
+ "description": "REDIRECTION.XML file is used to control what folders are redirected out of the profile container to the 'C:' drive. Exclusions should be the exception and should never be used unless the specific exclusion is completely understood by the person configuring the exclusion. Exclusions should always be fully tested in the environment where they are intended to be implemented. Configuring exclusions may impact functionality, stability and performance.",
+ "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
+ "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
+ "services": [
+ "Storage",
+ "AVD"
+ ],
+ "severity": "Medium",
+ "subcategory": "FSLogix",
+ "text": "Review the usage of FSLogix redirection.",
+ "waf": "Cost"
},
{
- "category": "Operations Management",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
- "services": [],
- "subcategory": "IaC",
- "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
+ "services": [
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Automation",
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"services": [
- "SAP"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "ACSS",
- "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
"waf": "Operations"
},
{
- "category": "Automation",
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
"services": [
- "SAP"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "SDAF",
- "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
- "training": "https://github.com/Azure/sap-automation",
+ "severity": "Low",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
"waf": "Operations"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
"services": [
- "Backup",
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "Backup and restore",
- "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"services": [
- "Backup",
- "SAP",
- "ASR"
+ "Entra"
],
- "severity": "Medium",
- "subcategory": "Disaster recovery",
- "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
- "waf": "Reliability"
+ "severity": "High",
+ "subcategory": "Cloud Solution Provider",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a24d0de3-d4b9-4dfb-8ddd-bbfaf123fa01",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-cloud-solution-provider#design-recommendations",
"services": [
- "Storage",
- "SQL",
- "Backup",
- "SAP",
- "ASR"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Disaster recovery",
- "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Cloud Solution Provider",
+ "text": "If you have a CSP partner, define and document your support request and escalation process.",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "32952499-58c8-4e6f-ada5-972e67893d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "ASR",
- "SAP"
+ "Entra",
+ "Cost"
],
"severity": "Medium",
- "subcategory": "Disaster recovery",
- "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Cloud Solution Provider",
+ "text": "Setup Cost Reporting and Views with Azure Cost Management.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "685cb4f2-ac9c-4b19-9167-993ed0b32415",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
"services": [
- "ExpressRoute",
- "VPN",
- "ASR",
- "SAP"
+ "Entra",
+ "LoadBalancer"
],
- "severity": "High",
- "subcategory": "Disaster recovery",
- "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Enterprise Agreement",
+ "text": "Configure Notification Contacts to a group mailbox.",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
"services": [
- "ACR",
- "AKV",
- "ASR",
- "SAP"
+ "TrafficManager",
+ "Entra"
],
"severity": "Low",
- "subcategory": "Disaster recovery",
- "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
- "waf": "Reliability"
+ "subcategory": "Enterprise Agreement",
+ "text": "Use departments and accounts to map your organization's structure to your enrollment hierarchy which can help with separating billing.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-ea-roles",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ca0fe401-12ad-46fc-8a7e-86293866a9f6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-recommendations",
"services": [
- "ASR",
- "SAP",
- "VNet"
+ "Entra",
+ "Cost"
],
"severity": "Medium",
- "subcategory": "Disaster recovery",
- "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
- "waf": "Reliability"
+ "subcategory": "Enterprise Agreement",
+ "text": "Enable both DA View Charges and AO View Charges on your EA Enrollments to allow users with the correct perms review Cost and Billing Data.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/assign-access-acm-data#enable-access-to-costs-in-the-azure-portal",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
"services": [
- "Storage",
- "ASR",
- "SAP"
+ "Entra",
+ "Cost",
+ "Subscriptions"
],
"severity": "Low",
- "subcategory": "Disaster recovery",
- "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Reliability"
+ "subcategory": "Enterprise Agreement",
+ "text": "Use of Enterprise Dev/Test Subscriptions to reduce costs for non-production workloads.",
+ "training": "https://learn.microsoft.com/azure/devtest/offer/how-to-manage-monitor-devtest",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6ad5c3dd-e5ea-4ff1-81a4-7886ff87845c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Disaster recovery",
- "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Configure Agreement billing account notification contact email.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-setup-account",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90e87802-602f-4dfb-acea-67c60689f1d7",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice",
"services": [
- "ASR",
- "SAP",
- "VNet"
+ "Storage",
+ "Entra",
+ "Cost"
],
- "severity": "High",
- "subcategory": "Disaster recovery",
- "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Use Billing Profiles and Invoice sections to structure your agreements billing for effective cost management.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/mca-overview#billing-profiles",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e81a73f0-84c4-4641-b406-14db3b4d1f50",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "VM",
"Entra",
- "ASR",
- "SAP"
+ "Cost"
],
- "severity": "High",
- "subcategory": "Disaster recovery",
- "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Make use of Microsoft Azure plan for dev/test offer to reduce costs for non-production workloads.",
+ "training": "https://learn.microsoft.com/azure/devtest/offer/overview-what-is-devtest-offer-visual-studio",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "ASR",
- "SAP"
+ "Entra",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Define and document a process to periodically audit the agreement billing RBAC role assignments to review who has access to your MCA billing account.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-mca-roles",
+ "waf": "Cost"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
"services": [
- "ASR",
- "SAP"
+ "Entra",
+ "ACR",
+ "Subscriptions",
+ "RBAC"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4348bf81-7573-4512-8f46-9061cc198fea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
"services": [
- "Storage",
- "VM",
- "SAP",
- "ASR"
+ "Entra"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Reliability"
+ "subcategory": "Microsoft Entra ID and Hybrid Identity",
+ "text": "Use managed identities instead of service principals for authentication to Azure services. You can check for existing service principals via Entra ID > Sign in Logs > Service principal logins.",
+ "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"services": [
- "Storage",
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
"services": [
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"services": [
- "LoadBalancer",
- "ASR",
- "SAP"
+ "Entra",
+ "AzurePolicy"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
"services": [
- "LoadBalancer",
- "ASR",
- "SAP"
+ "Entra"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "Make sure the Floating IP is enabled on the Load balancer",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
"services": [
- "ASR",
- "SAP"
+ "Entra",
+ "RBAC"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
"services": [
"Entra",
"VM",
- "SAP",
- "ASR"
+ "ACR"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "subcategory": "Identity",
+ "text": "When deploying Active Directory Domain Controllers, use a location with Availability Zones and deploy at least two VMs across these zones. If not available, deploy in an Availability Set.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
"waf": "Reliability"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8aa1e41-870d-4968-94c6-77be14f510ac",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions#identity",
"services": [
- "VM",
- "RBAC",
- "Entra",
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Deploy your Azure landing zone identity resources in multiple regions. If using domain controllers, associate each region with an Active Directory site so that resources can resolve to their local domain controllers.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
"waf": "Reliability"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
"services": [
- "ASR",
- "SAP"
+ "Entra",
+ "ACR",
+ "Subscriptions",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "High availability",
- "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Use Azure custom RBAC roles for the following key roles to provide fine-grain access across your ALZ: Azure platform owner, network management, security operations, subscription owner, application owner. Align these roles to teams and responsibilities within your business.",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"services": [
- "VM",
- "SAP",
- "ASR"
+ "Entra"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"services": [
- "Entra",
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
"waf": "Reliability"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"services": [
- "ACR",
- "ASR",
- "SAP"
+ "Entra",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "High availability",
- "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "ammp": true,
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
"services": [
- "Entra",
- "ASR",
- "SAP"
+ "Entra"
],
"severity": "High",
- "subcategory": "High availability",
- "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
+ "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
"services": [
"Entra",
- "VM",
- "SAP",
"ASR"
],
"severity": "Medium",
- "subcategory": "High availability",
- "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "subcategory": "Microsoft Entra ID",
+ "text": "When deploying Microsoft Entra Connect, use a staging sever for high availability/disaster recovery.",
+ "training": "https://learn.microsoft.com/entra/identity/hybrid/connect/plan-connect-topologies",
"waf": "Reliability"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"services": [
- "Storage",
- "VM",
- "SAP",
- "ASR"
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "High availability",
- "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"services": [
- "ASR",
- "SAP"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "High availability",
- "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Identity",
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
"services": [
- "Storage",
- "ASR",
- "SAP"
+ "Entra",
+ "VNet"
],
"severity": "High",
- "subcategory": "Storage",
- "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "subcategory": "Landing zones",
+ "text": "Configure Identity network segmentation through the use of a virtual Network and peer back to the hub. Providing authentication inside application landing zone (legacy).",
+ "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations",
"services": [
+ "AKV",
"Storage",
- "ASR",
- "SAP"
+ "ACR",
+ "Entra",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Storage",
- "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Landing zones",
+ "text": "Use Azure RBAC to manage data plane access to resources, if possible. E.g. Data Operations across Key Vault, Storage Account and Database Services.",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d505ebcb-79b1-4274-9c0d-a27c8bea489c",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review",
"services": [
- "Storage",
- "ASR",
- "SAP"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Storage",
- "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Landing zones",
+ "text": "Use Microsoft Entra ID PIM access reviews to periodically validate resource entitlements.",
+ "training": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-perform-roles-and-resource-roles-review",
+ "waf": "Security"
},
{
- "category": "Business Continuity and Disaster Recovery",
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "services": [
- "Storage",
- "ASR",
- "SAP"
- ],
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Consider using the Azure naming tool available at https://aka.ms/azurenamingtool",
+ "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
+ "services": [],
"severity": "High",
- "subcategory": "Storage",
- "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
- "waf": "Reliability"
+ "subcategory": "Naming and tagging",
+ "text": "Use a well defined naming scheme for resources, such as Microsoft Best Practice Naming Standards.",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
"services": [
- "Cost",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": " ",
- "text": "Automate SAP System Start-Stop to manage costs.",
- "waf": "Cost"
+ "subcategory": "Subscriptions",
+ "text": "Enforce reasonably flat management group hierarchy with no more than four levels.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
"services": [
- "Cost",
- "Storage",
- "VM",
- "SAP"
+ "Subscriptions"
],
- "severity": "Low",
- "subcategory": " ",
- "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
"services": [
- "Cost",
- "Storage",
- "VM",
- "SAP"
+ "AzurePolicy",
+ "Subscriptions",
+ "RBAC"
],
- "severity": "Low",
- "subcategory": " ",
- "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
- "waf": "Cost"
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
"services": [
- "Entra",
- "RBAC",
+ "DNS",
"Subscriptions",
- "SAP"
+ "VWAN",
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a dedicated connectivity subscription in the Connectivity management group to host an Azure Virtual WAN hub, private non-AD Domain Name System (DNS), ExpressRoute circuit, and other networking resources.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
+ "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
"services": [
- "Entra",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "subcategory": "Subscriptions",
+ "text": "Enforce no subscriptions are placed under the root management group.",
+ "training": "https://learn.microsoft.com/azure/governance/management-groups/overview",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
"services": [
- "Entra",
- "SAP"
+ "Subscriptions",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "subcategory": "Subscriptions",
+ "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings.",
+ "training": "https://learn.microsoft.com/training/modules/configure-role-based-access-control/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
"services": [
- "Entra",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "subcategory": "Subscriptions",
+ "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "49b82111-2df2-47ee-912e-7f983f630472",
+ "link": "https://learn.microsoft.com/entra/id-governance/access-reviews-overview",
"services": [
- "Entra",
- "SAP"
+ "Cost",
+ "Subscriptions",
+ "RBAC",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.",
+ "training": "https://learn.microsoft.com/training/modules/plan-implement-manage-access-review/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
"services": [
- "Entra",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "subcategory": "Subscriptions",
+ "text": "Ensure that all subscription owners and IT core team are aware of subscription quotas and the impact they have on provision resources for a given subscription.",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
"services": [
- "AKV",
- "Entra",
- "SAP"
+ "Cost",
+ "Subscriptions"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions.",
+ "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "ammp": true,
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
+ "link": "https://learn.microsoft.com/azure/azure-portal/azure-portal-dashboards",
"services": [
- "AKV",
- "Entra",
- "SAP"
+ "Storage",
+ "Subscriptions",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "subcategory": "Subscriptions",
+ "text": "Establish dashboards and/or visualizations to monitor compute and storage capacity metrics. (i.e. CPU, memory, disk space)",
+ "training": "https://learn.microsoft.com/training/modules/visualize-data-workbooks/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/get-started/manage-costs",
+ "services": [
+ "Cost",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "As part of your cloud adoption, implement a detailed cost management plan using the 'Managed cloud costs' process.",
+ "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
"services": [
"Entra",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "subcategory": "Subscriptions",
+ "text": "If servers will be used for Identity services, like domain controllers, establish a dedicated identity subscription in the identity management group, to host these services. Make sure that resources are set to use the domain controllers available in their region.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
"services": [
- "Entra",
- "SAP"
+ "Cost",
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO to SAP HANA",
+ "subcategory": "Subscriptions",
+ "text": "Ensure tags are used for billing and cost management.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6cc0ea22-42bb-441e-a345-804ab0a09666",
+ "link": "https://github.com/Azure/sovereign-landing-zone/blob/main/docs/02-Architecture.md",
"services": [
- "Entra",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "subcategory": "Subscriptions",
+ "text": "For Sovereign Landing Zone, have a 'confidential corp' and 'confidential online' management group directly under the 'landing zones' MG.",
+ "training": "https://learn.microsoft.com/industry/sovereignty/slz-overview",
"waf": "Security"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "250d81ce-8bbe-4f85-9051-6a18a8221e50",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions",
"services": [
- "Entra",
- "SAP"
+ "Cost"
],
- "severity": "Medium",
- "subcategory": "Identity",
- "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Regions",
+ "text": "Select the right Azure region/s for your deployment. Azure is a global-scale cloud platform that provide global coverage through many regions and geographies. Different Azure regions have different characteristics, access and availability models, costs, capacity, and services offered, then it is important to consider all criteria and requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19ca3f89-397d-44b1-b5b6-5e18661372ac",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions#operate-in-multiple-geographic-regions",
"services": [
- "Entra",
- "SAP"
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
- "waf": "Security"
+ "subcategory": "Regions",
+ "text": "Deploy your Azure landing zone in a multi-region deployment. Depending on customer size, locations, and users presence, operating in multiple regions can be a common choice to deliver services and run applications closer to them. Using a multi-region deployment is also important to provide geo disaster recovery capabilities, to eliminate the dependency from a single region capacity and diminish the risk of a temporary and localized resource capacity constraint.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
- "services": [
- "Entra",
- "SAP"
- ],
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "services": [],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Implement SSO to SAP BTP",
- "waf": "Security"
+ "subcategory": "Regions",
+ "text": "Ensure required services and features are available within the chosen deployment regions.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access",
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery",
"services": [
- "Entra",
- "SAP"
+ "AppGW",
+ "FrontDoor"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
- "waf": "Security"
+ "subcategory": "App delivery",
+ "text": "Document a standard for securing the delivery application content from your Workload spokes using Application Gateway and Azure Front Door. You can use the Application Delivery checklist to for recommendations.",
+ "waf": "Operations"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "description": "Keep your management group hierarchy reasonably flat, no more than four.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"services": [
- "Subscriptions",
- "AzurePolicy",
- "SAP"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "enforce existing Management Group policies to SAP Subscriptions",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "Operations"
+ "subcategory": "Hub and spoke",
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"services": [
- "Subscriptions",
- "SAP"
+ "Firewall",
+ "VNet",
+ "NVA",
+ "VPN",
+ "ExpressRoute",
+ "DNS",
+ "Entra"
],
"severity": "High",
- "subcategory": "Subscriptions",
- "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "Operations"
+ "subcategory": "Hub and spoke",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"services": [
- "Subscriptions",
- "SAP"
+ "DDoS"
],
"severity": "High",
- "subcategory": "Subscriptions",
- "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "Operations"
+ "subcategory": "App delivery",
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"services": [
- "VM",
- "Subscriptions",
- "SAP"
+ "NVA"
],
- "severity": "High",
- "subcategory": "Subscriptions",
- "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "waf": "Reliability"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
"services": [
- "Subscriptions",
- "SAP"
+ "VPN",
+ "ARS",
+ "ExpressRoute"
],
"severity": "Low",
- "subcategory": "Subscriptions",
- "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
- "waf": "Operations"
+ "subcategory": "Hub and spoke",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
"services": [
- "VM",
- "Subscriptions",
- "SAP"
+ "ARS",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Subscriptions",
- "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "Hub and spoke",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"services": [
- "Subscriptions",
- "SAP"
+ "ACR",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Subscriptions",
- "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
},
{
- "category": "Management Group and Subscriptions",
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"services": [
- "Cost",
- "TrafficManager",
- "Subscriptions",
- "SAP"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Subscriptions",
- "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "subcategory": "Hub and spoke",
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"services": [
- "Monitor",
- "Backup",
- "SAP"
+ "ExpressRoute",
+ "VNet"
],
- "severity": "High",
- "subcategory": "BCDR",
- "text": "Help protect your HANA database by using the Azure Backup service.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"services": [
- "Storage",
- "VM",
- "Monitor",
- "Entra",
- "SAP"
+ "Storage"
],
"severity": "Medium",
- "subcategory": "BCDR",
- "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
+ "subcategory": "Hub and spoke",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
"services": [
- "Monitor",
- "SAP"
+ "VNet"
],
"severity": "High",
- "subcategory": "Management",
- "text": "Ensure time-zone matches between the operating system and the SAP system.",
- "waf": "Operations"
- },
- {
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
- "services": [
- "Monitor",
- "Entra",
- "SAP"
- ],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "subcategory": "Hub and spoke",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"services": [
- "Cost",
- "Monitor",
- "SAP"
+ "LoadBalancer"
],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Hub and spoke",
+ "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
+ "waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"services": [
- "Monitor",
- "Entra",
- "SAP"
+ "LoadBalancer"
],
- "severity": "Medium",
- "subcategory": "Management",
- "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Hub and spoke",
+ "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
+ "waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"services": [
- "Monitor",
- "VM",
- "SAP"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Management",
- "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "Operations"
- },
- {
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
- "services": [
- "Monitor",
- "SAP"
- ],
- "severity": "Low",
- "subcategory": "Management",
- "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
- "waf": "Operations"
+ "subcategory": "Encryption",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
"services": [
- "SQL",
- "Monitor",
- "SAP"
- ],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Operations"
+ "VPN",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
"services": [
- "VM",
- "Monitor",
- "Entra",
- "SAP"
+ "ACR",
+ "VNet"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "Operations"
+ "subcategory": "IP plan",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"services": [
- "Monitor",
- "AzurePolicy",
- "SAP"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "subcategory": "IP plan",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"services": [
- "Monitor",
- "NetworkWatcher",
- "SAP"
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
"services": [
- "Monitor",
- "VM",
- "SAP"
+ "ASR",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
"services": [
- "Monitor",
- "Subscriptions",
- "SAP"
+ "ACR",
+ "VNet"
],
"severity": "High",
- "subcategory": "Monitoring",
- "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Performance"
+ "subcategory": "IP plan",
+ "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"services": [
- "Monitor",
- "Storage",
- "ASR",
- "SAP"
+ "DNS",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Reliability"
+ "subcategory": "IP plan",
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
"services": [
- "Sentinel",
- "Monitor",
- "SAP"
+ "ACR",
+ "DNS",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "subcategory": "IP plan",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
"waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
"services": [
- "Cost",
- "Monitor",
- "SAP"
+ "DNS",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "severity": "Low",
+ "subcategory": "IP plan",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
"waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
"services": [
- "Monitor",
"VM",
- "SAP"
+ "DNS",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Performance",
- "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
"services": [
- "Monitor",
- "ASR",
- "SAP"
+ "DNS",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Performance",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "subcategory": "IP plan",
+ "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "Reliability"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
"services": [
- "Monitor",
- "Storage",
- "SAP"
+ "Bastion"
],
"severity": "Medium",
- "subcategory": "Performance",
- "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
- "waf": "Performance"
+ "subcategory": "Internet",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"services": [
- "Monitor",
- "SAP"
+ "Bastion",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Performance",
- "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
"services": [
- "Monitor",
- "Storage",
- "SAP"
+ "ACR",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Performance",
- "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Performance"
+ "subcategory": "Internet",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"services": [
- "SQL",
- "Monitor",
- "SAP"
+ "AppGW",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Performance",
- "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Performance"
+ "severity": "Low",
+ "subcategory": "Internet",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "category": "Management and Monitoring",
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"services": [
- "Monitor",
- "ASR",
- "SAP"
+ "WAF",
+ "VNet"
],
"severity": "High",
- "subcategory": "Reliability",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "Operations"
+ "subcategory": "Internet",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "SAP"
+ "DDoS",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": "App delivery",
- "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "services": [
+ "DDoS"
+ ],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
"services": [
- "DNS",
"VM",
- "SAP"
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "DNS",
- "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"services": [
- "DNS",
- "SAP",
- "VNet"
+ "VPN",
+ "Backup",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "DNS",
- "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "subcategory": "Hybrid",
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
"services": [
- "ACR",
- "SAP",
- "VNet"
+ "ExpressRoute"
],
"severity": "Medium",
"subcategory": "Hybrid",
- "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"services": [
- "NVA",
- "SAP"
+ "VPN",
+ "ExpressRoute"
],
- "severity": "High",
+ "severity": "Medium",
"subcategory": "Hybrid",
- "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
- "training": "https://me.sap.com/notes/2731110",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"services": [
- "ACR",
- "VWAN",
- "SAP"
+ "Cost",
+ "ExpressRoute"
],
- "severity": "Medium",
+ "severity": "High",
"subcategory": "Hybrid",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "Operations"
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
"services": [
- "NVA",
- "SAP",
- "VNet"
+ "Cost",
+ "ExpressRoute"
],
- "severity": "Medium",
+ "severity": "High",
"subcategory": "Hybrid",
- "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operations"
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"services": [
- "VWAN",
- "NVA",
- "SAP",
- "VNet"
+ "ExpressRoute"
],
"severity": "Medium",
"subcategory": "Hybrid",
- "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operations"
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"services": [
- "VM",
- "SAP",
- "VNet"
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "IP plan",
- "text": "Public IP assignment to VM running SAP Workload is not recommended.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"services": [
- "ASR",
- "SAP",
- "VNet"
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "IP plan",
- "text": "Consider reserving IP address on DR side when configuring ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"services": [
- "SAP",
- "VNet"
+ "VPN"
],
- "severity": "High",
- "subcategory": "IP plan",
- "text": "Avoid using overlapping IP address ranges for production and DR sites.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"services": [
- "Storage",
- "SAP",
- "VNet"
+ "VPN"
],
"severity": "Medium",
- "subcategory": "IP plan",
- "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "Operations"
+ "subcategory": "Hybrid",
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
"services": [
- "SAP",
- "Firewall"
+ "Cost",
+ "ExpressRoute"
],
- "severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
"services": [
- "WAF",
- "AppGW",
- "SAP"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "subcategory": "Hybrid",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"services": [
- "ACR",
- "FrontDoor",
- "AzurePolicy",
- "WAF",
- "SAP"
+ "Monitor",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "Security"
+ "subcategory": "Hybrid",
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
"services": [
- "FrontDoor",
- "AzurePolicy",
- "WAF",
- "AppGW",
- "SAP"
+ "NetworkWatcher",
+ "ACR",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Hybrid",
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"services": [
- "LoadBalancer",
- "WAF",
- "AppGW",
- "SAP"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Hybrid",
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
"services": [
- "ACR",
- "VWAN",
- "SAP"
+ "VPN",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Internet",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Performance"
+ "subcategory": "Hybrid",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
"services": [
- "ACR",
"Storage",
- "PrivateLink",
- "Backup",
- "SAP",
"VNet"
],
- "severity": "Medium",
- "subcategory": "Internet",
- "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
"services": [
- "VM",
- "SAP"
+ "ACR",
+ "ExpressRoute"
],
"severity": "High",
- "subcategory": "Segmentation",
- "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Performance"
+ "subcategory": "Hybrid",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"services": [
- "LoadBalancer",
- "SAP"
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Hybrid",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
"services": [
- "VM",
- "SAP",
- "VNet"
+ "ExpressRoute"
],
- "severity": "Medium",
- "subcategory": "Segmentation",
- "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
"services": [
- "SAP",
+ "ExpressRoute",
+ "Monitor",
"VNet"
],
- "severity": "High",
- "subcategory": "Segmentation",
- "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
"services": [
- "SAP"
+ "ExpressRoute",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Segmentation",
- "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "subcategory": "Hybrid",
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
"services": [
- "SAP"
+ "ACR"
],
- "severity": "High",
- "subcategory": "Segmentation",
- "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "severity": "Low",
+ "subcategory": "Hybrid",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
"waf": "Performance"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
"services": [
- "Cost",
- "SAP",
- "VNet"
+ "Firewall"
],
"severity": "High",
- "subcategory": "Segmentation",
- "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Cost"
+ "subcategory": "Firewall",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"services": [
- "LoadBalancer",
- "SAP"
+ "AzurePolicy",
+ "Firewall",
+ "ACR",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Segmentation",
- "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
"category": "Network Topology and Connectivity",
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
"services": [
- "SAP",
- "VNet"
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": "Segmentation",
- "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
"services": [
- "VM",
- "Backup",
- "SAP"
+ "DNS",
+ "Firewall"
],
"severity": "High",
- "subcategory": " ",
- "text": "Review SAP HANA database backups for Azure VMs.",
- "waf": "Cost"
+ "subcategory": "Firewall",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
"services": [
- "Monitor",
- "ASR",
- "SAP"
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Review Site Recovery built-in monitoring, where used for SAP.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
"services": [
- "Monitor",
- "SAP"
+ "Firewall"
],
"severity": "High",
- "subcategory": " ",
- "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
- "waf": "Operations"
+ "subcategory": "Firewall",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
"services": [
- "VM",
- "Backup",
- "SAP"
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Review Oracle Database in Azure Linux VM backup strategies.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
"services": [
- "SQL",
+ "Firewall",
+ "VNet",
+ "NVA",
"Storage",
- "SAP"
+ "VWAN"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Security"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"services": [
- "VM",
- "Backup",
- "SAP"
+ "Storage",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": " ",
- "text": "Review the use of Automated Backup v2 for Azure VMs.",
+ "subcategory": "Firewall",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Operations"
},
{
- "category": "Operational Excellence",
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
"services": [
- "SAP"
+ "AzurePolicy",
+ "Firewall"
],
"severity": "High",
- "subcategory": " ",
- "text": "Enabling Write accelerator for M series when using premium disks(V1)",
+ "subcategory": "Firewall",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Operations"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"services": [
- "SAP"
+ "Firewall",
+ "VNet"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Test availability zone latency.",
- "waf": "Performance"
+ "severity": "High",
+ "subcategory": "Segmentation",
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
"services": [
- "SAP"
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": " ",
- "text": "Activate SAP EarlyWatch Alert for all SAP components.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "subcategory": "Firewall",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
"waf": "Performance"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
"services": [
- "SAP"
+ "Storage"
],
"severity": "Medium",
- "subcategory": " ",
- "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
+ "subcategory": "Firewall",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
"waf": "Performance"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
- "services": [
- "SQL",
- "Monitor",
- "SAP"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "services": [],
"severity": "Medium",
- "subcategory": " ",
- "text": "Review SQL Server performance monitoring using CCMS.",
+ "subcategory": "Firewall",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
"waf": "Performance"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
"services": [
- "VM",
- "SAP"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": " ",
- "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
+ "subcategory": "Firewall",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
"waf": "Performance"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"services": [
- "Monitor",
- "SAP"
+ "Firewall"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Review SAP HANA studio alerts.",
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
"waf": "Performance"
},
{
- "category": "Performant",
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
"services": [
- "SAP"
+ "ServiceBus"
],
- "severity": "Medium",
- "subcategory": " ",
- "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
"waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "services": [
- "VM",
- "SAP"
- ],
- "severity": "Medium",
- "subcategory": "Governance",
- "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "waf": "Security"
- },
- {
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "services": [
- "SAP"
- ],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "services": [],
"severity": "Medium",
- "subcategory": "Governance",
- "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "Security"
- },
- {
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "services": [
- "SQL",
- "SAP"
- ],
- "severity": "Low",
- "subcategory": "Governance",
- "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
- "waf": "Security"
- },
- {
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "services": [
- "SQL",
- "SAP"
- ],
- "severity": "High",
- "subcategory": "Governance",
- "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "Security"
- },
- {
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "services": [
- "Storage",
- "SQL",
- "AKV",
- "Backup",
- "SAP"
- ],
- "severity": "High",
- "subcategory": "Secrets",
- "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "waf": "Security"
+ "subcategory": "Firewall",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
"services": [
- "AKV",
- "Storage",
- "SAP"
+ "DNS",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "Secrets",
- "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "subcategory": "Firewall",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"services": [
- "AKV",
- "SAP"
+ "Monitor",
+ "Firewall"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "Use Azure Key Vault to store your secrets and credentials",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Security"
- },
- {
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
- "services": [
- "AzurePolicy",
- "RBAC",
- "AKV",
- "Subscriptions",
- "SAP"
- ],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Firewall",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operations"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
"services": [
- "AKV",
- "AzurePolicy",
- "SAP"
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Secrets",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"services": [
- "AKV",
- "RBAC",
- "AzurePolicy",
- "SAP"
+ "ACR",
+ "Firewall"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Firewall",
+ "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Reliability"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"services": [
- "AKV",
- "Storage",
- "SAP",
- "Defender"
+ "DDoS",
+ "Firewall",
+ "VNet"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
- "waf": "Security"
+ "subcategory": "Firewall",
+ "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
+ "waf": "Reliability"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"services": [
- "AKV",
- "RBAC",
- "SAP",
- "Defender"
+ "VNet"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "subcategory": "PaaS",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
"services": [
- "AKV",
- "SAP"
+ "PrivateLink"
],
- "severity": "Low",
- "subcategory": "Secrets",
- "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Use Private Link, where available, for shared Azure PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"services": [
- "AKV",
- "SAP"
+ "PrivateLink",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Secrets",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "subcategory": "PaaS",
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
"services": [
- "AKV",
- "SAP"
+ "VNet"
],
"severity": "High",
- "subcategory": "Secrets",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "subcategory": "PaaS",
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
"services": [
- "AKV",
- "SAP"
+ "NVA",
+ "PrivateLink",
+ "DNS",
+ "Firewall"
],
- "severity": "High",
- "subcategory": "Secrets",
- "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
"services": [
- "RBAC",
- "Subscriptions",
- "SAP"
+ "VPN",
+ "ExpressRoute",
+ "VNet"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "subcategory": "Segmentation",
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"services": [
- "PrivateLink",
- "NVA",
- "SAP"
+ "VNet"
],
"severity": "High",
- "subcategory": "Security",
- "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "subcategory": "Segmentation",
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
"services": [
- "Storage",
- "VM",
- "SAP"
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Security",
- "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Delegate subnet creation to the landing zone owner.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
"services": [
- "SAP",
- "Defender"
+ "ACR",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Security",
- "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
"services": [
- "SAP",
+ "NVA",
+ "Entra",
"VNet"
],
- "severity": "High",
- "subcategory": "Security",
- "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"services": [
- "WAF",
- "SAP"
+ "NetworkWatcher",
+ "VNet"
],
- "severity": "Low",
- "subcategory": "Security",
- "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "Security"
},
{
- "category": "Security, Governance and Compliance",
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
"services": [
- "AKV",
- "Monitor",
- "SAP"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Security"
+ "subcategory": "Segmentation",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "services": [],
- "severity": "High",
- "subcategory": "High Availablity",
- "text": "Enable 2 replicas to have 99.9% availability for read operations",
- "waf": "Reliability"
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "services": [],
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "services": [
+ "ACR",
+ "VWAN"
+ ],
"severity": "Medium",
- "subcategory": "High Availablity",
- "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
- "waf": "Reliability"
+ "subcategory": "Virtual WAN",
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
- "services": [],
- "severity": "High",
- "subcategory": "High Availablity",
- "text": "Leverage Availability Zones by enabling read and/or write replicas",
- "waf": "Reliability"
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "services": [
+ "VWAN",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
"services": [
- "ACR"
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Georeplication",
- "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "subcategory": "Virtual WAN",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
"services": [
- "ACR"
+ "Monitor",
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Georeplication",
- "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
- "waf": "Reliability"
+ "subcategory": "Virtual WAN",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
"services": [
- "TrafficManager"
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Georeplication",
- "text": "Use Azure Traffic Manager to coordinate requests",
+ "subcategory": "Virtual WAN",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
"services": [
- "Storage",
- "Backup",
- "ASR"
+ "VPN",
+ "VWAN",
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "Disaster Recovery",
- "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
"services": [
- "Cost",
- "Monitor"
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Azure Monitor - enforce data collection rules",
- "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "subcategory": "Virtual WAN",
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
"services": [
- "Cost",
- "Backup"
+ "VWAN"
],
- "severity": "Medium",
- "subcategory": "Backup",
- "text": "check backup instances with the underlying datasource not found",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Virtual WAN",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost"
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Delete/archive",
- "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "659d3958-fd77-4289-a835-556df2bfe456",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost"
+ "AzurePolicy",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Delete/archive",
- "text": "Consider snooze and stop technique (snooze a service after x days, stop after 2x, delete/deallocate after 3x)",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost",
- "Storage",
- "Backup"
+ "AzurePolicy",
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Delete/archive",
- "text": "Delete or archive unused resources (old backups, logs, storage accounts, etc...)",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost",
- "Storage",
- "Backup",
- "ASR"
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Delete/archive",
- "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Low",
+ "subcategory": "Governance",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost",
- "Monitor"
+ "AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Log Analytics retention for workspaces",
- "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"services": [
- "Cost",
- "Storage",
- "AzurePolicy"
+ "Entra",
+ "AzurePolicy",
+ "Subscriptions",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Policy",
- "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "59bb91a3-ed90-4cae-8cc8-4c37b6b780cb",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"services": [
- "Cost"
+ "AzurePolicy",
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "Run orphaned resources workbook - delete or snooze ghost items",
- "text": "https://github.com/dolevshor/azure-orphan-resources",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "9fe5c464-89d4-457a-a27c-3874d0102cac",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
"services": [
- "Cost"
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Shutdown/deallocate",
- "text": "Shutdown underutilized instances",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/analyze-unexpected-charges",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
"services": [
- "Cost",
- "Storage",
- "Backup",
- "VM"
+ "AzurePolicy",
+ "Subscriptions"
],
"severity": "Medium",
- "subcategory": "stopped/deallocated VMs: check disks",
- "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
"services": [
- "Cost",
- "Storage",
"AzurePolicy"
],
"severity": "Medium",
- "subcategory": "storage accounts lifecycle policy",
- "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
+ "waf": "Security"
},
{
- "category": "Cleanup",
- "checklist": "Cost Optimization Checklist",
- "guid": "f2bfe456-3b0d-4834-a348-726de69c6b5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
"services": [
- "Cost"
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Tagging",
- "text": "Use specific tags for temporary items with 'delete by DATE' format - and automate monthly cleanup",
- "waf": "Cost"
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "waf": "Security"
},
{
- "category": "DB/App tuning",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a26494b-69ba-4d37-aad5-3cc78e1d7666",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice",
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "29fd366b-a180-452b-9bd7-954b7700c667",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json",
"services": [
- "Cost"
+ "TrafficManager",
+ "Cost",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "DB optimization",
- "text": "Plan for db optimization with the intent of downsizing the related services (and improve performance)",
+ "subcategory": "Optimize your cloud investment",
+ "text": "Configure 'Actual' and 'Forecasted' Budget Alerts.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/",
"waf": "Cost"
},
{
- "category": "DB/APP tuning",
- "checklist": "Cost Optimization Checklist",
- "guid": "7357c449-674b-45ed-a5a8-59c7733be2a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
"services": [
- "Cost"
+ "Entra",
+ "AzurePolicy",
+ "RBAC",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "App modernization",
- "text": "Modernizing the app towards a microservices architecture will have the effect of letting the app scale according to the single service and not the entire stack",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
},
{
- "category": "DB/APP tuning",
- "checklist": "Cost Optimization Checklist",
- "guid": "a27b765a-91be-41f3-a8ef-394c2bd463cb",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"services": [
- "Cost",
- "Storage",
- "VM"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "DB optimization",
- "text": "optimizing the DB queries will increase performance and allow better right-sizing of storage and VMs",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Reliability"
},
{
- "category": "DB/APP tuning",
- "checklist": "Cost Optimization Checklist",
- "guid": "bac75819-59bb-491a-9ed9-0cae2cc84c37",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"services": [
- "Cost"
+ "Storage",
+ "ARS",
+ "AzurePolicy",
+ "Monitor"
],
- "severity": "Medium",
- "subcategory": "Demand shaping",
- "text": "Using demand shaping on PaaS services will optimize costs and performances",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "b6b780cb-9fe5-4c46-989d-457a927c3874",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
"services": [
- "Cost",
- "Entra"
+ "VM",
+ "AzurePolicy",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Advisor",
- "text": "Start from the Azure Advisor page suggestions.",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
"service": "VM",
"services": [
- "Cost",
"VM"
],
"severity": "Medium",
- "subcategory": "Advisor",
- "text": "Make sure advisor is configured for VM right sizing ",
- "waf": "Cost"
+ "subcategory": "Operational compliance",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "881a1bd5-d1e4-44a1-a659-d3958fd77289",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
"services": [
- "Cost"
+ "VM"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Consider implementing IaC scripts or devops pipelines to match the cost governance process",
- "waf": "Cost"
+ "subcategory": "Operational compliance",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "b835556d-f2bf-4e45-93b0-d834a348726d",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
"services": [
- "Cost",
+ "NetworkWatcher",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Set up cost alerts for applications that have variable costs (ideally for all of them)",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "e69c6b5c-2a26-4494-a69b-ad37aad53cc7",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Use Azure Automation: Automate repetitive tasks can help you save time and resources, reducing costs in the process. ",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use resource locks to prevent accidental deletion of critical shared services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "8e1d7666-7357-4c44-a674-b5ed85a859c7",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/effect-deny",
"services": [
- "Cost"
+ "AzurePolicy",
+ "RBAC",
+ "Monitor"
],
- "severity": "Medium",
- "subcategory": "Automation",
- "text": "Run orphaned resources workbook",
- "waf": "Cost"
+ "severity": "Low",
+ "subcategory": "Monitoring",
+ "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/deny-assignments?tabs=azure-portal",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "733be2a1-a27b-4765-a91b-e1f388ef394c",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
"services": [
- "Cost",
- "Storage"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Baseline",
- "text": "Try and establish a baseline of monthly spending and an acceptable saving target against the baseline (new services will not be optimized at this stage)",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-service-health/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "2bd463cb-bac7-4581-a59b-b91a3ed90cae",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
"services": [
- "Cost",
- "AzurePolicy"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Baseline",
- "text": "Establish a cost optimization baseline by using a policy that tags every new resource as #NEW",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned.",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/incident-response-with-alerting-on-azure/7-actions-and-alert-processing-rules",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "2cc84c37-b6b7-480c-a9fe-5c46489d457a",
- "link": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management-config",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
+ "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Baseline",
- "text": "Organize resources to maximize cost insights and accountability",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "927c3874-d010-42ca-a6aa-e01e6a84de5d",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Budgets",
- "text": "Create budgets",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "e36d1d92-881a-41bd-9d1e-44a19659d395",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
"services": [
- "Cost"
+ "Storage",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Cost Analysis",
- "text": "In cost analysis - use daily granularity, grouped by service name to analyze the spending of the past 3 months and identify the top 3 spenders",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-extensions/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "8fd77289-b835-4556-bf2b-fe4563b0d834",
- "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Cost Analysis",
- "text": "Check daily for cost spikes and anomalies (ideally with automatic billing exports)",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "a348726d-e69c-46b5-a2a2-6494b69bad37",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "859c3900-4514-41eb-b010-475d695abd74",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Cost Analysis",
- "text": "Automate cost retrieval for deep analysis or integration",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied.",
+ "training": "https://learn.microsoft.com/training/paths/az-104-monitor-backup-resources/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "aad53cc7-8e1d-4766-9735-7c449674b5ed",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
"services": [
- "Cost",
- "ACR"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Free services",
- "text": "Take advantage of Azure free services: Azure offers a number of free services, such as DevOps, Azure Container Registry, and Azure Logic Apps, that can help you save costs on development and operations. ",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "96c96ad8-844c-4f3b-8b38-c886ba2c0214",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "aa45be6a-8f2d-4896-b0e3-775e6e94e610",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-monitor",
"services": [
- "Cost"
+ "Monitor",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Tagging",
- "text": "Tag shared resources",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Deploy AMBA to establish monitoring for platform components of your landing zone - AMBA is a framework solution that is available and provides an easy way to scale alerting by using Azure Policy.",
+ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/",
+ "waf": "Operations"
},
{
- "category": "Process Administration",
- "checklist": "Cost Optimization Checklist",
- "guid": "99014a5d-3ce5-474d-acbd-9792a6bcca2b",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview",
"services": [
- "Cost"
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Tagging",
- "text": "Consider using tags to all services for cost allocation",
- "waf": "Cost"
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitoring Agent (AMA). The Log Analytics agent is deprecated since August 31,2024",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview#installation",
+ "waf": "Operations"
},
{
- "category": "reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "4fea1dbf-3dd9-45d4-ac7c-891dcb1f7d57",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "0d83fd81-952c-4d47-a6cb-3a930925ef2e",
+ "link": "https://learn.microsoft.com/en-gb/azure/storage/common/redundancy-migration?tabs=portal",
"services": [
+ "Storage",
"Cost"
],
- "severity": "Medium",
- "subcategory": "automation",
- "text": "Consider Reservation automation to track and promptly react to changes",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Data Protection",
+ "text": "Ensure that storage accounts are zone or region redundant, Redundancy ensures storage accounts meet availability and durability targets amidst failures, weighing lower costs against higher availability. Locally redundant storage offers the least durability at the lowest cost.",
+ "training": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "waf": "Reliability"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "description": "check by searching the Meter Category Licenses in the Cost analysys",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "services": [
- "Cost",
- "SQL",
- "AzurePolicy",
- "VM"
- ],
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "services": [],
"severity": "Medium",
- "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL",
- "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
- "waf": "Cost"
+ "subcategory": "Data Protection",
+ "text": "Enable cross-region replication in Azure for BCDR with paired regions.",
+ "training": "https://learn.microsoft.com/training/modules/provide-disaster-recovery-replicate-storage-data/",
+ "waf": "Reliability"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
"services": [
- "Cost",
- "LoadBalancer"
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Check Red Hat Licences if applicable",
- "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Cost"
+ "severity": "Low",
+ "subcategory": "Data Protection",
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "a76af4a6-91e8-4839-ada4-6667e13c1056",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
"services": [
- "Cost",
- "AppSvc"
+ "VM",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Functions",
- "text": "Saving plans will provide 17% on select app service plans",
- "waf": "Cost"
+ "subcategory": "Operational compliance",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "waf": "Security"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
"service": "VM",
"services": [
- "Cost",
- "VM"
+ "VM",
+ "AzurePolicy",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Planning",
- "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Cost"
+ "subcategory": "Operational compliance",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
"service": "VM",
"services": [
- "Cost",
- "ARS",
- "VM"
+ "VM",
+ "ACR",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Reservations/savings plans",
- "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
- "waf": "Cost"
+ "subcategory": "Protect and Recover",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "a785c6fe-96c9-46ad-a844-cf3b2b38c886",
- "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
"services": [
- "Cost"
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Reservations/savings plans",
- "text": "Plan for Azure Savings Plans for all the workloads that are dynamic and need maximum flexibility",
- "waf": "Cost"
+ "subcategory": "Protect and Recover",
+ "text": "Use native PaaS service disaster recovery capabilities. Perform failover testing with these capabilities.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/explore-iaas-paas-platform-tools-for-high-availability-disaster-recovery/",
+ "waf": "Operations"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "ba2c0214-9901-44a5-b3ce-574dccbd9792",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
"services": [
- "Cost"
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Reservations/savings plans",
- "text": "Plan for Azure Reservations for all the workloads that are less dynamic and won't change much",
- "waf": "Cost"
+ "subcategory": "Protect and Recover",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"services": [
- "Cost",
- "Storage"
+ "AppGW",
+ "FrontDoor",
+ "WAF"
],
- "severity": "Medium",
- "subcategory": "Reserve storage",
- "text": "Only larger disks can be reserved => 1 TiB -",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "App delivery",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operations"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
"services": [
- "Cost",
- "VM"
+ "AppGW",
+ "Sentinel",
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
- "subcategory": "Reserve VMs with normalized and rationalized sizes",
- "text": "After the right-sizing optimization",
- "waf": "Cost"
+ "subcategory": "App delivery",
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "services": [
- "Cost",
- "SQL",
- "AzurePolicy"
- ],
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
+ "services": [],
"severity": "Medium",
- "subcategory": "SQL Database AHUB",
- "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Cost"
+ "subcategory": "Access control",
+ "text": "Determine the incident response plan for Azure services before allowing it into production.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-incident-readiness/",
+ "waf": "Security"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "services": [
- "Cost",
- "SQL",
- "VM"
- ],
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security-zero-trust",
+ "services": [],
"severity": "Medium",
- "subcategory": "SQL Database Reservations",
- "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
- "waf": "Cost"
+ "subcategory": "Access control",
+ "text": "Apply a zero-trust approach for access to the Azure platform.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-zero-trust-best-practice-frameworks/",
+ "waf": "Security"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "e13c1056-75c1-4e94-9b45-9837ff7ae7c6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV"
],
- "severity": "Medium",
- "subcategory": "Tracking",
- "text": "Make sure you Azure Reservations and Savings plans are close to 100% utilization or make the necessary changes to reach it.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Encryption and keys",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Reservations",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3b475a5-c7ac-4be4-abbe-64dd89f2e877",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"services": [
- "Cost",
- "AzurePolicy"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Tracking",
- "text": "Make sure that your reservations usage is close to 100%. If not, either enforce an allowed SKU policy or exchange the reservation",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "78468d55-a785-4c6f-b96c-96ad8844cf3b",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost",
+ "AKV",
"AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Plan and enforce a On/Off policy for production services, where possible",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "2b38c886-ba2c-4021-9990-14a5d3ce574d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost",
- "AzurePolicy"
+ "AKV",
+ "Entra",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Plan and enforce a On-Demand policy with auto-shutdown for non-production services, where possible",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost",
- "VM"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Autoscale",
- "text": "Consider using a VMSS to match demand rather than flat sizing",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost",
- "AKS"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Autoscale",
- "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "93665720-2bff-4456-9b0d-934a359c363e",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV",
+ "PrivateLink",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Autoscale",
- "text": "Right-size PaaS service according to average use and accomodate spikes with auto or manual scaling",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "7dd61623-a364-4a90-9eba-e38ead53cc7d",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV",
+ "Entra",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Autoscale",
- "text": "Plan for demand shaping where applicable",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "e2e8aaab-3571-4549-ab91-53d89f89dc7b",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Autoscale",
- "text": "Consider implementing a service re-scaling logic within the application",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/savings-plan/",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "16183687-a047-47a2-8994-5bda43334f24",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
"services": [
- "Cost",
- "Backup"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost",
- "VM",
- "LoadBalancer"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Databricks",
- "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV",
+ "ACR",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Functions",
- "text": "Functions - Reuse connections",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"services": [
- "Cost"
+ "AKV"
],
"severity": "Medium",
- "subcategory": "Functions",
- "text": "Functions - Cache data locally",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Cost"
+ "subcategory": "Encryption and keys",
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"services": [
- "Cost",
- "Storage"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Functions",
- "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
"services": [
- "Cost"
+ "Storage",
+ "ARS",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Functions",
- "text": "Functions - Keep your functions warm",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
"services": [
- "Cost"
+ "Defender",
+ "Subscriptions"
],
- "severity": "Medium",
- "subcategory": "Functions",
- "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
"services": [
- "Cost"
+ "Defender",
+ "Subscriptions"
],
- "severity": "Medium",
- "subcategory": "Functions",
- "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
"services": [
- "Cost"
+ "Defender",
+ "Subscriptions"
],
- "severity": "Medium",
- "subcategory": "Functions",
- "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "df03a822-cd46-43cb-abc8-ac299ebc91a4",
- "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"services": [
- "Cost"
+ "Defender",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Evaluate your network topology against networking costs and where applicable reduce the egress and peering data",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
"link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
+ "service": "Monitor",
"services": [
- "Cost",
- "FrontDoor",
- "EventHubs"
+ "Entra",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Networking",
- "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
"services": [
- "Cost",
- "AppSvc",
- "FrontDoor"
+ "Entra",
+ "ACR"
],
- "severity": "Medium",
- "subcategory": "Networking",
- "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "f843e52f-4722-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"services": [
- "Cost"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "PaaS",
- "text": "Consider using free tiers where applicable for all non-production environments",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "b9de39ac-0e7c-428d-a936-657202bff456",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"services": [
- "Cost"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Serverless",
- "text": "Using serverless patterns for spikes can help keeping costs down",
- "waf": "Cost"
+ "subcategory": "Operations",
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "874a748b-662d-46d1-9051-2a66498f6dfe",
+ "link": "https://learn.microsoft.com/azure/event-grid/set-alerts",
"services": [
- "Cost",
- "Storage"
+ "Monitor"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Consider archiving tiers for less used data",
- "waf": "Cost"
+ "severity": "Low",
+ "subcategory": "Operations",
+ "text": "Use an Azure Event Grid-based solution for log-oriented, real-time alerts.",
+ "training": "https://learn.microsoft.com/training/modules/azure-event-grid/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
"services": [
- "Cost",
"Storage"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Overview",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
"service": "Storage",
"services": [
- "Cost",
"Storage"
],
- "severity": "Medium",
- "subcategory": "Storage",
- "text": "Consider using standard SSD rather than Premium or Ultra where possible",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "Overview",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6f704104-85c1-441f-96d3-c9819911645e",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning",
"services": [
- "Cost",
- "Storage"
+ "Entra"
],
+ "severity": "High",
+ "subcategory": "Secure privileged access",
+ "text": "Separate privileged admin accounts for Azure administrative tasks.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-secure-privileged-access/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
+ "services": [],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
- "waf": "Cost"
+ "subcategory": "Service enablement framework",
+ "text": "Plan how new azure services will be implemented.",
+ "waf": "Security"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Service enablement framework",
+ "text": "Plan how service request will be fulfilled for Azure services.",
+ "waf": "Security"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e85f4226-bf06-4e35-8a8b-7aee4d2d633a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/platform-automation-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Ensure you have a cross functional DevOps Platform Team to build, manage and maintain your Azure Landing Zone architecture.",
+ "training": "https://learn.microsoft.com/training/modules/choose-an-agile-approach/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "634146bf-7085-4419-a7b5-f96d2726f6da",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Aim to define functions for Azure Landing Zone Platform team.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a9e65070-c59e-4112-8bf6-c11364d4a2a5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
"services": [
- "Cost",
- "Storage",
- "ASR"
+ "RBAC"
],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Aim to define functions for application workload teams to be self-sufficient and not require DevOps Platform Team support. Achieve this through the use of custom RBAC role.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "165eb5e9-b434-448a-9e24-178632186212",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
- "waf": "Cost"
+ "subcategory": "DevOps Team Topologies",
+ "text": "Use a CI/CD pipeline to deploy IaC artifacts and ensure the quality of your deployment and Azure environments.",
+ "training": "https://learn.microsoft.com/training/modules/manage-multiple-environments-using-bicep-azure-pipelines/",
+ "waf": "Operations"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0cadb8c7-8fa5-4fbf-8f39-d1fadb3b0460",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Include unit tests for IaC and application code as part of your build process.",
+ "training": "https://learn.microsoft.com/training/modules/run-quality-tests-build-pipeline/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
"services": [
- "Cost",
- "Storage"
+ "AKV",
+ "VM"
],
- "severity": "Medium",
- "subcategory": "storage",
- "text": "Storage accounts: check hot tier and/or GRS necessary",
- "waf": "Cost"
+ "severity": "High",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a52e0c98-76b9-4a09-a1c9-6b2babf22ac4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/subscription-vending",
"services": [
- "Cost",
- "Storage"
+ "Subscriptions"
],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Implement automation for new landing zone for applications and workloads through subscription vending.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cfe363b5-f579-4284-bc56-a42153e4c10b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Development Lifecycle",
+ "text": "Ensure a version control system is used for source code of applications and IaC developed. Microsoft recommends Git.",
+ "training": "https://learn.microsoft.com/training/paths/intro-to-vc-git/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c7245dd4-af8a-403a-8bb7-890c1a7cfa9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Development Lifecycle",
+ "text": "Follow a branching strategy to allow teams to collaborate better and efficiently manage version control of IaC and application Code. Review options such as Github Flow.",
+ "training": "https://learn.microsoft.com/training/modules/manage-git-branches-workflows/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12aeea20-9165-4b3e-bdf2-6795fcd3cdbe",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
+ "services": [],
"severity": "Medium",
- "subcategory": "Storage",
- "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
- "waf": "Cost"
+ "subcategory": "Development Lifecycle",
+ "text": "Adopt a pull request strategy to help keep control of code changes merged into branches.",
+ "training": "https://learn.microsoft.com/training/modules/review-azure-infrastructure-changes-using-bicep-pull-requests/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2676ae46-65ca-444e-8695-fdddeace4cb1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development Lifecycle",
+ "text": "Establish a process for using code to implement quick fixes. Always register quick fixes in your team's backlog so each fix can be reworked at a later point, and you can limit technical debt.",
+ "training": "https://learn.microsoft.com/training/modules/branch-merge-git/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2cdc9d99-dbcc-4ad4-97f5-e7d358bdfa73",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Development Strategy",
+ "text": "Leverage Declarative Infrastructure as Code Tools such as Azure Bicep, ARM Templates or Terraform to build and maintain your Azure Landing Zone architecture. Both from a Platform and Application workload perspective.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-infrastructure-as-code-using-bicep/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc87a3bc-c572-4ad2-92ed-8cabab66160f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/landing-zone-security#secure",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Security",
+ "text": "Integrate security into the already combined process of development and operations in DevOps to mitigate risks in the innovation process.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-implement-security-validate-code-bases-compliance/",
+ "waf": "Operations"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
- "Cost",
- "Monitor",
- "EventHubs"
+ "Backup",
+ "Storage",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
- "waf": "Cost"
+ "subcategory": "Backup",
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Microsoft backup service",
+ "guid": "fc8af7a1-c724-e255-c18d-4ca22a6f27f0",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
- "Cost",
- "Storage"
+ "Backup",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Export cost data to a storage account for additional data analysis.",
- "waf": "Cost"
+ "subcategory": "Business Continuity",
+ "text": "Use MABS as your backup solution",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Best practice - this is Backup, not disaster recovery",
+ "guid": "be28860f-3d29-a79a-1a0e-36f1b23b36ae",
+ "link": "Best practice to deploy backup in the same region as your AVS deployment",
"services": [
- "Cost",
- "SQL"
+ "Backup",
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
- "waf": "Cost"
+ "subcategory": "Business Continuity",
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Best practice - in case AVS is unavailable",
+ "guid": "4d2f79a5-4ccf-0dfc-557c-49619b99a540",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
- "Cost"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
- "waf": "Cost"
+ "subcategory": "Business Continuity",
+ "text": "Preferably deploy MABS outside of the SDDC as native Azure IaaS",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
+ "guid": "ff431c40-962c-5182-d536-0c2f0c4ce9e0",
+ "link": "Will Disaster Recovery Site Recovery, HCX Disaster Recovery, SRM or back tools be used?",
"services": [
- "Cost"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Create multiple Apache Spark pool definitions of various sizes.",
- "waf": "Cost"
+ "subcategory": "Business Continuity",
+ "text": "Escalation process with Microsoft in the event of a regional DR",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Compare SRM with HCX",
+ "guid": "f379436d-3051-daa0-01fb-dc4e0e04d677",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/disaster-recovery-using-vmware-site-recovery-manager",
"services": [
- "Cost"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Synapse",
- "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Disaster Recovery",
+ "text": "Use VMware Site Recovery Manager when both sites are Azure VMware Solution",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Recovery into Azure instead of Vmware solution",
+ "guid": "367f71d8-3cf6-51a0-91a5-3db3d570cc19",
+ "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
"services": [
- "Cost",
- "VM"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "VM",
- "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Disaster Recovery",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Avoid manual tasks as much as possible",
+ "guid": "ee02ada0-1887-bb3a-b84c-423f45a09ef9",
+ "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
"services": [
- "Cost",
- "VM"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "VM",
- "text": "Right-sizing all VMs",
- "waf": "Cost"
+ "subcategory": "Disaster Recovery",
+ "text": "Use Automated recovery plans with either of the Disaster solutions,",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Any other datacenter in the same region",
+ "guid": "0c2b74e5-9c28-780d-1df3-12d3de4aaa76",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/connect-multiple-private-clouds-same-region",
"services": [
- "Cost",
- "VM"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "VM",
- "text": "Swap VM sized with normalized and most recent sizes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Disaster Recovery",
+ "text": "Configure a secondary disaster recovery environment",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
+ "guid": "c2a34ec4-2933-4e6c-dc36-e20e67abbe3f",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"services": [
- "Cost",
- "Monitor",
- "VM"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "VM",
- "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "subcategory": "Disaster Recovery",
+ "text": "Assign IP ranges unique to each region",
+ "waf": "Reliability"
},
{
- "category": "Right-sizing",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "category": "BCDR",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "ExpressRoute Global Reach can be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or routing must be done through network virtual appliances?",
+ "guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c",
+ "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.",
"services": [
- "Cost",
- "VM"
+ "NVA",
+ "ASR",
+ "AVS",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "VM",
- "text": "Containerizing an application can improve VM density and save money on scaling it",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Cost"
- },
- {
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Metaprompting",
- "text": "Follow Metaprompting guardrails for resonsible AI",
- "waf": "Operational Excellence"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
- "services": [
- "Entra",
- "APIM"
- ],
- "severity": "High",
- "subcategory": "Load Balancing",
- "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
- "waf": "Operational Excellence"
+ "subcategory": "Disaster Recovery",
+ "text": "Use Global Reach between DR regions",
+ "waf": "Reliability"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "An ExR Global Reach connection will be established to the ExR circuit, no other connections",
+ "guid": "a2c12df2-07fa-3edd-2cec-fda0b55fb952",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud",
"services": [
- "Monitor"
+ "AVS",
+ "VWAN"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Enable monitoring for your AOAI instances",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "Direct (no vWAN, no H&S)",
+ "text": "Global Reach to ExR circuit - no Azure resources",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use ExR to connect on-premises (other) location to Azure",
+ "guid": "f62ce162-ba5a-429d-674e-fafa1af5f706",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud",
"services": [
- "AKV",
- "Monitor",
- "Subscriptions"
+ "AVS",
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "Alerts",
- "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "ExpressRoute",
+ "text": "Connect to Azure using ExR",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use the migration assesment tool and timeline to determine bandwidth required",
+ "guid": "cf01c73b-1247-0a7a-740c-e1ea29bda340",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-introduction",
"services": [
- "Monitor"
+ "AVS",
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Monitor token usage to prevent service disruptions due to capacity",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "ExpressRoute",
+ "text": "Bandwidth sizing",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "What traffic is routed through a firewall, what goes directly into Azure",
+ "guid": "aab216ee-8941-315e-eada-c7e1f2243bd1",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
"services": [
- "Monitor"
+ "AVS",
+ "ExpressRoute"
],
"severity": "Medium",
- "subcategory": "Observability",
- "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
- "waf": "Operational Excellence"
+ "subcategory": "ExpressRoute",
+ "text": "Traffic routing ",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "AVS to ExR circuit, no traffic inspection",
+ "guid": "1f956e45-f62d-5c95-3a95-3bab718907f8",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
"services": [
- "APIM"
+ "AVS",
+ "ExpressRoute"
],
- "severity": "Low",
- "subcategory": "Observability",
- "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
- "waf": "Operational Excellence"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Infrastructure Deployment",
- "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "ExpressRoute",
+ "text": "Global Reach ",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Name of the vNet and a unique address space /24 minimum",
+ "guid": "91f7a87b-21ac-d712-959c-8df2ba034253",
+ "link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal",
"services": [
- "Entra"
+ "AVS",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Authentication",
- "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
- "waf": "Security"
- },
- {
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Evaluation",
- "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
- "waf": "Operational Excellence"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Hosting model",
- "text": "Evaluate usage of Provisioned throughput model ",
- "waf": "Performance"
- },
- {
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Content Safety",
- "text": "Review and implement Azure AI content safety",
- "waf": "Operational Excellence"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Throughput definition",
- "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
- "waf": "Performance"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
- "services": [],
"severity": "Medium",
- "subcategory": "Latency improvement",
- "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
+ "subcategory": "Hub & Spoke",
+ "text": "VNet name & address space",
"waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Subnet must be called GatewaySubnet",
+ "guid": "58a027e2-f37f-b540-45d5-e44843aba26b",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
"services": [
- "ServiceBus",
- "Storage"
+ "VPN",
+ "ExpressRoute",
+ "AVS",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Elasticity segregation",
- "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
- "waf": "Performance"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Benchmarking",
- "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "subcategory": "Hub & Spoke",
+ "text": "Gateway subnet",
"waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Create a VPN gateway on the hub Gateway subnet",
+ "guid": "d4806549-0913-3e79-b580-ac2d3706e65a",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
+ "services": [
+ "VPN",
+ "ExpressRoute",
+ "AVS",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Elasticity ",
- "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
- "waf": "Performance"
- },
- {
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Model choice",
- "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
+ "subcategory": "Hub & Spoke",
+ "text": "VPN Gateway",
"waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Create an ExR Gateway in the hub Gateway subnet.",
+ "guid": "864d7a8b-7016-c769-a717-61af6bfb73d2",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
+ "services": [
+ "VPN",
+ "ExpressRoute",
+ "AVS",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "Fine tuning",
- "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
+ "subcategory": "Hub & Spoke",
+ "text": "ExR Gateway",
"waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "How will Internet traffic be routes, Az Firewall, NVA, Secure Hub, On-Premises firewall?",
+ "guid": "cc2e11b9-7911-7da1-458c-d7fcef794aad",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/enable-public-internet-access",
"services": [
- "ACR"
+ "NVA",
+ "AVS"
],
- "severity": "Low",
- "subcategory": "Multi-region architecture",
- "text": "Deploy multiple OAI instances across regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Egress point",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Allow remote connectivity to AVS via the portal, specifically to vCenter, NSX-T and HCX",
+ "guid": "71e68ce3-982e-5e56-0191-01100ad0e66f",
+ "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html",
"services": [
- "Entra",
- "APIM"
+ "Bastion",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Load balancing",
- "text": "Implement retry & healthchecks with Gateway pattern like APIM",
- "waf": "Reliability"
- },
- {
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
- "services": [],
"severity": "Medium",
- "subcategory": "Quotas",
- "text": "Ensure having adequate quotas of TPM & RPM for the workload",
- "waf": "Reliability"
+ "subcategory": "Jumpbox & Bastion",
+ "text": "Remote connectivity to AVS",
+ "waf": "Performance"
},
{
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Name the jumpbox and identify the subnet where it will be hosted",
+ "guid": "6f8e93a2-44b1-bb1d-28a1-4d5b3c2ea857",
+ "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal",
+ "services": [
+ "Bastion",
+ "AVS",
+ "VNet"
+ ],
"severity": "Medium",
- "subcategory": "UX best practice",
- "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
- "waf": "Operational Excellence"
+ "subcategory": "Jumpbox & Bastion",
+ "text": "Configure a jumbox and Azure Bastion",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Provides secure / seamless RDP/SSH connectivity to your vm's directly through the portal.",
+ "guid": "ba430d58-4541-085c-3641-068c00be9bc5",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview",
"services": [
- "ACR"
+ "Bastion",
+ "AVS",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Load balancing",
- "text": "Deploy separate fine tuned models across regions if finetuning is employed",
- "waf": "Reliability"
+ "subcategory": "Jumpbox & Bastion",
+ "text": "Security measure allowing RDP access via the portal",
+ "waf": "Performance"
},
{
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Using a VPN to connect to Azure to enable VMware communications (HCX) (not recommended)",
+ "guid": "9988598f-2a9f-6b12-9b46-488415ceb325",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway",
"services": [
- "Backup",
- "ASR"
+ "VPN",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Data Backup and Disaster Recovery",
- "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
- "waf": "Reliability"
- },
- {
- "category": "BC and DR",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "SLA considerations",
- "text": "Azure AI search service tiers should be choosen to have a SLA ",
- "waf": "Reliability"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "Low",
- "subcategory": "Data Sensitivity",
- "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
- "waf": "Security"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Encryption at Rest",
- "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
- "waf": "Security"
+ "subcategory": "VPN",
+ "text": "Connect to Azure using a VPN",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use the migration assesment tool and timeline to determine bandwidth required (eg 3rd party tool in link)",
+ "guid": "956ce5e9-a862-fe2b-a50d-a22923569357",
+ "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.",
"services": [
- "ACR"
+ "VPN",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Transit Encryption",
- "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "VPN",
+ "text": "Bandwidth sizing",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "What traffic is routed through a firewall, what goes directly into Azure",
+ "guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
"services": [
- "RBAC"
+ "VPN",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Access Control",
- "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
- "waf": "Security"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
- "services": [],
"severity": "Medium",
- "subcategory": "Data Masking and Redaction",
- "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
- "waf": "Security"
+ "subcategory": "VPN",
+ "text": "Traffic routing ",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Name and unique address space for the vWAN, name for the vWAN hub",
+ "guid": "4dc480ac-cecd-39c4-fdc6-680b300716ab",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-site-to-site-portal#openvwan",
"services": [
- "Monitor",
- "Sentinel",
- "Defender"
+ "AVS",
+ "VWAN"
],
- "severity": "High",
- "subcategory": "Threat Detection and Monitoring",
- "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "vWAN hub",
+ "text": "vWAN name, hub name and address space",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Select either boh or the appropriate connection type.",
+ "guid": "51d6affd-8e02-6aea-d3d4-0baf618b3076",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal",
"services": [
- "AzurePolicy"
+ "VPN",
+ "AVS",
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Data Retention and Disposal",
- "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
- "waf": "Security"
- },
- {
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Jail break Safety",
- "text": "Implement Prompt shields and groundedness detection using Content Safety ",
- "waf": "Operational Excellence"
+ "subcategory": "vWAN hub",
+ "text": "ExR and/or VPN gateway provisioned",
+ "waf": "Performance"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Data Privacy and Compliance",
- "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "category": "Connectivity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Add Azure firewall to vWAN (recommended)",
+ "guid": "e32a4c67-3dc0-c134-1c12-52d46dcbab5b",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal",
+ "services": [
+ "AVS",
+ "VWAN",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "subcategory": "vWAN hub",
+ "text": "Secure vWAN",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Active directory or other identity provider servers",
+ "guid": "fbc47fbf-bc96-fa93-ed5d-8c9be63cd5c3",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter",
+ "services": [
+ "Entra",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Employee Awareness and Training",
- "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "subcategory": "Access",
+ "text": "External Identity (user accounts)",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Environment segregation",
- "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Not required for LDAPS, required for Kerberos",
+ "guid": "b5db7975-f6bb-8ba3-ee5f-e3e805887997",
+ "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology",
+ "services": [
+ "Entra",
+ "AVS"
+ ],
+ "severity": "Medium",
+ "subcategory": "Access",
+ "text": "If using AD domain, ensure Sites & Services has been configured",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Authentication for users, must be secure.",
+ "guid": "c30749c4-e2af-558c-2eb9-0b6ae84881d1",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter",
+ "services": [
+ "Entra",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Index Segregation",
- "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "subcategory": "Access",
+ "text": "Use LDAPS not ldap ( vCenter)",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Authentication for users, must be secure.",
+ "guid": "64cb9b5c-9edd-787e-1dd8-2b2338e51635",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/configure-external-identity-source-nsx-t",
"services": [
- "RBAC",
- "AzurePolicy"
+ "Entra",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Sensitive Data in Separate Instances",
- "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "subcategory": "Access",
+ "text": "Use LDAPS not ldap (NSX-T)",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Embedding and Vector handling",
- "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "CN or SAN names, no wildcards, contains private key - CER or PFX",
+ "guid": "bec285ab-037e-d629-81d1-f61dac23cd4c",
+ "link": "https://youtu.be/4jvfbsrhnEs",
+ "services": [
+ "Entra",
+ "AVS"
+ ],
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "Security certificate installed on LDAPS servers ",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Standard Azure Roles Based Access Controls",
+ "guid": "4ba394a2-3c33-104c-8e34-2dadaba9cc73",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity",
"services": [
+ "Entra",
+ "AVS",
"RBAC"
],
- "severity": "High",
- "subcategory": "Access control",
- "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "RBAC applied to Azure roles",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Create roles in vCenter required to meet minimum viable access guidelines",
+ "guid": "b04ca129-83a9-3494-7512-347dd2d766db",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges",
"services": [
- "PrivateLink"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Network security",
- "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "RBAC model in vCenter",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "guid": "8e477d2f-8004-3dd0-93d6-0aece9e1b2fb",
+ "link": "Best practice",
"services": [
- "Firewall",
- "VNet"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Network security",
- "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
- "waf": "Security"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Control Network Access",
- "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "severity": "Medium",
+ "subcategory": "Security",
+ "text": "CloudAdmin role usage",
"waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "For roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "guid": "00e0b729-f9be-f600-8c32-5ec0e8f2ed63",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
"services": [
- "Cost"
+ "Entra",
+ "AVS",
+ "RBAC"
],
"severity": "Medium",
- "subcategory": "Token Optimization",
- "text": "Use prompt compression tools like LLMLingua or gprtrim",
- "waf": "Cost Optimization"
+ "subcategory": "Security ",
+ "text": "Is Privileged Identity Management implemented",
+ "waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "For the Azure VMware Solution PIM roles",
+ "guid": "0842d45f-41a8-8274-1155-2f6ed554d315",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
"services": [
- "AKV",
- "Entra"
+ "Entra",
+ "AVS",
+ "RBAC"
],
- "severity": "High",
- "subcategory": "Secure APIs and Endpoints",
- "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
- "waf": "Security"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
- "services": [],
"severity": "Medium",
- "subcategory": "Implement Strong Authentication",
- "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
+ "subcategory": "Security ",
+ "text": "Is Privileged Identity Management audit reporting implemented",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Best practice, also see Monitoring/Alerts",
+ "guid": "915cbcd7-0640-eb7c-4162-9f33775de559",
+ "link": "Best practice",
"services": [
+ "Entra",
+ "AVS",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Use Network Monitoring",
- "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
+ "subcategory": "Security ",
+ "text": "Limit use of CloudAdmin account to emergency access only",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Identity",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Operational procedure",
+ "guid": "7effa0c0-9172-e8e4-726a-67dbea8be40a",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/rotate-cloudadmin-credentials?tabs=azure-portal",
+ "services": [
+ "Entra",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Security Audits and Penetration Testing",
- "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
+ "subcategory": "Security ",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "Low",
- "subcategory": "Infrastructure Deployment",
- "text": "Azure AI Services are properly tagged for better management",
- "waf": "Operational Excellence"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "Low",
- "subcategory": "Infrastructure Deployment",
- "text": "Azure AI Service accounts follows organizational naming conventions",
- "waf": "Operational Excellence"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Diagnostics Logging",
- "text": "Diagnostic logs in Azure AI services resources should be enabled",
- "waf": "Operational Excellence"
- },
- {
- "category": "Identity and Access Management",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82",
+ "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview",
"services": [
- "Entra"
+ "VM",
+ "AVS",
+ "Arc"
],
- "severity": "High",
- "subcategory": "Entra ID based access",
- "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "AVS VM Management (Azure Arc)",
+ "waf": "Operations"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
+ "guid": "11dbe773-e380-9191-1418-e886fa7a6fd0",
+ "link": "https://docs.microsoft.com/azure/governance/policy/overview",
"services": [
- "AKV",
- "Entra"
+ "AzurePolicy",
+ "AVS",
+ "Monitor"
],
- "severity": "High",
- "subcategory": "Secure Key Management",
- "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Azure policy",
+ "waf": "Operations"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "guid": "1e59c639-9b7e-a60b-5e93-3798c1aff5db",
+ "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json#configure-locks",
"services": [
- "AKV"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Key Rotation and Expiration",
- "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Resource locks",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "For manual deployments, all configuration and deployments must be documented",
+ "guid": "8f2c46aa-ca1b-cad3-3ac9-213dfc0a265e",
+ "link": "Make sure to create your own runbook on the deployment of AVS.",
"services": [
- "Cost"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Token Optimization",
- "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
- "waf": "Cost Optimization"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Secure coding practice",
- "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
- "waf": "Security"
- },
- {
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "services": [],
- "severity": "High",
- "subcategory": "Patching and updates",
- "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Run books",
+ "waf": "Operations"
},
{
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
+ "category": "Management",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
"services": [
- "AzurePolicy"
+ "AKV",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Governance",
- "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Naming conventions for auth keys",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "For automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "guid": "e22a2d99-eb71-7d7c-07af-6d4cdb1d4443",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
"services": [
- "Cost"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Cost familiarization",
- "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
- "waf": "Cost Optimization"
+ "subcategory": "Alerts",
+ "text": "Create warning alerts for critical thresholds ",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "guid": "6d02f159-627d-79bf-a931-fab6d947eda2",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
"services": [
- "Cost"
+ "Monitor",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Batch processing",
- "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
- "waf": "Cost Optimization"
+ "severity": "Medium",
+ "subcategory": "Alerts",
+ "text": "Create critical alert vSAN consumption",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Provides platform alerts (generated by Microsoft)",
+ "guid": "1cc97b39-2c7e-246f-6d73-789cfebfe951",
+ "link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Cost monitoring",
- "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
- "waf": "Cost Optimization"
+ "subcategory": "Alerts",
+ "text": "Configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
+ "guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
- "Cost"
+ "AzurePolicy",
+ "Monitor",
+ "Backup",
+ "AVS",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Token limit",
- "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
- "waf": "Cost Optimization"
+ "subcategory": "Backup",
+ "text": "Backup policy",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Keep in mind the lead time for requesting new nodes",
+ "guid": "4ec7ccfb-795e-897e-4a84-fd31c04eadc6",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
+ "services": [
+ "AzurePolicy",
+ "AVS",
+ "Monitor"
+ ],
"severity": "Medium",
- "subcategory": "AI Search Reliability",
- "text": "Review the guidance provided on setting up AI search for Reliability",
- "waf": "Operational Excellence"
+ "subcategory": "Capacity",
+ "text": "Policy around ESXi host density and efficiency",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Azure Cost Management can be used - one option, put AVS in it's own Subscription. ",
+ "guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern",
"services": [
- "Storage"
+ "Subscriptions",
+ "Cost",
+ "AVS",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "AI Search Vector Limits",
- "text": "Plan and manage AI Search Vector storage",
- "waf": "Operational Excellence"
+ "subcategory": "Costs",
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - ",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Create dashboards to enable core Azure VMware Solution monitoring insights",
+ "guid": "01e689e0-7c6c-b58f-37bd-4d6b9b1b9c74",
+ "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards",
"services": [
- "ACR"
+ "NetworkWatcher",
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
- "waf": "Operational Excellence"
+ "subcategory": "Dashboard",
+ "text": "Connection monitor dashboard",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Send to an Azure Storage account or Azure EventHub for processing (direct to Log Analytics is pending)",
+ "guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
- "Cost",
- "Storage"
+ "Storage",
+ "Monitor",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Costing Model",
- "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
- "waf": "Cost Optimization"
+ "severity": "Medium",
+ "subcategory": "Logs & Metrics",
+ "text": "Configure Azure VMware Solution logging ",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Must be on-premises, implement if available",
+ "guid": "7cbac8c3-4eda-d5d9-9bda-c6b5abba9fb6",
+ "link": "Is vROPS or vRealize Network Insight going to be used? ",
+ "services": [
+ "Monitor",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Evaluate the quality of prompts and applications when switching between model versions",
- "waf": "Operational Excellence"
+ "subcategory": "Logs & Metrics",
+ "text": "vRealize Operations",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "guid": "b243521a-644d-f865-7fb6-21f9019c0dd2",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
+ "VM",
+ "AVS",
"Monitor"
],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
- "waf": "Operational Excellence"
+ "subcategory": "Logs & Metrics",
+ "text": "AVS VM logging",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Between on-premises to Azure are monitored using 'connection monitor'",
+ "guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "services": [
+ "Monitor",
+ "ExpressRoute",
+ "VPN",
+ "AVS",
+ "NetworkWatcher"
+ ],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Evaluate your Azure AI Search results based on different search parameters",
- "waf": "Operational Excellence"
+ "subcategory": "Network",
+ "text": "Monitor ExpressRoute and/or VPN connections ",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "To monitor the Azure VMware Solution back-end ExpressRoute connection (Azure native to AVS)",
+ "guid": "99209143-60fe-19f0-5633-8b5671277ba5",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "services": [
+ "Monitor",
+ "AVS",
+ "ExpressRoute"
+ ],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
- "waf": "Operational Excellence"
+ "subcategory": "Network",
+ "text": "Monitor from an Azure native resource to an Azure VMware Solution VM",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "To monitor end-to-end, on-premises to AVS workloads",
+ "guid": "b9e5867c-57d3-036f-fb1b-3f0a71664efe",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
+ "services": [
+ "Monitor",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
- "waf": "Operational Excellence"
+ "subcategory": "Network",
+ "text": "Monitor from an on-premises resource to an Azure VMware Solution VM",
+ "waf": "Operations"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Track requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "guid": "4af7c5f7-e5e9-bedf-a8cf-314b81735962",
+ "link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)",
+ "services": [
+ "Monitor",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Security Audits and Penetration Testing",
- "text": "Red team your GenAI applications",
- "waf": "Security"
+ "subcategory": "Security",
+ "text": "Auditing and logging is implemented for inbound internet ",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "guid": "74be60a3-cfac-f057-eda6-3ee087e805d5",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
+ "services": [
+ "Monitor",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "End user feedback",
- "text": "Provide end users with scoring options for LLM responses and track these scores. ",
- "waf": "Operational Excellence"
+ "subcategory": "Security",
+ "text": "Session monitoring ",
+ "waf": "Operations"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Enable Diagnostic and metric logging on Azure VMware Solution",
+ "guid": "a434b3b5-f258-0845-cd76-d7df6ef5890e",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
- "Cost"
+ "Monitor",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Quota Management",
- "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
- "waf": "Cost Optimization"
+ "severity": "Medium",
+ "subcategory": "VMWare",
+ "text": "Logging and diagnostics",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "category": "Monitoring",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Monitor AVS workloads (each VM in AVS)",
+ "guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a",
+ "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard",
"services": [
- "LoadBalancer",
- "ACR",
- "Entra",
- "APIM"
+ "VM",
+ "AVS",
+ "Monitor"
],
"severity": "Medium",
- "subcategory": "Load Balancing",
- "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
- "waf": "Operational Excellence"
+ "subcategory": "VMware",
+ "text": "Log Analytics Agents deployed on Azure VMware Solution guest VM workloads",
+ "waf": "Operations"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Decision on traffic flow",
+ "guid": "a1354b87-e18e-bf5c-c50b-8ddf0540e971",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke",
"services": [
- "Storage"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Fine tuning",
- "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
- "waf": "Reliability"
+ "subcategory": "Hub & Spoke",
+ "text": "North/South routing through Az Firewall or 3rd party ",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)",
+ "guid": "29a8a499-ec31-f336-3266-0895f035e379",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke",
"services": [
- "Monitor"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
- "waf": "Reliability"
+ "subcategory": "Hub & Spoke",
+ "text": "East West (Internal to Azure)",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Requires a 3rd party NVA with Azure Route server - Scenario 2 (see link)",
+ "guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
"services": [
- "Monitor"
+ "NVA",
+ "ARS",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
- "waf": "Reliability"
+ "subcategory": "Hub & Spoke",
+ "text": "ExR without Global Reach",
+ "waf": "Operations"
},
{
- "category": "Responsible AI",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "When route server is used, ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN",
+ "guid": "ffb5c5ca-bd89-ff1b-8b73-8a54d503d506",
+ "link": "https://learn.microsoft.com/azure/route-server/route-server-faq",
+ "services": [
+ "ARS",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Content Safety",
- "text": "Tune content filters to minimize false positives from overly aggressive filters",
- "waf": "Reliability"
+ "subcategory": "Hub & Spoke",
+ "text": "Route server ",
+ "waf": "Operations"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Via on-premises, Az Firewall, 3rd Party, NSX-T pubic IP",
+ "guid": "a4070dad-3def-818d-e9f7-be440d10e7de",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-design-public-internet-access",
"services": [
- "AKV"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Key Management",
- "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "subcategory": "Internet",
+ "text": "Egress point(s)",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Az Firewall, 3rd party NVA, Application Gateway, Azure Frontdoor ",
+ "guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937",
+ "link": "Research and choose optimal solution for each application",
"services": [
- "LoadBalancer"
+ "NVA",
+ "AppGW",
+ "FrontDoor",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Jailbreak protection",
- "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "subcategory": "Internet",
+ "text": "Internet facing applications",
"waf": "Security"
},
{
- "category": "Governance and Security",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN",
+ "guid": "e778a2ec-b4d7-1d27-574c-14476b167d37",
+ "link": "https://docs.microsoft.com/azure/route-server/route-server-faq#route-server-limits",
+ "services": [
+ "ARS",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "Quota exhaustion",
- "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
+ "subcategory": "Routing",
+ "text": "When route server Route limit understood? ",
"waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "(VPN Gateway, AppGW, FrontDoor, Load balancer, VMs (etc) (Remove: enabled on ExR/VPN Gateway subnet in Azure)",
+ "guid": "66c97b30-81b9-139a-cc76-dd1d94aef42a",
+ "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection",
"services": [
- "Cost"
+ "LoadBalancer",
+ "VNet",
+ "ExpressRoute",
+ "VPN",
+ "FrontDoor",
+ "AVS",
+ "AppGW",
+ "VM",
+ "DDoS"
],
"severity": "Medium",
- "subcategory": "Cost estimation",
- "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
- "waf": "Cost Optimization"
+ "subcategory": "Security",
+ "text": "Is DDoS standard protection of public facing IP addresses? ",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
- "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "To manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "guid": "d43da920-4ecc-a4e9-dd45-a2986ce81d32",
+ "link": "Best practice: Bastion or 3rd party tool",
"services": [
- "Cost"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Model selection",
- "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
- "waf": "Cost Optimization"
+ "subcategory": "Security",
+ "text": "Use a dedicated privileged access workstation (PAW)",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use NSX-T for inter-vmware-traffic inspection",
+ "guid": "a2dac74f-5380-6e39-25e6-f13b99ece51f",
+ "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-F6685367-7AA1-4771-927E-ED77727CFDA3.html",
"services": [
- "Cost"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Usage Optimization",
- "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
- "waf": "Cost Optimization"
+ "subcategory": "Traffic Inspection",
+ "text": "East West (Internal to AVS)",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Decision on whether or not to use Secure hub for E/W and Internet traffic - requires Global Reach",
+ "guid": "3f621543-dfac-c471-54a6-7b2849b6909a",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
"services": [
- "Cost"
+ "AVS",
+ "VWAN",
+ "Firewall"
],
"severity": "Medium",
- "subcategory": "Usage Optimization",
- "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
- "waf": "Cost Optimization"
+ "subcategory": "Virtual WAN",
+ "text": "Use Secure Hub (Azure Firewall or 3rd party)",
+ "waf": "Security"
},
{
- "category": "Cost Optimization",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "category": "Networking",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)",
+ "guid": "d7af5670-1b39-d95d-6da2-8d660dfbe16b",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/secure-cloud-network",
"services": [
- "Cost"
+ "AVS",
+ "VWAN"
],
"severity": "Medium",
- "subcategory": "Token Optimization",
- "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
- "waf": "Cost Optimization"
+ "subcategory": "Virtual WAN",
+ "text": "East West (Internal to Azure)",
+ "waf": "Security"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
- "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "guid": "7d049005-eb35-4a93-50a5-3b31a9f61161",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal",
+ "services": [
+ "Subscriptions",
+ "AVS"
+ ],
"severity": "Medium",
- "subcategory": "IaC",
- "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
- "waf": "Operational Excellence"
+ "subcategory": "Automated Scale",
+ "text": "Scale out operations planning",
+ "waf": "Performance"
},
{
- "category": "Operations Management",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5855",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
- "service": "Azure OpenAI",
- "services": [],
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale",
+ "services": [
+ "Storage",
+ "AVS",
+ "AzurePolicy"
+ ],
"severity": "Medium",
- "subcategory": "Development",
- "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
- "waf": "Operational Excellence"
+ "subcategory": "Automated Scale",
+ "text": "Scale in operations planning",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
+ "guid": "3233e49e-62ce-97f3-8737-8230e771b694",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale",
"services": [
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Development best practices",
- "text": "Implement an error handling policy at the global level",
- "waf": "Operations"
+ "subcategory": "Automated Scale",
+ "text": "Scale serialized operations planning",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "guid": "68161d66-5707-319b-e77d-9217da892593",
+ "link": "Best practice (testing)",
"services": [
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Development best practices",
- "text": "Ensure all APIs policies include a element.",
- "waf": "Operations"
+ "subcategory": "Automated Scale",
+ "text": "Scale rd operations planning",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Define and enforce scale in/out maximum limits for your environment in the automations",
+ "guid": "c32cb953-e860-f204-957a-c79d61202669",
+ "link": "Operational planning - understand workload requirements",
"services": [
- "ACR",
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Development best practices",
- "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
- "waf": "Operations"
+ "subcategory": "Automated Scale",
+ "text": "Scale maximum operations planning",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "guid": "7bd65a5e-7b5d-652d-dbea-fc6f73a42857",
+ "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring",
"services": [
- "APIM"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Monetization",
- "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
- "waf": "Operations"
+ "subcategory": "Automated Scale",
+ "text": "Monitor scaling operations ",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
"services": [
- "Monitor",
- "APIM"
+ "PrivateLink",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Networking",
+ "text": "Private link",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
+ "category": "Other Services/Operations",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "guid": "71eff90d-5ad7-ac60-6244-2a6f7d3c51f2",
+ "link": "Best practice",
"services": [
- "Monitor",
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Monitoring",
- "text": "Enable Application Insights for more detailed telemetry",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "Provisioning Vmware VLANs",
+ "waf": "Performance"
},
{
- "category": "Governance",
- "checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "In which region will AVS be deployed",
+ "guid": "04e3a2f9-83b7-968a-1044-2811811a924b",
+ "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology",
"services": [
- "Monitor",
- "APIM"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Monitoring",
- "text": "Configure alerts on the most critical metrics",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Pre-deployment",
+ "text": "Region selected",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Are there regulatory or compliance policies in play",
+ "guid": "e52d1615-9cc6-565c-deb6-743ed7e90f4b",
+ "link": "Internal policy or regulatory compliance",
"services": [
- "AKV",
- "APIM",
- "Entra"
+ "AzurePolicy",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Data protection",
- "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Pre-deployment",
+ "text": "Data residency compliant with selected regions",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Request through the support blade",
+ "guid": "92bd5ad6-441f-a983-7aa9-05dd669d760b",
+ "link": "https://learn.microsoft.com/azure/migrate/concepts-azure-vmware-solution-assessment-calculation",
"services": [
- "Entra",
- "APIM"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Identity",
- "text": "Protect incoming requests to APIs (data plane) with Azure AD",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Pre-deployment",
+ "text": "Request for number of AVS hosts submitted ",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "PG approval for deployment",
+ "guid": "28370f63-1cb8-2e35-907f-c5516b6954fa",
+ "link": "Support request through portal or get help from Account Team",
"services": [
- "Entra",
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Identity",
- "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
- "waf": "Security"
+ "subcategory": "Pre-deployment",
+ "text": "Region and number of AVS nodes approved",
+ "waf": "Reliability"
},
{
- "category": "Identity and Access Management",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Portal/subscription/resource providers/ Microsoft.AVS",
+ "guid": "96c76997-30a6-bb92-024d-f4f93f5f57fa",
+ "link": "Done through the subscription/resource providers/ AVS register in the portal",
"services": [
- "Entra",
- "APIM"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Privileged access",
- "text": "Create appropriate groups to control the visibility of the products",
- "waf": "Security"
+ "subcategory": "Pre-deployment",
+ "text": "Resource provider for AVS registered",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Connectivity, subscription & governanace model",
+ "guid": "5898e3ff-5e6b-bee1-6f85-22fee261ce63",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone",
"services": [
- "APIM"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "Use Backends feature to eliminate redundant API backend configurations",
- "waf": "Operations"
+ "subcategory": "Pre-deployment",
+ "text": "Landing zone architecture",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "The name of the RG where AVS will exist",
+ "guid": "d0181fb8-9cb8-bf4b-f5e5-b5f9bf7ae4ea",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/manage-resource-groups-portal",
"services": [
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "Use Named Values to store common values that can be used in policies",
- "waf": "Operations"
+ "subcategory": "Pre-deployment",
+ "text": "Resource group name selected",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Each resource created as part of the deployment will also utilize this prefix in the name",
+ "guid": "0f0d20c2-5a19-726c-de20-0984e070d9d6",
+ "link": "Best practice - naming standards",
"services": [
- "ACR",
- "APIM",
- "ASR"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Business continuity and disaster recovery",
- "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
+ "subcategory": "Pre-deployment",
+ "text": "Deployment prefix selected",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "/22 unique non-overlapping IPv4 address space",
+ "guid": "7fbf2ab7-a36c-5957-c27a-67038557af2a",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-network-checklist#routing-and-subnet-considerations",
"services": [
- "APIM",
- "ASR"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
+ "subcategory": "Pre-deployment",
+ "text": "Network space for AVS management layer",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "vNets used by workloads running in AVS (non-stretched)",
+ "guid": "0c87f999-e517-21ef-f355-f210ad4134d2",
+ "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html",
"services": [
- "APIM",
- "Backup",
- "ASR"
+ "AVS",
+ "VNet"
],
- "severity": "High",
- "subcategory": "Business continuity and disaster recovery",
- "text": "Ensure there is an automated backup routine",
+ "severity": "Medium",
+ "subcategory": "Pre-deployment",
+ "text": "Network space for AVS NSX-T segments",
"waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Choose AV36, AV36P, AV52, AV36T (AV36T = Trial)",
+ "guid": "946c8966-f902-6f53-4f37-00847e8895c2",
+ "link": "https://azure.microsoft.com/pricing/details/azure-vmware/",
"services": [
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Failover and Caching",
- "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
- "waf": "Reliability"
+ "subcategory": "Pre-deployment",
+ "text": "AVS SKU (region dependent)",
+ "waf": "Performance"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use the Azure migration assessment tool to determine the minimum number of nodes required (consider BCDR as well)",
+ "guid": "31833808-26ba-9c31-416f-d54a89a17f5d",
+ "link": "https://learn.microsoft.com/azure/migrate/how-to-assess",
"services": [
- "APIM",
- "AzurePolicy"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Performance and scalability",
- "text": "Consider using a external cache policy for APIs that can benefit from caching",
- "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
+ "subcategory": "Pre-deployment",
+ "text": "Number of hosts to be deployed",
+ "waf": "Performance"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Understand how and if you should be using reserved instances (cost control)",
+ "guid": "f2b73c4f-3d46-32c9-5df1-5b8dfcd3947f",
+ "link": "https://azure.microsoft.com/en-ca/pricing/details/azure-vmware/#:~:text=Azure%20VMware%20Solution%20%20%20%20Instance%20size,TB%20%28all%20NVMe%29%20%20%20N%2FA%20%2Fhour%20",
"services": [
- "APIM",
- "AzurePolicy",
- "EventHubs"
+ "Cost",
+ "AVS"
],
- "severity": "Low",
- "subcategory": "Performance and scalability",
- "text": "If you need to log at high performance levels, consider Event Hubs policy",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Pre-deployment",
+ "text": "Reserverd Instances",
+ "waf": "Cost"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "guid": "94ac48ab-ade5-3fa7-f800-263feeb97070",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "APIM",
- "AzurePolicy"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Performance and scalability",
- "text": "Apply throttling policies to control the number of requests per second",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "subcategory": "Pre-deployment",
+ "text": "Capacity ",
"waf": "Performance"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Identify which of the networking scenarios make ",
+ "guid": "1f9d4bd5-14b8-928c-b4cb-eb211f9b8de5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Performance and scalability",
- "text": "Configure autoscaling to scale out the number of instances when the load increases",
- "waf": "Performance"
+ "subcategory": "Pre-deployment",
+ "text": "Networking & Connectivity See docs describing scenrario 1 through 5",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "category": "Planning",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
+ "guid": "070db19b-8a2a-fd6a-c39b-4488d8780da9",
+ "link": "Please Check Partner Ecosystem",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Performance and scalability",
- "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
- "waf": "Performance"
+ "subcategory": "Pre-deployment",
+ "text": "3rd party application compatibility ",
+ "waf": "Reliability"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646",
+ "link": "General recommendation for storing encryption keys.",
"services": [
- "APIM"
+ "AKV",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Premium Tier",
- "text": "Use the premium tier for production workloads.",
- "waf": "Reliability"
+ "subcategory": "Encryption",
+ "text": "Use Azure Key Vault with in-guest encryption ",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "guid": "c1a81638-18df-0ce9-a73a-4b9a8a8dd392",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#data-at-rest-encryption",
"services": [
- "APIM",
- "AzurePolicy"
+ "SQL",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Request Routing",
- "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
- "waf": "Reliability"
+ "subcategory": "Encryption",
+ "text": "Use in-guest encryption",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "guid": "8d0a8f51-8d35-19cd-c2fe-4e3512fb467e",
+ "link": "https://docs.microsoft.com/azure/key-vault/general/authentication",
"services": [
- "Entra",
- "APIM"
+ "AKV",
+ "AVS",
+ "ExpressRoute"
],
- "severity": "High",
- "subcategory": "Resource Limits",
- "text": "Be aware of APIM's limits",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Encryption",
+ "text": "Keyvault use for secrets",
+ "waf": "Security"
},
{
- "category": "Management",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Older OS security patching configured for workloads running on Azure VMware Solution are eligible for ESU",
+ "guid": "4f8b20e9-a2a1-f80f-af9b-8aa3b26dca08",
+ "link": "https://docs.microsoft.com/windows-server/get-started/extended-security-updates-deploy",
"services": [
- "APIM"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Self-Hosted",
- "text": "Ensure that the self-hosted gateway deployments are resilient.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "subcategory": "Extended support",
+ "text": "Ensure extended security update support ",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Use a SIEM/SOAR",
+ "guid": "9bb22fec-4d00-3b95-7136-e225d0f5c63a",
+ "link": "https://learn.microsoft.com/azure/sentinel/overview",
"services": [
- "Entra",
- "APIM",
- "FrontDoor"
+ "Sentinel",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Connectivity",
- "text": "Use Azure Front Door in front of APIM for multi-region deployment",
- "waf": "Performance"
+ "subcategory": "Investigation",
+ "text": "Enable Azure Sentinel or 3rd party SIEM ",
+ "waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "MS Defender For Cloud, for workloads running on Azure VMware Solution",
+ "guid": "f42b0b09-c591-238a-1580-2de3c485ebd2",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites",
"services": [
- "APIM",
- "VNet"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
- "text": "Deploy the service within a Virtual Network (VNet)",
+ "text": "Enable Advanced Threat Detection ",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "category": "Security",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Are the applicable policies enabled (compliance baselines added to MDfC)",
+ "guid": "bcdd2348-3d0e-c6bb-1092-aa4cd1a66d6b",
+ "link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration",
"services": [
- "Monitor",
- "APIM",
- "Entra",
- "VNet"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
- "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
+ "text": "Policy & Regulatory Compliance",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Azure to Azure (E/W), Azure to On-premises), AVS to Internet, AVS to Azure",
+ "guid": "607c1ca9-da92-ae19-5a4c-eb1e876acbe7",
+ "link": "https://techcommunity.microsoft.com/t5/azure-migration-and/firewall-integration-in-azure-vmware-solution/ba-p/2254961#:~:text=Azure%20VMware%20Solution%20customers%20have%20multiple%20security%20options,the%20box%20to%20provide%20East-West%20and%20North-South%20firewalling.",
"services": [
- "Entra",
- "APIM",
- "PrivateLink",
- "VNet"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Security",
- "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
+ "subcategory": "Firewalls",
+ "text": "Azure / 3rd party firewall",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "To allow HCX appliance to connect/sync",
+ "guid": "1d87925c-c02b-7fde-a425-7e95ad846a27",
+ "link": "https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-networking-security/GUID-2CFE1654-9CC9-4EDB-A625-21317299E559.html",
"services": [
- "APIM"
+ "AVS"
],
- "severity": "High",
- "subcategory": "Security",
- "text": "Disable Public Network Access",
+ "severity": "Medium",
+ "subcategory": "Firewalls",
+ "text": "Firewalls allow for East/West traffic inside AVS",
"waf": "Security"
},
{
- "category": "Platform automation and DevOps",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Decision on which tool to use (SRM requires additional license - enables automation & other features)",
+ "guid": "468b3495-2f6e-b65a-38ef-3ba631bcaa46",
+ "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-B842696B-89EF-4183-9C73-B77157F56055.html",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Automation",
- "text": "Simplify management with PowerShell automation scripts",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "HCX and/or SRM",
+ "waf": "Reliability"
},
{
- "category": "Platform automation and DevOps",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Read up on requirements for Service Mesh requirements and how HCX ",
+ "guid": "be2ced52-da08-d366-cf7c-044c19e29509",
+ "link": "https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-76BCD059-A31A-4041-9105-ACFB56213E7C.html",
"services": [
- "Entra",
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "Configuring and Managing the HCX Interconnect",
+ "waf": "Reliability"
},
{
- "category": "Platform automation and DevOps",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "If you are planning on using stretch networks ensure that your on-premises environment requirements",
+ "guid": "7dcac579-fc5c-5c9c-f1f7-9b1149ff2c37",
+ "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-DBDB4D1B-60B6-4D16-936B-4AC632606909.html",
"services": [
- "Entra",
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Best practices",
- "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "Restrictions and limitations for network extensions",
+ "waf": "Performance"
},
{
- "category": "Platform automation and DevOps",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Do workloads require MoN?",
+ "guid": "cf45c0b9-6c4b-3bfb-86c5-62fe54061c73",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/vmware-hcx-mon-guidance",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "DevOps",
- "text": "Implement DevOps and CI/CD in your workflow",
- "waf": "Operations"
+ "subcategory": "Networking",
+ "text": "Mobility optimized networking",
+ "waf": "Performance"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Operating system level of Vmware environment",
+ "guid": "b7cf11f3-b12e-5189-991a-06df5250d2ca",
+ "link": "https://learn.microsoft.com/azure/site-recovery/vmware-physical-azure-support-matrix",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "APIs",
- "text": "Secure APIs using client certificate authentication",
- "waf": "Security"
+ "subcategory": "On-premises pre-requisites",
+ "text": "Support matrix (OS versions etc).",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Required that all switches are dynamic",
+ "guid": "45fe9252-aa1b-4e30-45c6-bc02f3b76acf",
+ "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/vsan-network-design-guide/GUID-91E1CD6F-33A6-4AC6-BC22-3E4807296F86.html#:~:text=Migrate%20Management%20Network%201%20Add%20hosts%20to%20the,each%20host.%20...%204%20Finish%20the%20configuration.%20",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "APIs",
- "text": "Secure backend services using client certificate authentication",
- "waf": "Security"
+ "subcategory": "On-premises pre-requisites",
+ "text": "Standard switches converted to dynamic switches",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "See sections on sizing and capacity in the link.",
+ "guid": "e9f6d736-ee44-e2ac-e7f9-e361f8c857f3",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/plan-private-cloud-deployment",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "APIs",
- "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
- "waf": "Security"
+ "subcategory": "On-premises pre-requisites",
+ "text": "Capacity for HCX appliance",
+ "waf": "Performance"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Check hardware restrictions to ensure compatibility with AVS/OS ",
+ "guid": "1be2cdd6-15a7-9a33-aea7-113859035ce9",
+ "link": "https://kb.vmware.com/s/article/2007240#:~:text=ESXi%2FESX%20hosts%20and%20compatible%20virtual%20machine%20hardware%20versions,%20Not%20Supported%20%204%20more%20rows",
"services": [
- "APIM"
+ "AVS"
],
"severity": "Medium",
- "subcategory": "APIs",
- "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
- "waf": "Security"
+ "subcategory": "On-premises pre-requisites",
+ "text": "Hardware compatibility",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Need to be converted",
+ "guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7",
+ "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html",
"services": [
- "APIM"
+ "Storage",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Ciphers",
- "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "VSAN RDM disks are converted - not supported.",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Need to be converted",
+ "guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611",
+ "link": "3rd-Party tools",
"services": [
- "AKV",
- "APIM"
+ "Storage",
+ "VM",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Data protection",
- "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "VM with SCSI shared bus are not supported",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Remove Direct IO before migration",
+ "guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381",
+ "link": "Contact VMware",
"services": [
- "Entra",
- "APIM"
+ "Storage",
+ "VM",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Identities",
- "text": "Use managed identities to authenticate to other Azure resources whenever possible",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "VM with Direct IO require removing DirectPath device",
+ "waf": "Operations"
},
{
- "category": "Security",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Cannot migrate clusters ",
+ "guid": "efc8a311-74f8-0252-c6a0-4bac7610e266",
+ "link": "Contact VMware",
"services": [
- "WAF",
- "Entra",
- "APIM",
- "AppGW"
+ "Storage",
+ "AVS"
],
- "severity": "High",
- "subcategory": "Network",
- "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "Shared VMDK files are not supported",
+ "waf": "Operations"
},
{
- "category": "BCDR",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Ensure that your backups are protected against attacks. This should include encryption of the backups to protect against loss of confidentiality. For regular Azure service backup, backup data is automatically encrypted using Azure platform-managed keys. You can also choose to encrypt the backup using a customer-managed key. In this case, ensure this customer-managed key in the key vault is also in the backup scope.",
- "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Convert to a different format",
+ "guid": "ab6c89cd-a26f-b894-fe59-61863975458e",
+ "link": "Contact VMware",
"services": [
- "SQL",
- "AKV",
- "Backup"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Azure Key Vault",
- "text": "Protect your backup data with encryption and store keys safely in Azure Key Vault",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "RDM with 'physical compatibility mode' are not supported.",
+ "waf": "Operations"
},
{
- "category": "BCDR",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure SQL Database uses SQL Server technology to create full backups every week, differential backup every 12-24 hours, and transaction log backup every 5 to 10 minutes. By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region.",
- "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning 'RAID-1 FTT-1' is default with Thin Provisioning",
+ "guid": "7628d446-6b10-9678-9cec-f407d990de43",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "SQL",
+ "VM",
"Storage",
- "Backup"
+ "AVS",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Backup",
- "text": "Configure Azure SQL Database automated backups",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Default storage policy",
+ "waf": "Operations"
},
{
- "category": "BCDR",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region. For SQL Database, the backup storage redundancy can be configured at the time of database creation or can be updated for an existing database; the changes made to an existing database apply to future backups only.",
- "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "The default storage policy is set to RAID-1 (Mirroring) FTT-1, with Object Space Reservation set to Thin provisioning.",
+ "guid": "37fef358-7ab9-43a9-542c-22673955200e",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy",
"services": [
- "SQL",
+ "AzurePolicy",
"Storage",
- "Backup"
+ "AVS",
+ "VM"
],
- "severity": "Low",
- "subcategory": "Backup",
- "text": "Enable geo-redundant backup storage to protect against single region failure and data loss",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "Ensure that the appropriate VM template storage policy is used",
+ "waf": "Operations"
},
{
- "category": "Code",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Malicious code can potentially circumvent security controls. Before deploying custom code to production, it is essential to review what's being deployed. Use a database tool like Azure Data Studio that supports source control. Implement tools and logic for code analysis, vulnerability and credential scanning.",
- "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "guid": "ebebd109-9f9d-d85e-1b2f-d302012843b7",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "SQL"
+ "Storage",
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
- "subcategory": "Source Control and Code Review",
- "text": "Use Source Control systems to store, maintain and review application code deployed inside Azure SQLDB Database",
- "waf": "Security"
+ "subcategory": "Storage",
+ "text": "Failure to tolerate policy",
+ "waf": "Operations"
},
{
- "category": "Data Discovery and Classification",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "In case of classification requirements Purview is the preferred option. Only use SQL Data Discovery & Classification in case Purview is not an option. Discover columns that potentially contain sensitive data. What is considered sensitive data heavily depends on the customer, compliance regulation, etc., and needs to be evaluated by the users in charge of that data. Classify the columns to use advanced sensitivity-based auditing and protection scenarios. Review results of automated discovery and finalize the classification if necessary.",
- "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
+ "category": "VMware",
+ "checklist": "Azure VMware Solution Implementation Checklist",
+ "description": "ANF can be used to extend storage for Azure VMware Solution,",
+ "guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863",
+ "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution",
"services": [
- "SQL"
+ "Storage",
+ "AVS"
],
- "severity": "Low",
- "subcategory": "Data Discovery and Classification",
- "text": "Plan and configure Data Discovery & Classification to protect the sensitive data",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Storage",
+ "text": "Use ANF for external storage",
+ "waf": "Operations"
},
{
- "category": "Data Masking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Usage of this feature is recommended only if column encryption is not an option and there is a specific requirement to preserve data types and formats. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.",
- "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
- "services": [
- "SQL"
- ],
- "severity": "Low",
- "subcategory": "Data Masking",
- "text": "Use Data Masking to prevent unauthorized non-admin users data access if no encryption is possible",
- "waf": "Security"
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "category": "Defender",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "SQL Advanced Threat Detection (ATP) provides a layer of security that detects potential vulnerabilities and anomalous activity in databases such as SQL injection attacks and unusual behavior patterns. When a potential threat is detected Threat Detection sends an actionable real-time alert by email and in Microsoft Defender for Cloud, which includes clear investigation and remediation steps for the specific threat.",
- "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
+ "service": "Azure Functions",
+ "services": [],
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
+ },
+ {
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
"services": [
- "SQL",
- "EventHubs",
- "Defender"
+ "AppSvc"
],
"severity": "High",
- "subcategory": "Advanced Threat Protection",
- "text": "Review and complete Advanced Threat Protection (ATP) configuration",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "category": "Defender",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Enable Microsoft Defender for Azure SQL at the subscription level to automatically onboard and protect all existing and future servers and databases. When you enable on the subscription level, all databases in Azure SQL Database and Azure SQL Managed Instance are protected. You can then disable them individually if you choose. If you want to manually manage which databases are protected, disable at the subscription level and enable each database that you want protected.",
- "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
+ "service": "Azure Functions",
"services": [
- "SQL",
- "Subscriptions",
- "Defender"
+ "AppSvc"
],
"severity": "High",
- "subcategory": "Defender for Azure SQL",
- "text": "Enable Microsoft Defender for Azure SQL",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
+ "waf": "Reliability"
},
{
- "category": "Defender",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Microsoft Defender for Azure SQL ATP detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Alerts can be configured and generated and will be reported in the Defender for console.",
- "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
+ "category": "BC and DR",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"services": [
- "SQL",
- "Monitor",
- "Defender"
+ "Storage"
],
- "severity": "High",
- "subcategory": "Defender for Azure SQL",
- "text": "Prepare a security response plan to promptly react to Microsoft Defender for Azure SQL alerts",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
+ "waf": "Reliability"
},
{
- "category": "Defender",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure SQLDB vulnerability assessment is a service that provides visibility into your security state. Vulnerability assessment includes actionable steps to resolve security issues and enhance your database security. It can help you to monitor a dynamic database environment where changes are difficult to track and improve your SQL security posture.",
- "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
+ "category": "Application Deployment",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "CI/CD",
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "waf": "Operations"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"services": [
- "SQL",
- "Monitor",
- "Defender"
+ "AzurePolicy",
+ "APIM"
],
- "severity": "High",
- "subcategory": "Vulnerability Assessment",
- "text": "Configure Vulnerability Assessment (VA) findings and review recommendations",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Development best practices",
+ "text": "Implement an error handling policy at the global level",
+ "waf": "Operations"
},
{
- "category": "Defender",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL Databases. Vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. You can use the findings to remediate software vulnerabilities and disable findings.",
- "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"services": [
- "SQL",
- "Defender"
+ "AzurePolicy",
+ "APIM"
],
- "severity": "High",
- "subcategory": "Vulnerability Assessment",
- "text": "Regularly review of Vulnerability Assessment (VA) findings and recommendations and prepare a plan to fix",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Development best practices",
+ "text": "Ensure all APIs policies include a element.",
+ "waf": "Operations"
},
{
- "category": "Encryption",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Always Encrypted with Secure Enclaves expands confidential computing capabilities of Always Encrypted by enabling in-place encryption and richer confidential queries. Always Encrypted with Secure Enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. Usage of this feature is recommended for the cases where you need to limit administrator access and need your queries to support more than equality matching of encrypted columns.",
- "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
- "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"services": [
- "SQL"
+ "ACR",
+ "APIM",
+ "AzurePolicy"
],
"severity": "Medium",
- "subcategory": "Always Encrypted",
- "text": "If protecting sensitive PII data from admin users is a key requirement, but Column Encryption limitations cannot be tolerated, consider the adoption of Always Encrypted with Secure Enclaves",
- "waf": "Security"
+ "subcategory": "Development best practices",
+ "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
+ "waf": "Operations"
},
{
- "category": "Encryption",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "With Azure SQL Database, you can apply symmetric encryption to a column of data by using Transact-SQL. This approach is called column encryption, because you can use it to encrypt specific columns with different encryption keys. Doing so gives you more granular encryption capability than TDE, which encrypts data in pages. Using Always Encrypted to ensure sensitive data isn't exposed in plaintext in Azure SQL Database or SQL Managed Instance, even in memory/in use. Always Encrypted protects the data from Database Administrators (DBAs) and cloud admins (or bad actors who can impersonate high-privileged but unauthorized users) and gives you more control over who can access your data.",
- "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
"services": [
- "SQL",
- "AKV",
- "Storage"
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Column Encryption",
- "text": "To protect sensitive PII data from non-admin users in specific table columns, consider using Column Encryption",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Monetization",
+ "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
+ "waf": "Operations"
},
{
- "category": "Encryption",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Enabled by default, Transparent data encryption (TDE) helps to protect the database files against information disclosure by performing real-time encryption and decryption of the database, associated backups, and transaction log files 'at rest', without requiring changes to the application.",
- "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage",
- "Backup"
+ "Monitor",
+ "APIM"
],
"severity": "High",
- "subcategory": "Transparent Data Encryption",
- "text": "Ensure Transparent Data Encryption (TDE) is kept enabled",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
+ "waf": "Operations"
},
{
- "category": "Encryption",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "If separation of duties in the management of keys and data within the organization is required, leverage Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) for your Azure SQLDB and use Azure Key Vault to store (refer to its checklist). Leverage this feature when you have strict security requirements which cannot be met by the managed service keys.",
- "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"services": [
- "SQL",
- "AKV"
+ "Monitor",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Transparent Data Encryption",
- "text": "Use customer-managed keys (CMK) in Azure Key Vault (AKV) if you need increased transparency and granular control over the TDE protection",
- "waf": "Security"
+ "subcategory": "Monitoring",
+ "text": "Enable Application Insights for more detailed telemetry",
+ "waf": "Operations"
},
{
- "category": "Encryption",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The minimal Transport Layer Security (TLS) version setting allows customers to choose which version of TLS their SQL database uses. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.",
- "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
+ "category": "Governance",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
+ "services": [
+ "Monitor",
+ "APIM"
+ ],
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Configure alerts on the most critical metrics",
+ "waf": "Operations"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"services": [
- "SQL"
+ "AKV",
+ "Entra",
+ "APIM"
],
"severity": "High",
- "subcategory": "Transport Layer Security",
- "text": "Enforce minimum TLS version to the latest available",
+ "subcategory": "Data protection",
+ "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Use Azure Active Directory (Azure AD) authentication for centralized identity management. Use SQL Authentication only if really necessary and document as exceptions.",
- "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
+ "category": "Identity and Access Management",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"services": [
- "SQL",
- "Entra"
+ "Entra",
+ "APIM"
],
- "severity": "Medium",
- "subcategory": "Azure Active Directory",
- "text": "Leverage Azure AD authentication for connections to Azure SQL Databases",
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Protect incoming requests to APIs (data plane) with Azure AD",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Using Azure AD groups simplifies permission management and both the group owner, and the resource owner can add/remove members to/from the group. Create a separate group for Azure AD administrators for each logical server. Monitor Azure AD group membership changes using Azure AD audit activity reports.",
- "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
+ "category": "Identity and Access Management",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"services": [
- "SQL",
- "Monitor",
- "Entra"
+ "Entra",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Azure Active Directory",
- "text": "Create a separate Azure AD group with two admin accounts for each Azure SQL Database logical server",
+ "subcategory": "Identity",
+ "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Ensure that distinct system and user assigned managed identities, that are dedicated to the function, with least permissions assigned, are used for communication from Azure services and applications to the Azure SQLDB databases.",
- "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
+ "category": "Identity and Access Management",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"services": [
- "SQL",
- "Entra"
+ "Entra",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Azure Active Directory",
- "text": "Minimize the use of password-based authentication for applications",
+ "subcategory": "Privileged access",
+ "text": "Create appropriate groups to control the visibility of the products",
"waf": "Security"
},
{
- "category": "Identity",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "System or User assigned managed identities enable Azure SQLDB to authenticate to other cloud services (e.g. Azure Key Vault) without storing credentials in code. Once enabled, all necessary permissions can be granted via Azure role-based-access-control to the specific Azure SQLDB instance. Do not share user assigned managed identities across multiple services if not strictly required.",
- "guid": "69891194-5074-4e30-8f69-4efc3c580900",
- "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"services": [
- "ACR",
- "RBAC",
- "Entra",
- "SQL",
- "AKV"
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Managed Identities",
- "text": "Assign Azure SQL Database a managed identity for outbound resource access",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Best practices",
+ "text": "Use Backends feature to eliminate redundant API backend configurations",
+ "waf": "Operations"
},
{
- "category": "Identity",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Use an Azure AD integrated authentication that eliminates the use of passwords. Password-based authentication methods are a weaker form of authentication. Credentials can be compromised or mistakenly given away. Use single sign-on authentication using Windows credentials. Federate the on-premises AD domain with Azure AD and use integrated Windows authentication (for domain-joined machines with Azure AD).",
- "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"services": [
- "SQL",
- "Entra"
+ "AzurePolicy",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Passwords",
- "text": "Minimize the use of password-based authentication for users",
- "waf": "Security"
+ "subcategory": "Best practices",
+ "text": "Use Named Values to store common values that can be used in policies",
+ "waf": "Operations"
},
{
- "category": "Ledger",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Confidential Ledger is one of the supported store, it can be used and supports automatic generation and storage of database digests. Azure Ledger provides advanced security features like Blockchain Ledger Proof and Confidential Hardware Enclaves. Use it only if advanced security features are required, otherwise revert to Azure storage.",
- "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
- "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage"
+ "ACR",
+ "APIM",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Database Digest",
- "text": "Use Azure Confidential Ledger to store database digests only if advanced security features are required",
- "waf": "Security"
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
+ "waf": "Reliability"
},
{
- "category": "Ledger",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Blob Storage with Immutable Storage feature can be used and supports automatic generation and storage of database digests. To prevent tampering of your digest files, configure and lock a retention policy for your container.",
- "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
- "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage",
- "AzurePolicy"
+ "ASR",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Database Digest",
- "text": "If Azure storage account is used to store database digests, ensure security is properly configured",
- "waf": "Security"
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
+ "waf": "Reliability"
},
{
- "category": "Ledger",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Ledger provides a form of data integrity called forward integrity, which provides evidence of data tampering on data in your ledger tables. The database verification process takes as input one or more previously generated database digests. It then recomputes the hashes stored in the database ledger based on the current state of the ledger tables. If the computed hashes don't match the input digests, the verification fails. The failure indicates that the data has been tampered with. The verification process reports all inconsistencies that it detects.",
- "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
- "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage"
+ "Backup",
+ "ASR",
+ "APIM"
],
- "severity": "Medium",
- "subcategory": "Integrity",
- "text": "Schedule the Ledger verification process regularly to verify data integrity",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Business continuity and disaster recovery",
+ "text": "Ensure there is an automated backup routine",
+ "waf": "Reliability"
},
{
- "category": "Ledger",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The Ledger feature provides tamper-evidence capabilities in your database. You can cryptographically attest to other parties, such as auditors or other business parties, that your data hasn't been tampered with. Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators.",
- "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
- "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"services": [
- "SQL"
+ "AzurePolicy",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Ledger",
- "text": "If cryptographic proof of data integrity is a critical requirement, Ledger feature should be considered",
- "waf": "Security"
+ "subcategory": "Failover and Caching",
+ "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
+ "waf": "Reliability"
},
{
- "category": "Ledger",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Depending on the type of tampering, there are cases where you can repair the ledger without losing data. In the article contained in the --More Info-- column, different scenarios and recovery techniques are described.",
- "guid": "804fc554-6554-4842-91c1-713b32f99902",
- "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
"services": [
- "SQL"
+ "AzurePolicy",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Recovery",
- "text": "Prepare a response plan to investigate and repair a database after a tampering event",
- "waf": "Security"
+ "subcategory": "Performance and scalability",
+ "text": "Consider using a external cache policy for APIs that can benefit from caching",
+ "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure SQL Database Auditing tracks database events and writes them to an audit log in your Azure storage account. Auditing helps you understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations as well as helps you meet regulatory compliance. By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to configure auditing for different types of actions and action groups using PowerShell.",
- "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage",
+ "EventHubs",
+ "APIM",
"AzurePolicy"
],
- "severity": "Medium",
- "subcategory": "Auditing",
- "text": "Ensure that Azure SQL Database Auditing is enabled at the server level",
- "waf": "Security"
+ "severity": "Low",
+ "subcategory": "Performance and scalability",
+ "text": "If you need to log at high performance levels, consider Event Hubs policy",
+ "waf": "Operations"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure SQL Database Auditing logs can be written to external storage accounts, Log Analytics workspace or Event Hub. Be sure to protect the target repository using backups and secured configuration. Use Azure SQL Database Managed Identity to access the storage and set an explicit retention period. Do not grant permissions to administrators to the audit log repository. Use a different target storage for --Enabling Auditing of Microsoft support operations--. ",
- "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"services": [
- "Storage",
- "EventHubs",
- "Monitor",
- "SQL",
- "Entra",
- "Backup"
+ "AzurePolicy",
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Auditing",
- "text": "Ensure that Azure SQL Database Auditing logs are backed up and secured in the selected repository type",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Performance and scalability",
+ "text": "Apply throttling policies to control the number of requests per second",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "Performance"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The Azure Monitor activity log is a platform log in Azure that provides insight into subscription-level events. The activity log includes information like when a resource is modified. It is recommended to send this activity log to the same external storage repository as the Azure SQL Database Audit Log (storage account, Log Analytics workspace, Event Hub).",
- "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"services": [
- "Storage",
- "EventHubs",
- "Monitor",
- "SQL",
- "Subscriptions"
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Auditing",
- "text": "Ensure that Azure SQL Database Activity Log is collected and integrated with Auditing logs",
- "waf": "Security"
+ "subcategory": "Performance and scalability",
+ "text": "Configure autoscaling to scale out the number of instances when the load increases",
+ "waf": "Performance"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR). Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
- "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"services": [
- "SQL",
- "Monitor"
+ "APIM"
],
"severity": "Medium",
- "subcategory": "SIEM/SOAR",
- "text": "Ensure that Azure SQL Database Auditing logs are being presented in to your organizations SIEM/SOAR",
- "waf": "Security"
+ "subcategory": "Performance and scalability",
+ "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
+ "waf": "Performance"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), which can be used to set up custom threat detections. Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
- "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"services": [
- "SQL",
- "Monitor"
+ "APIM"
],
"severity": "Medium",
- "subcategory": "SIEM/SOAR",
- "text": "Ensure that Azure SQL Database Activity Log data is presented in to your SIEM/SOAR",
- "waf": "Security"
+ "subcategory": "Premium Tier",
+ "text": "Use the premium tier for production workloads.",
+ "waf": "Reliability"
},
{
- "category": "Logging",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Security Operation Center (SOC) team should create an incident response plan (playbooks or manual responses) to investigate and mitigate tampering, malicious activities, and other anomalous behaviors.",
- "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"services": [
- "SQL",
- "EventHubs"
+ "AzurePolicy",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "SIEM/SOAR",
- "text": "Ensure that you have response plans for malicious or aberrant audit logging events",
- "waf": "Security"
+ "subcategory": "Request Routing",
+ "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "When you create a logical server from the Azure portal for Azure SQL Database, the result is a public endpoint that is visible and reachable over the public network (Public Access). You can then limit connectivity based on firewall rules and Service Endpoint. You can also configure private connectivity only limiting connections to internal networks using Private Endpoint (Private Access). Private Access using Private Endpoint should be the default unless a business case or performance/technical reason applies that cannot support it. Usage of Private Endpoints has performance implications that need to be considered and assessed.",
- "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
"services": [
- "SQL",
- "PrivateLink"
+ "Entra",
+ "APIM"
],
"severity": "High",
- "subcategory": "Connectivity",
- "text": "Review Public vs. Private Access connectivity methods and select the appropriate one for the workload",
- "waf": "Security"
+ "subcategory": "Resource Limits",
+ "text": "Be aware of APIM's limits",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "IMPORTANT: Connections to private endpoint only support Proxy as the connection policy. When using private endpoints connections are proxied via the Azure SQL Database gateway to the database nodes. Clients will not have a direct connection.",
- "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
+ "category": "Management",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"services": [
- "SQL",
- "PrivateLink",
- "AzurePolicy"
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Connectivity",
- "text": "Keep default Azure SQL Database Connection Policy if not differently required and justified",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "Self-Hosted",
+ "text": "Ensure that the self-hosted gateway deployments are resilient.",
+ "waf": "Reliability"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. If you select this option, make sure that your login and user permissions limit access to authorized users only. If not strictly required, keep this setting to OFF.",
- "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure API Management Review",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
"services": [
- "SQL",
- "Subscriptions"
+ "FrontDoor",
+ "Entra",
+ "APIM"
],
- "severity": "High",
+ "severity": "Medium",
"subcategory": "Connectivity",
- "text": "Ensure Allow Azure Services and Resources to Access this Server setting is disabled in Azure SQL Database firewall",
- "waf": "Security"
+ "text": "Use Azure Front Door in front of APIM for multi-region deployment",
+ "waf": "Performance"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure SQL Database has a new built-in feature that allows native integration with external REST endpoints. This means that integration of Azure SQL Database with Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management and in general any REST or even GraphQL endpoint. If not properly restricted, code inside an Azure SQL Database database could leverage this mechanism to exfiltrate data. If not strictly required, it is recommended to block or restrict this feature using Outbound Firewall Rules.",
- "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
- "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure API Management Review",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
"services": [
- "SQL",
"APIM",
- "EventHubs"
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Outbound Control",
- "text": "Block or restrict outbound REST API calls to external endpoints",
+ "subcategory": "Security",
+ "text": "Deploy the service within a Virtual Network (VNet)",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Outbound firewall rules limit network traffic from the Azure SQL Database logical server to a customer defined list of Azure Storage accounts and Azure SQL Database logical servers. Any attempt to access storage accounts or databases not in this list is denied.",
- "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure API Management Review",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage"
+ "Entra",
+ "Monitor",
+ "APIM",
+ "VNet"
],
"severity": "Medium",
- "subcategory": "Outbound Control",
- "text": "If outbound network access is required, it is recommended to configure outbound networking restrictions using built-in Azure SQL Database control feature",
+ "subcategory": "Security",
+ "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Private Endpoint is created inside a subnet in an Azure Virtual Network. Proper security configuration must be applied also to the containing network environment, including NSG/ASG, UDR, firewall, monitoring and auditing.",
- "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure API Management Review",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"services": [
- "Firewall",
"PrivateLink",
- "Monitor",
- "SQL",
+ "Entra",
+ "APIM",
"VNet"
],
"severity": "Medium",
- "subcategory": "Private Access",
- "text": "If Private Access connectivity is used, ensure that you are using the Private Endpoint, Azure Virtual Network, Azure Firewall, and Azure Network Security Group checklists",
+ "subcategory": "Security",
+ "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "When adding a Private Endpoint connection, public routing to your logical server isn't blocked by default. In the --Firewall and virtual networks-- pane, the setting --Deny public network access-- is not selected by default. To disable public network access, ensure that you select --Deny public network access--.",
- "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure API Management Review",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"services": [
- "SQL",
- "PrivateLink",
- "VNet"
+ "APIM"
],
"severity": "High",
- "subcategory": "Private Access",
- "text": "If Private Endpoint (Private Access) is used, consider disabling Public Access connectivity",
+ "subcategory": "Security",
+ "text": "Disable Public Network Access",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Network Security Group (NSG) and Application Security Group (ASG) can be now applied to subnet containing Private Endpoints to restrict connections to Azure SQLDB based on internal source IP ranges.",
- "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
+ "category": "Platform automation and DevOps",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
+ "services": [
+ "APIM"
+ ],
+ "severity": "Medium",
+ "subcategory": "Automation",
+ "text": "Simplify management with PowerShell automation scripts",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform automation and DevOps",
+ "checklist": "Azure API Management Review",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
+ "services": [
+ "Entra",
+ "APIM"
+ ],
+ "severity": "Medium",
+ "subcategory": "Best practices",
+ "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform automation and DevOps",
+ "checklist": "Azure API Management Review",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
"services": [
- "SQL",
- "PrivateLink",
- "VNet"
+ "Entra",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Private Access",
- "text": "If Private Endpoint (Private Access) is used, apply NSG and eventually ASG to limit incoming source IP address ranges",
- "waf": "Security"
+ "subcategory": "Best practices",
+ "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. Applications and tools that are in the same or peered virtual network in the same region could access it directly. Applications and tools that are in different region could use virtual-network-to-virtual-network connection or ExpressRoute circuit peering to establish connection. Customer should use Network Security Groups (NSG), and eventually internal firewalls, to restrict access over port 1433 only to resources that require access to a managed instance.",
- "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
+ "category": "Platform automation and DevOps",
+ "checklist": "Azure API Management Review",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
"services": [
- "SQL",
- "ExpressRoute",
- "VNet"
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Private Access",
- "text": "Apply Network Security Groups (NSG) and firewall rules to restrict access to Azure SQL Managed Instance internal subnet",
- "waf": "Security"
+ "subcategory": "DevOps",
+ "text": "Implement DevOps and CI/CD in your workflow",
+ "waf": "Operations"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Azure Virtual Network Service Endpoint is preferred solution if you want to establish a direct connection to the Azure SQL Database backend nodes using Redirect policy. This will allow access in high performance mode and is the recommended approach from a performance perspective.",
- "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
"services": [
- "SQL",
- "AzurePolicy",
- "VNet"
+ "APIM"
],
- "severity": "High",
- "subcategory": "Public Access",
- "text": "If Public Access connectivity is used, leverage Service Endpoint to restrict access from selected Azure Virtual Networks",
+ "severity": "Medium",
+ "subcategory": "APIs",
+ "text": "Secure APIs using client certificate authentication",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The Azure SQL Database firewall allows you to specify IP address ranges from which communications are accepted. This approach is fine for stable IP addresses that are outside the Azure private network.",
- "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage"
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Public Access",
- "text": "If Public Access connectivity is used, ensure that only specific known IPs are added to the firewall",
+ "subcategory": "APIs",
+ "text": "Secure backend services using client certificate authentication",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "We recommend that you use database-level IP firewall rules whenever possible. This practice enhances security and makes your database more portable. Use server-level IP firewall rules for administrators. Also use them when you have many databases that have the same access requirements, and you don't want to configure each database individually.",
- "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
"services": [
- "SQL",
- "Storage"
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Public Access",
- "text": "If Public Access connectivity is used and controlled by Azure SQL Database firewall rules, use database-level over server-level IP rules",
+ "severity": "Medium",
+ "subcategory": "APIs",
+ "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. The Managed Instance public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. If company policy disallows the use of public endpoints, use Azure Policy to prevent enabling public endpoints in the first place.",
- "guid": "b8435656-143e-41a8-9922-61d34edb751a",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"services": [
- "SQL",
- "AzurePolicy",
- "VNet"
+ "APIM"
],
- "severity": "High",
- "subcategory": "Public Access",
- "text": "Do not enable Azure SQL Managed Instance public endpoint",
+ "severity": "Medium",
+ "subcategory": "APIs",
+ "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
"waf": "Security"
},
{
- "category": "Networking",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "A Managed Instance (SQL MI) public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. In this case, it is recommended to apply a Network Security Groups (NSG) to restrict access to port 3342 only to trusted source IP addresses.",
- "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
- "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
"services": [
- "SQL",
- "VNet"
+ "APIM"
],
"severity": "High",
- "subcategory": "Public Access",
- "text": "Restrict access if Azure SQL Managed Instance public endpoint is required",
+ "subcategory": "Ciphers",
+ "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
"waf": "Security"
},
{
- "category": "Privileged Access",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Most operations, support, and troubleshooting performed by Microsoft personnel and sub-processors do not require access to customer data. In those rare circumstances where such access is required, Customer Lockbox for Microsoft Azure provides an interface for customers to review and approve or reject customer data access requests. In support scenarios where Microsoft needs to access customer data, Azure SQL Database supports Customer Lockbox to provide an interface for you to review and approve or reject customer data access requests.",
- "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"services": [
- "SQL"
+ "AKV",
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Lockbox",
- "text": "Review and enable Customer Lockbox for Azure SQL Database access by Microsoft personnel",
+ "severity": "High",
+ "subcategory": "Data protection",
+ "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
"waf": "Security"
},
{
- "category": "Privileged Access",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "The principle of least privilege states that users shouldn't have more privileges than needed to complete their tasks. High-privileged database and server users can perform many configuration and maintenance activities on the database and can also drop databases in Azure SQL instance. Tracking database owners and privileged accounts is important to avoid having excessive permission.",
- "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
- "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
"services": [
- "SQL"
+ "Entra",
+ "APIM"
],
"severity": "Medium",
- "subcategory": "Permissions",
- "text": "Ensure that users are assigned the minimum level of access necessarily to complete their job functions",
+ "subcategory": "Identities",
+ "text": "Use managed identities to authenticate to other Azure resources whenever possible",
"waf": "Security"
},
{
- "category": "Privileged Access",
- "checklist": "Azure SQLDB Security Checklist (Preview)",
- "description": "Identities (both Users and SPNs) should be scoped to the least amount of access needed to perform the function. A higher number of tightly scoped SPNs should be used, instead of having one SPN with multiple sets of unrelated permissions. For example, if there are three external web applications hosted on-prem that make queries to the Azure SQL Database, they should not all use the same SPN for these activities. Instead, they should each have their own tightly scoped SPN.",
- "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
+ "category": "Security",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"services": [
- "SQL",
- "Entra"
+ "AppGW",
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "Low",
- "subcategory": "Permissions",
- "text": "Ensure that distinct applications will be assigned different credentials with minimal permissions to access Azure SQL Database",
+ "severity": "High",
+ "subcategory": "Network",
+ "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
"waf": "Security"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
+ "service": "CosmosDB",
"services": [
- "AKV",
- "FrontDoor"
+ "CosmosDB"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
- "waf": "Operations"
+ "subcategory": "Best Practices",
+ "text": "FTA Resiliency Playbook",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
+ "CosmosDB"
],
- "severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "High",
+ "subcategory": "High Availability",
+ "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
+ "service": "CosmosDB",
"services": [
- "WAF",
- "AppGW",
- "AzurePolicy",
- "FrontDoor"
+ "CosmosDB"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Run multiple replicas of the database (>1 ) in Prod",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
+ "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
+ "service": "CosmosDB",
"services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
+ "CosmosDB",
+ "ACR"
],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Leverage Multi-Region Writes",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Span Cosmos account across two or more regions with multi-region writes",
+ "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
- "TrafficManager",
- "FrontDoor",
- "EventHubs"
+ "CosmosDB",
+ "ACR"
],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "Avoid placing Traffic Manager behind Front Door.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Distribute your data globally",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
+ "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
+ "service": "CosmosDB",
"services": [
- "FrontDoor"
+ "CosmosDB"
],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Choose from several well-defined consistency models",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
+ "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+ "service": "CosmosDB",
"services": [
- "FrontDoor"
+ "CosmosDB"
],
- "severity": "Low",
- "subcategory": "Front Door",
- "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "High Availability",
+ "text": "Enable Service managed failover",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
+ "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
+ "service": "CosmosDB",
"services": [
- "FrontDoor"
+ "CosmosDB",
+ "Storage",
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
+ "subcategory": "Backup Strategy",
+ "text": "Enable Automatic Backups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
+ "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "FrontDoor"
+ "CosmosDB",
+ "Backup"
],
- "severity": "Low",
- "subcategory": "Front Door",
- "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
- "waf": "Performance"
+ "severity": "Medium",
+ "subcategory": "Backup Strategy",
+ "text": "Perform Periodic Backups",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
+ "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "Cost",
- "AKV",
- "FrontDoor"
+ "CosmosDB",
+ "Backup"
],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
- "waf": "Operations"
+ "severity": "Medium",
+ "subcategory": "Backup Strategy",
+ "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
+ "service": "PostgreSQL",
"services": [
- "WAF",
- "FrontDoor"
+ "SQL"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "subcategory": "Best Practices",
+ "text": "Leverage Flexible Server",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
+ "service": "PostgreSQL",
"services": [
- "FrontDoor"
+ "SQL"
],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Leverage Availability Zones where regionally applicable",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "31b67c67-be59-4519-8083-845d587cb391",
+ "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
+ "service": "PostgreSQL",
"services": [
- "FrontDoor"
+ "SQL"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Leverage cross-region read replicas for BCDR",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
- "services": [
- "WAF",
- "FrontDoor"
- ],
+ "category": "BC and DR",
+ "checklist": "Device Update Review",
+ "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "services": [],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
- "services": [
- "WAF",
- "FrontDoor"
- ],
+ "category": "BC and DR",
+ "checklist": "Device Update Review",
+ "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "services": [],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
- "services": [
- "WAF",
- "FrontDoor",
- "AzurePolicy"
- ],
+ "category": "BC and DR",
+ "checklist": "Device Update Review",
+ "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Device Update for IoT Hub",
+ "services": [],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
+ "category": "BC and DR",
+ "checklist": "Device Update Review",
+ "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Device Update for IoT Hub",
"services": [
- "WAF",
- "FrontDoor"
+ "AppSvc"
],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
- "waf": "Security"
+ "subcategory": "High Availability",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
- "services": [
- "WAF",
- "FrontDoor"
- ],
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "65285269-440c-44be-9d3e-0844276d4bdc",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foudations-playbooks-ADB_v1.docx",
+ "services": [],
"severity": "High",
- "subcategory": "Front Door",
- "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
- "waf": "Security"
+ "subcategory": "Best Practices",
+ "text": "Reference Databricks HA/DR playbook",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "89d558b9-37d3-4974-b111-2dbd7aaf12e6",
+ "link": "https://learn.microsoft.com/azure/databricks/security/secrets/secret-scopes",
"services": [
- "WAF",
- "FrontDoor"
+ "Backup"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
- "waf": "Security"
+ "subcategory": "Backup",
+ "text": "Backup Your Workspace Configuration including ARM templates and Secret Scopes",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757",
"services": [
- "WAF",
- "FrontDoor"
+ "Backup",
+ "ACR"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "subcategory": "Backup",
+ "text": "Share MetaData Across different Databricks Workspaces using Hive External Metastore",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "769e3969-0e78-428a-a936-657d03b0f466",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/disaster-recovery-strategy-in-azure-databricks-using-the-hive/ba-p/3684581",
"services": [
- "WAF",
- "FrontDoor"
+ "Backup",
+ "ASR"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
- "waf": "Security"
+ "subcategory": "Backup",
+ "text": "Plan Disaster Recovery Strategy in Databricks using the Hive External Metastore",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "4b1d944a-3598-437e-b79d-6c6d3a364a5b",
+ "link": "https://www.databricks.com/blog/2021/04/20/attack-of-the-delta-clones-against-disaster-recovery-availability-complexity.html",
"services": [
- "FrontDoor"
+ "Backup"
],
- "severity": "Low",
- "subcategory": "Front Door",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Backup",
+ "text": "Backup your data with deep and shallow clones",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "description": "Download the blob using Secondary Endpoint in RAGRS Storage Account",
+ "guid": "7abae48a-bd54-4cd7-ae2e-86768357c559",
+ "link": "https://techcommunity.microsoft.com/t5/azure-paas-blog/download-the-blob-using-secondary-endpoint-in-ragrs-storage/ba-p/2403750",
"services": [
- "WAF",
- "FrontDoor"
+ "Backup",
+ "Storage"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
- "waf": "Security"
+ "subcategory": "Backup",
+ "text": "Backup your data to Azure Storage RA-GRS",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "675c5ee8-5b85-49c7-944c-e3b1a28b875a",
+ "link": "https://learn.microsoft.com/azure/databricks/dev-tools/index-ci-cd",
"services": [
- "WAF",
- "Monitor",
- "FrontDoor"
+ "Backup"
],
- "severity": "Medium",
- "subcategory": "Front Door",
- "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Backup",
+ "text": "Backup your code with DevOps",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "a1bf1038-9f03-4a4d-8ce4-63dbbbc8682a",
+ "link": "https://learn.microsoft.com/azure/databricks/administration-guide/disaster-recovery",
"services": [
- "WAF",
- "Sentinel",
- "FrontDoor"
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "Front Door",
- "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "severity": "High",
+ "subcategory": "Disaster Recovery",
+ "text": "Plan for Disaster recovery using Active/Active or Active/Passive Configuration",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "description": "Migration package to log all Databricks resources for backup and/or migrating to another Databricks workspace",
+ "guid": "5abc92a4-eda1-4dae-8cc8-5c47c6b781cc",
+ "link": "https://github.com/databrickslabs/migrate",
"services": [
- "FrontDoor",
"Backup"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
+ "subcategory": "Migration",
+ "text": "Use Databricks Migration tools",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
- "services": [
- "FrontDoor"
- ],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
+ "category": "Operations Management",
+ "checklist": "DataBricks Review Checklist",
+ "guid": "a0e6c465-89d5-458b-a37d-3974d1112dbd",
+ "link": "https://github.com/databrickslabs/databricks-sync",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Migration",
+ "text": "Use Databricks Sync",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
- "services": [
- "FrontDoor"
- ],
- "severity": "Medium",
- "subcategory": "Front Door",
- "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "cb7da8cf-aa62-4a15-a495-6da97dc3a242",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-plan-capacity-vmware",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Replication",
+ "text": "Capacity planning is required to make sure you have sufficient bandwidth for replication and an estimated number of CPU cores & disk types that will be needed in Azure for failover",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "67b23587-05a1-4652-aded-fa8a488cdec4",
+ "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-policy",
"services": [
- "FrontDoor"
+ "VM",
+ "AzurePolicy",
+ "ASR"
],
- "severity": "Medium",
- "subcategory": "Front Door",
- "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
+ "severity": "High",
+ "subcategory": "Replication",
+ "text": "Use Azure Policy to ensure that all critical Azure VMs are protected with ASR",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "862bc3bc-14be-4b7f-96e8-d9b3bec228e7",
+ "link": "https://learn.microsoft.com/azure/site-recovery/recovery-plan-overview",
"services": [
- "FrontDoor"
+ "VM"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
- "waf": "Security"
+ "subcategory": "Replication",
+ "text": "Define recovery plans to automate the failover sequence for VMs. You can also include automation scripts to reduce manual steps and improve recovery time",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
- "services": [
- "FrontDoor"
- ],
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "437b1736-db55-4f67-a613-334bd09dc234",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-how-to-manage?tabs=recovery-services-vault",
+ "services": [],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use caching for endpoints that support it.",
- "waf": "Cost"
+ "subcategory": "Data Protection",
+ "text": "Enable and LOCK immutability for vaults. This ensures recovery points cannot be deleted before their intended expiry",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "services": [
- "FrontDoor"
- ],
- "severity": "Low",
- "subcategory": "Front Door",
- "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
- "waf": "Cost"
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "19db6128-1265-404b-a47a-493a08042729",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Protection",
+ "text": "Enable 'Always-on soft delete' for vaults protecting critical workloads",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Recovery Services Vault Checklist",
+ "guid": "4798b158-8b31-4aa5-9ceb-54445135a227",
+ "link": "https://learn.microsoft.com/azure/backup/backup-create-recovery-services-vault#set-storage-redundancy",
"services": [
- "Storage",
- "FrontDoor"
+ "Storage"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
- "waf": "Operations"
+ "subcategory": "Redudancy",
+ "text": "When creating Recovery Service Vaults choose the best storage redundancy option for your requirements. Vaults support local, geo and zone redundancy but this setting cannot be changed once the vault is protecting one or more resources",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"services": [
- "AKV",
- "FrontDoor"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use wildcard TLS certificates when possible.",
- "waf": "Operations"
+ "subcategory": "Entra ID",
+ "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"services": [
- "FrontDoor"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
- "waf": "Performance"
+ "subcategory": "AAD B2C",
+ "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"services": [
- "Storage",
- "FrontDoor"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Use file compression when you're accessing downloadable content.",
+ "subcategory": "AAD B2C",
+ "text": "Custom brand assets should be hosted on a CDN",
"waf": "Performance"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
"services": [
- "FrontDoor"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
- "waf": "Operations"
+ "severity": "Low",
+ "subcategory": "AAD B2C",
+ "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "TrafficManager",
- "Storage",
- "FrontDoor"
+ "Entra",
+ "VM"
],
"severity": "Medium",
- "subcategory": "Front Door",
- "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
+ "subcategory": "Windows Server AD",
+ "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
"waf": "Reliability"
},
{
- "category": "Network Topology and Connectivity",
- "checklist": "Azure Application Delivery Networking",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
+ "category": "Operations Management",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "AppSvc",
- "FrontDoor"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Front Door",
- "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
- "waf": "Security"
+ "severity": "Medium",
+ "subcategory": "Windows Server AD",
+ "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "waf": "Reliability"
},
{
"category": "Operations Management",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "SQL"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage Flexible Server",
+ "subcategory": "Windows Server AD",
+ "text": "Have active-active for multi-regions",
"waf": "Reliability"
},
{
"category": "Operations Management",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
- "SQL"
+ "Entra"
],
- "severity": "High",
- "subcategory": "Best Practices",
- "text": "Leverage Availability Zones where regionally applicable",
+ "severity": "Medium",
+ "subcategory": "Entra Domain Services",
+ "text": "Add Azure AD Domain service stamps to additional regions and locations",
"waf": "Reliability"
},
{
"category": "Operations Management",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
- "SQL"
+ "Entra"
],
"severity": "Medium",
- "subcategory": "Best Practices",
- "text": "Leverage Data-in replication for cross-region DR scenarios",
+ "subcategory": "Entra Domain Services",
+ "text": "Use Replica Sets for DR",
"waf": "Reliability"
}
],
"metadata": {
"name": "Master checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.en.json b/checklists/waf_checklist.en.json
index b8f933d83..f080234c3 100644
--- a/checklists/waf_checklist.en.json
+++ b/checklists/waf_checklist.en.json
@@ -1,7158 +1,7532 @@
{
"items": [
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
- "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
- "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
- "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
+ "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
+ "service": "Container Apps",
"severity": "High",
- "text": "Disable Azure Container Registry image export",
- "waf": "Security"
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
- "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
+ "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
+ "service": "Container Apps",
"severity": "High",
- "text": "Enable Azure Policies for Azure Container Registry",
- "waf": "Security"
+ "text": "Use more than one replica and enable Zone Redundancy.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
- "guid": "d345293c-7639-4637-a551-c5c04e401955",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"severity": "High",
- "text": "Sign and Verify containers with notation (Notary v2)",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
- "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
- "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
- "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
- "service": "ACR",
- "severity": "Medium",
- "text": "Encrypt registry with a customer managed key",
- "waf": "Security"
+ "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
- "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "arm-service": "Microsoft.App/containerApps",
+ "checklist": "Container Apps Review",
+ "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"severity": "High",
- "text": "Use Managed Identities to connect instead of Service Principals",
- "waf": "Security"
+ "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
- "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
- "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
- "severity": "High",
- "text": "Disable local authentication for management plane access",
- "waf": "Security"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
+ "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Leverage FTA Resillency Handbook",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
- "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
- "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "High",
- "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
- "waf": "Security"
+ "text": "Plan for Data Center level outage",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable anonymous pull/push access",
- "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
- "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
- "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
+ "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Anonymous pull access",
- "waf": "Security"
+ "text": "Practice Failover for BCDR",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
- "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "High",
- "text": "Disable repository-scoped access tokens",
- "waf": "Security"
+ "text": "Plan a backup strategy and take regular backups",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
- "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
- "service": "ACR",
- "severity": "High",
- "text": "Deploy images from a trusted environment",
- "waf": "Security"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
+ "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
- "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
+ "link": "https://learn.microsoft.com/purview/deployment-best-practices",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Azure ARM audience tokens for authentication",
- "waf": "Security"
+ "text": "Follow Purview accounts architectures and deployment best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
- "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
- "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
+ "service": "Purview",
"severity": "Medium",
- "text": "Enable diagnostics logging",
- "waf": "Security"
+ "text": "Follow Collection Architectures and best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
- "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
+ "service": "Purview",
"severity": "Medium",
- "text": "Control inbound network access with Private Link",
- "waf": "Security"
+ "text": "Follow Assest lifecycle best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Disable public network access if inbound network access is secured using Private Link",
- "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
+ "service": "Purview",
"severity": "Medium",
- "text": "Disable Public Network access",
- "waf": "Security"
+ "text": "Follow automation best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Only the ACR Premium SKU supports Private Link access",
- "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
- "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
- "service": "ACR",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"severity": "Medium",
- "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
- "waf": "Security"
+ "text": "Follow Backup and Migration Best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
- "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
- "service": "ACR",
- "severity": "Low",
- "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
- "waf": "Security"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Follow Purview Glossary Best Practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
- "service": "ACR",
- "severity": "Medium",
- "text": "Deploy validated container images",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure Container Registry Security Review",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
- "service": "ACR",
- "severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
- "waf": "Security"
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
+ "link": "https://learn.microsoft.com/purview/concept-workflow",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Workflows ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
+ "service": "Purview",
"severity": "Medium",
- "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
+ "text": "Follow Purview Security Best Practices",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "High",
- "text": "Use zone redundant pipelines in regions that support Availability Zones",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Follow Purview Data Lineage Best Practices",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
+ "service": "Purview",
"severity": "Medium",
- "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
+ "text": "Follow Best Practices for Scanning Registered Sources",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
+ "service": "Purview",
"severity": "Medium",
- "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
+ "text": "Follow Classification Best Practices in Governance Portal",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
+ "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
+ "service": "Purview",
"severity": "Medium",
- "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
+ "text": "Perform Sensitivity Labelling in the Purview Data Map",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
+ "link": "https://learn.microsoft.com/purview/concept-data-share",
+ "service": "Purview",
"severity": "Low",
- "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
+ "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
- "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
- "service": "Azure Data Explorer",
- "text": "Leverage External Tables and Continuous data export overview to reduce costs",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Data Estate Insights",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
- "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
- "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
- "service": "Azure Data Explorer",
- "text": "To share data, explore Leader-follower cluster configuration",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
+ "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Data stewardship and Catalog adoption",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
- "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
- "service": "Azure Data Explorer",
- "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Use Inventory and Ownership",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
- "service": "Azure Data Explorer",
- "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
+ "link": "https://learn.microsoft.com/purview/glossary-insights",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
- "service": "Azure Data Explorer",
- "text": "Ingest data into each cluster in parallel",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
+ "link": "https://learn.microsoft.com/purview/compliance-manager",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Generate assessment scores",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
- "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
- "service": "Azure Data Explorer",
- "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
+ "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
+ "service": "Purview",
+ "severity": "Medium",
+ "text": "Profiling- get summaries of data content",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
- "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
- "service": "Azure Data Explorer",
- "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
+ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow Microsoft Purview Data Owner access policies",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
- "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
- "service": "Azure Data Explorer",
- "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
+ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow Self-service access policies",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
- "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
- "service": "Azure Data Explorer",
- "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "arm-service": "Microsoft.Purview/accounts",
+ "checklist": "Microsoft Purview Review Checklist",
+ "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
+ "link": "https://learn.microsoft.com/purview/concept-policies-devops",
+ "service": "Purview",
+ "severity": "Low",
+ "text": "Follow DevOps policies",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
- "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
- "text": "Wrap DevOps and source control around all your code",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
+ "checklist": "Resiliency Review",
+ "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
+ "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
+ "service": "VMSS",
+ "severity": "Low",
+ "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
- "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
+ "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
+ "service": "VM",
+ "severity": "High",
+ "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
- "checklist": "Azure Data Explorer Review Checklist",
- "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
- "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
+ "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "VM",
+ "severity": "High",
+ "text": "Use Premium or Ultra disks for production VMs",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
- "severity": "Medium",
- "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
+ "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
+ "service": "VM",
+ "severity": "High",
+ "text": "Ensure Managed Disks are used for all VMs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
+ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
+ "service": "VM",
"severity": "Medium",
- "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
+ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "VM",
"severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "text": "Leverage Availability Zones for your VMs in regions where they are supported",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
- "severity": "High",
- "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
- "waf": "Security"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
+ "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
+ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "VM",
"severity": "High",
- "text": "Avoid placing Traffic Manager behind Front Door.",
- "waf": "Security"
+ "text": "Avoid running a production workload on a single VM",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
+ "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"severity": "High",
- "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
- "waf": "Security"
+ "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
+ "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
+ "service": "VM",
"severity": "Low",
- "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
- "waf": "Performance"
+ "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
+ "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
+ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
+ "service": "VM",
"severity": "Medium",
- "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
+ "text": "Increase quotas in DR region before testing failover with ASR",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
+ "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
+ "service": "VM",
"severity": "Low",
- "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
- "waf": "Performance"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
- "severity": "High",
- "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
- "waf": "Operations"
+ "text": "Utilize Scheduled Events to prepare for VM maintenance",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
+ "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
- "severity": "High",
- "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
+ "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Low",
+ "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Low",
+ "text": "Enable soft delete for Storage Account Containers",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=~'Enabled') and (mode=~'Prevention')), enabledState, mode",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
- "severity": "High",
- "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Resiliency Review",
+ "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "Low",
+ "text": "Enable soft delete for blobs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
- "severity": "High",
- "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
- "waf": "Security"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
+ "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "service": "Azure Backup",
+ "severity": "Medium",
+ "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
- "severity": "High",
- "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
- "waf": "Security"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
+ "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
+ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
+ "service": "Azure Backup",
+ "severity": "Low",
+ "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
- "severity": "High",
- "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
- "waf": "Security"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Resiliency Review",
+ "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
+ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
+ "service": "Azure Backup",
+ "severity": "Low",
+ "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
- "severity": "High",
- "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
- "waf": "Security"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Resiliency Review",
+ "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
+ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
+ "service": "DNS",
+ "severity": "Low",
+ "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "arm-service": "Microsoft.PowerBI/gateways",
+ "checklist": "Resiliency Review",
+ "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
+ "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
+ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
+ "service": "Data Gateways",
"severity": "Medium",
- "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
- "waf": "Security"
+ "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Resiliency Review",
+ "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
+ "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "severity": "High",
+ "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
+ "text": "Consider the 'Azure security baseline for storage'",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
- "severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Consider using private endpoints for Azure Storage",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "text": "Enable 'soft delete' for blobs",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
- "waf": "Reliability"
+ "text": "Disable 'soft delete' for blobs",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "High",
- "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
- "waf": "Reliability"
+ "text": "Enable 'soft delete' for containers",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
- "waf": "Reliability"
+ "text": "Disable 'soft delete' for containers",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Enable resource locks on storage accounts",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Consider immutable blobs",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Use caching for endpoints that support it.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "Low",
- "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
- "waf": "Operations"
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Use wildcard TLS certificates when possible.",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
- "waf": "Performance"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Use Microsoft Entra ID tokens for blob access",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Use file compression when you're accessing downloadable content.",
- "waf": "Performance"
+ "text": "Least privilege in IaM permissions",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
"severity": "High",
- "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
- "waf": "Operations"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
- "waf": "Reliability"
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"severity": "High",
- "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "Low",
- "text": "If required for AKS Windows workloads HostProcess containers can be used",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
- "severity": "Low",
- "text": "Use KEDA if running event-driven workloads",
- "waf": "Performance"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Dapr to ease microservice development",
- "waf": "Operations"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "Consider configuring an SAS expiration policy",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
- "severity": "High",
- "text": "Use the SLA-backed AKS offering",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "Consider linking SAS to a stored access policy",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Disruption Budgets in your pod and deployment definitions",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "High",
- "text": "If using a private registry, configure region replication to store images in multiple regions",
- "waf": "Reliability"
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "Low",
- "text": "Use an external application such as kubecost to allocate costs to different users",
- "waf": "Cost"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Strive for short validity periods for ad-hoc SAS",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
- "severity": "Low",
- "text": "Use scale down mode to delete/deallocate nodes",
- "waf": "Cost"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "Apply a narrow scope to a SAS",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "When required use multi-instance partitioning GPU on AKS Clusters",
- "waf": "Cost"
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"severity": "Low",
- "text": "If running a Dev/Test cluster use NodePool Start/Stop",
- "waf": "Cost"
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Separate applications from the control plane with user/system node pools",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "Low",
- "text": "Add taint to your system nodepool to make it dedicated",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Avoid overly broad CORS policies",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Use a private registry for your images, such as ACR",
+ "text": "Determine which/if platform encryption should be used.",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Scan your images for vulnerabilities",
+ "text": "Determine which/if client-side encryption should be used.",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"severity": "High",
- "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
- "severity": "Medium",
- "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Leverage a storagev2 account type for better performance and reliability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"severity": "High",
- "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
- "waf": "Security"
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "If required add Key Management Service etcd encryption",
- "waf": "Security"
+ "text": "For write operation after failover, use customer-Managed Failover ",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
- "severity": "Low",
- "text": "If required consider using Confidential Compute for AKS",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "Medium",
+ "text": "Understand Microsoft-Managed Failover details",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"severity": "Medium",
- "text": "Consider using Defender for Containers",
- "waf": "Security"
+ "text": "Enable Soft Delete",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
- "severity": "High",
- "text": "Use managed identities instead of Service Principals",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"severity": "Medium",
- "text": "Integrate authentication with AAD (using the managed integration)",
- "waf": "Security"
+ "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"severity": "Medium",
- "text": "Limit access to admin kubeconfig (get-credentials --admin)",
- "waf": "Security"
+ "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"severity": "Medium",
- "text": "Integrate authorization with AAD RBAC",
- "waf": "Security"
+ "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
- "severity": "High",
- "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
- "severity": "Medium",
- "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
- "severity": "Medium",
- "text": "For AKS non-interactive logins use kubelogin (preview)",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
+ "severity": "High",
+ "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "Medium",
- "text": "Disable AKS local accounts",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Configure if required Just-in-time cluster access",
- "waf": "Security"
+ "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Configure if required AAD conditional access for AKS",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"severity": "Low",
- "text": "If required for Windows AKS workloads configure gMSA ",
- "waf": "Security"
+ "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"severity": "Medium",
- "text": "For finer control consider using a managed Kubelet Identity",
- "waf": "Security"
+ "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
- "severity": "Medium",
- "text": "If using AGIC, do not share an AppGW across clusters",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "High",
- "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
+ "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
- "severity": "Medium",
- "text": "For Windows workloads use Accelerated Networking",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
+ "severity": "High",
+ "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
"severity": "High",
- "text": "Use the standard ALB (as opposed to the basic one)",
+ "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
- "severity": "Medium",
- "text": "If using Azure CNI, consider using different Subnets for NodePools",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
+ "severity": "High",
+ "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "High",
- "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"severity": "High",
- "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
- "waf": "Performance"
+ "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
"severity": "High",
- "text": "If using Azure CNI, check the maximum pods/node (default 30)",
- "waf": "Performance"
+ "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
- "severity": "Low",
- "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
"severity": "High",
- "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
+ "text": "Make sure the Floating IP is enabled on the Load balancer",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "Low",
- "text": "If required add your own CNI plugin",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
- "severity": "Low",
- "text": "If required configure Public IP per node in AKS",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "High",
+ "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
+ "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "severity": "Low",
- "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "High",
+ "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "High",
- "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
- "waf": "Security"
+ "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using a public API endpoint, restrict the IP addresses that can access it",
- "waf": "Security"
+ "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
- "severity": "High",
- "text": "Use private clusters if your requirements mandate it",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
"severity": "Medium",
- "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
- "waf": "Security"
+ "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "High",
- "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
- "waf": "Security"
+ "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"severity": "High",
- "text": "Use Kubernetes network policies to increase intra-cluster security",
- "waf": "Security"
+ "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
"severity": "High",
- "text": "Use a WAF for web workloads (UIs or APIs)",
- "waf": "Security"
+ "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use DDoS Standard in the AKS Virtual Network",
- "waf": "Security"
+ "text": "Automate SAP System Start-Stop to manage costs.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "Low",
- "text": "If required add company HTTP Proxy",
- "waf": "Security"
+ "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
- "severity": "Medium",
- "text": "Consider using a service mesh for advanced microservice communication management",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"severity": "High",
- "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
- "waf": "Operations"
+ "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "Low",
- "text": "Check regularly Azure Advisor for recommendations on your cluster",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
- "severity": "Low",
- "text": "Enable AKS auto-certificate rotation",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
- "severity": "High",
- "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
- "severity": "High",
- "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
- "severity": "High",
- "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider using AKS command invoke on private clusters",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "Low",
- "text": "For planned events consider using Node Auto Drain",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
- "severity": "High",
- "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP HANA",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "Low",
- "text": "Use custom Node RG (aka 'Infra RG') name",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"severity": "Medium",
- "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
- "waf": "Operations"
+ "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
- "severity": "Low",
- "text": "Taint Windows nodes",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "Low",
- "text": "Keep windows containers patch level in sync with host patch level",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP BTP",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
- "severity": "Low",
- "text": "If required use nodePool snapshots",
- "waf": "Cost"
+ "checklist": "SAP Checklist",
+ "description": "Keep your management group hierarchy reasonably flat, no more than four.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "enforce existing Management Group policies to SAP Subscriptions",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider spot node pools for non time-sensitive workloads",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"severity": "Low",
- "text": "Consider AKS virtual node for quick bursting",
+ "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
"severity": "High",
- "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
+ "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "High",
- "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
+ "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"severity": "Medium",
- "text": "Monitor CPU and memory utilization of the nodes",
+ "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Help protect your HANA database by using the Azure Backup service.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Ensure time-zone matches between the operating system and the SAP system.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"severity": "Medium",
- "text": "Monitor OS disk queue depth in nodes",
- "waf": "Operations"
+ "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Subscribe to resource health notifications for your AKS cluster",
+ "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "High",
- "text": "Configure requests and limits in your pod specs",
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Medium",
- "text": "Enforce resource quotas for namespaces",
+ "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
- "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
- "service": "AKS",
- "severity": "High",
- "text": "Configure Liveness and Readiness probes for all deployments",
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use the Cluster Autoscaler",
- "waf": "Performance"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
- "severity": "Low",
- "text": "Customize node configuration for AKS node pools",
- "waf": "Performance"
+ "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use the Horizontal Pod Autoscaler when required",
- "waf": "Performance"
+ "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "High",
- "text": "Consider an appropriate node size, not too large or too small",
+ "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "Low",
- "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
- "waf": "Performance"
- },
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "Reliability"
+ },
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "Low",
- "text": "Consider subscribing to EventGrid Events for AKS automation",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "Low",
- "text": "For long running operation on an AKS cluster consider event termination",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
"severity": "Low",
- "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
+ "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "High",
- "text": "Use ephemeral OS disks",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
- "severity": "High",
- "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"severity": "Low",
- "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"severity": "Medium",
- "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
+ "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"severity": "Medium",
- "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
"waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
- "severity": "Medium",
- "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
+ "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "Low",
- "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
- "severity": "High",
- "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "High",
- "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "Cost"
+ "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Performance"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
- "severity": "High",
- "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"severity": "Medium",
- "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"severity": "Medium",
- "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"severity": "High",
- "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "text": "Public IP assignment to VM running SAP Workload is not recommended.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
"severity": "High",
- "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "Security"
+ "text": "Consider reserving IP address on DR side when configuring ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Avoid using overlapping IP address ranges for production and DR sites.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
"severity": "Medium",
- "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operations"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"severity": "Medium",
- "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
"waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"severity": "Medium",
- "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "Reliability"
+ "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
- "severity": "High",
- "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Security"
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"severity": "High",
- "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Cost"
+ "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
- "severity": "High",
- "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"severity": "Medium",
- "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "severity": "Low",
- "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
- "severity": "Low",
- "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Security"
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "Medium",
- "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
"waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
- "severity": "Medium",
- "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "High",
+ "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Medium",
- "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Medium",
- "text": "Limit the number of routes per route table to 400.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
- "severity": "High",
- "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Reliability"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"severity": "High",
- "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
- "waf": "Reliability"
+ "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Security"
+ "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"severity": "Medium",
- "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
+ "text": "Review SAP HANA database backups for Azure VMs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
- "severity": "High",
- "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
- "severity": "High",
- "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "text": "Review Site Recovery built-in monitoring, where used for SAP.",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
"severity": "High",
- "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "Reliability"
+ "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"severity": "Medium",
- "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Review Oracle Database in Azure Linux VM backup strategies.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"severity": "Medium",
- "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "Security"
+ "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
- "severity": "Low",
- "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Review the use of Automated Backup v2 for Azure VMs.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"severity": "High",
- "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Enabling Write accelerator for M series when using premium disks(V1)",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"severity": "Medium",
- "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Reliability"
+ "text": "Test availability zone latency.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use Azure Bastion to securely connect to your network.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Security"
+ "text": "Activate SAP EarlyWatch Alert for all SAP components.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use Azure Bastion in a subnet /26 or larger.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Security"
+ "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "text": "Review SQL Server performance monitoring using CCMS.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "Low",
- "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Review SAP HANA studio alerts.",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "High",
- "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "High",
- "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"severity": "High",
- "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "Reliability"
+ "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "High",
- "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
+ "severity": "Medium",
+ "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Security"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "Use Azure Key Vault to store your secrets and credentials",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"severity": "Medium",
- "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "High",
- "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"severity": "High",
- "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "Medium",
- "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
- "severity": "Medium",
- "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
+ "severity": "High",
+ "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
- "severity": "Medium",
- "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Reliability"
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"severity": "High",
- "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Cost"
+ "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "High",
+ "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Low",
+ "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "waf": "Security"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Medium",
- "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "Low",
+ "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
+ "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "Medium",
- "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
+ "service": "App Services",
"severity": "High",
- "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
+ "service": "App Services",
"severity": "High",
- "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "severity": "Low",
+ "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
+ "service": "App Services",
"severity": "High",
- "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
"severity": "Medium",
- "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Operations"
+ "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
- "severity": "Medium",
- "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Performance"
- },
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
+ "waf": "Reliability"
+ },
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"severity": "Low",
- "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
- "waf": "Performance"
+ "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"severity": "High",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
- "severity": "Low",
- "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
- "severity": "High",
- "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
- "severity": "High",
- "text": "Use Azure Firewall Premium to enable additional security features.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Do not store sensitive data on local disk",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
- "severity": "High",
- "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"severity": "High",
- "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "Deploy code to App Service from a trusted and secure environment.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"severity": "High",
- "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"severity": "High",
- "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Operations"
+ "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"severity": "High",
- "text": "Use a /26 prefix for your Azure Firewall subnets.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "Pull container images from Azure Container Registry using a Managed Identity.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "Medium",
- "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "Performance"
+ "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "Medium",
- "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
- "waf": "Performance"
+ "text": "Send App Service activity logs to Log Analytics",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"severity": "Medium",
- "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
+ "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
- "severity": "High",
- "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
"severity": "Low",
- "text": "Use web categories to allow or deny outbound access to specific topics.",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
- "severity": "Medium",
- "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Enable Azure Firewall DNS proxy configuration.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
- "severity": "High",
- "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "Low",
- "text": "Implement backups for your firewall rules",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "High",
- "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Reliability"
+ "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"severity": "High",
- "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
- "waf": "Reliability"
+ "text": "Use a Web Application Firewall (WAF) in front of App Service.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "High",
- "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"severity": "Medium",
- "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
"severity": "High",
- "text": "Don't enable virtual network service endpoints by default on all subnets.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
- "severity": "Medium",
- "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
"severity": "High",
- "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "text": "Turn off remote debugging in production environments.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
- "severity": "High",
- "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
+ "severity": "Medium",
+ "text": "Enable Defender for Cloud - Defender for App Service",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"severity": "Medium",
- "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "Enable DDOS Protection Standard on the WAF VNet",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"severity": "Medium",
- "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "Pull container images over a Virtual Network from Azure Container Registry.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"severity": "Medium",
- "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "text": "Conduct a penetration test on the web application.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"severity": "Medium",
- "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "waf": "Reliability"
+ "text": "Deploy validated and vulnerability-scanned code.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
+ "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
+ "service": "App Services",
"severity": "Medium",
- "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Performance"
+ "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
+ "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
+ "service": "App Services",
"severity": "Medium",
- "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
+ "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "App Services",
+ "severity": "High",
+ "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
+ "waf": "Governance"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Operations"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
+ "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/",
+ "service": "App Services",
+ "severity": "Low",
+ "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
+ "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
+ "service": "App Services",
"severity": "Medium",
- "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Reliability"
+ "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
+ "severity": "High",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
- "severity": "Medium",
- "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"severity": "High",
- "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"severity": "High",
- "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "Medium",
- "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
- "waf": "Security"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "Medium",
- "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
"severity": "High",
- "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "Low",
- "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "severity": "High",
+ "text": "Learn how to trigger a manual failover.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
"severity": "High",
- "text": "Use built-in policies where possible to minimize operational overhead.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "text": "Learn how to fail back after a failover.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
- "severity": "Medium",
- "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "High",
+ "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Security"
+ "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "severity": "High",
+ "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Security"
+ "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
- "waf": "Security"
+ "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
- "waf": "Security"
+ "text": "Use Azure Traffic Manager to coordinate requests",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
+ "severity": "High",
+ "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
- "waf": "Security"
+ "text": "Follow reliability support recommendations in Azure Bot Service",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
"severity": "Medium",
- "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Operations"
+ "text": "Deploying bots with local data residency and regional compliance",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
"severity": "Medium",
- "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
"waf": "Reliability"
},
{
"arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
- "severity": "High",
- "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "severity": "Medium",
+ "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
"severity": "Medium",
- "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "text": "check backup instances with the underlying datasource not found",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
"service": "VM",
"severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
"severity": "Medium",
- "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operations"
+ "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
"severity": "Medium",
- "text": "Use Network Watcher to proactively monitor traffic flows.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Operations"
+ "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
"severity": "Medium",
- "text": "Use Azure Monitor Logs for insights and reporting.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "Operations"
+ "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
"severity": "Medium",
- "text": "Use Azure Monitor alerts for the generation of operational alerts.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "Operations"
+ "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
"severity": "Medium",
- "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "Operations"
+ "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
- "severity": "Low",
- "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Make sure advisor is configured for VM right sizing ",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "checklist": "Cost Optimization Checklist",
+ "description": "check by searching the Meter Category Licenses in the Cost analysys",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
"service": "VM",
"severity": "Medium",
- "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
- "waf": "Security"
+ "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
"service": "VM",
"severity": "Medium",
- "text": "Monitor VM security configuration drift via Azure Policy.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
"service": "VM",
"severity": "Medium",
- "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "Operations"
+ "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
"severity": "Medium",
- "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Operations"
+ "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
- "severity": "High",
- "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Only larger disks can be reserved => 1 TiB -",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
"severity": "Medium",
- "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
- "waf": "Operations"
+ "text": "After the right-sizing optimization",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
- "severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "severity": "Medium",
+ "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
"severity": "Medium",
- "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
"severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "text": "Consider using a VMSS to match demand rather than flat sizing",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
"severity": "Medium",
- "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
"severity": "Medium",
- "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "text": "Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
"severity": "Medium",
- "text": "Establish an automated process for key and certificate rotation.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
- "waf": "Security"
+ "text": "Functions - Reuse connections",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "Security"
+ "text": "Functions - Cache data locally",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
- "waf": "Security"
+ "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "Security"
+ "text": "Functions - Keep your functions warm",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "Security"
+ "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
- "waf": "Security"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
- "severity": "High",
- "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
- "waf": "Security"
+ "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
- "severity": "High",
- "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
- "severity": "High",
- "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
- "severity": "High",
- "text": "Enable Endpoint Protection on IaaS Servers.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
- "waf": "Security"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "severity": "Medium",
+ "text": "Consider archiving tiers for less used data",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
"service": "VM",
"severity": "Medium",
- "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
- "waf": "Security"
+ "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
"severity": "Medium",
- "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "Security"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
- "severity": "High",
- "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
- "waf": "Security"
+ "text": "Consider using standard SSD rather than Premium or Ultra where possible",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
- "waf": "Security"
+ "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
+ "waf": "Cost"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
"severity": "Medium",
- "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
- "waf": "Security"
+ "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
"service": "Storage",
- "severity": "High",
- "text": "Enable secure transfer to storage accounts.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Storage accounts: check hot tier and/or GRS necessary",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
- "severity": "High",
- "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
- "waf": "Security"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
- "severity": "High",
- "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "Operations"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Follow Metaprompting guardrails for resonsible AI",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Export cost data to a storage account for additional data analysis.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Enable monitoring for your AOAI instances",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type == 'microsoft.insights/metricalerts' | extend compliant = (properties.targetResourceType =~ 'Microsoft.CognitiveServices/accounts') | project id, compliant",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Create multiple Apache Spark pool definitions of various sizes.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Monitor token usage to prevent service disruptions due to capacity",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "severity": "Medium",
+ "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
"severity": "Medium",
- "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
- "waf": "Operational Excellence"
+ "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
- "severity": "Low",
- "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Right-sizing all VMs",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Swap VM sized with normalized and most recent sizes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
- "waf": "Security"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
- "waf": "Operational Excellence"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
"severity": "High",
- "text": "Evaluate usage of Provisioned throughput model ",
- "waf": "Performance"
+ "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Review and implement Azure AI content safety",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
+ "severity": "Medium",
+ "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
- "waf": "Performance"
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
+ "severity": "Medium",
+ "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "Medium",
- "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
- "waf": "Performance"
+ "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
- "waf": "Performance"
+ "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
- "waf": "Performance"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
"severity": "Medium",
- "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
- "waf": "Performance"
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"severity": "High",
- "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
- "waf": "Performance"
+ "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
- "waf": "Performance"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Avoid placing Traffic Manager behind Front Door.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "Low",
- "text": "Deploy multiple OAI instances across regions",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Implement retry & healthchecks with Gateway pattern like APIM",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Deploy separate fine tuned models across regions if finetuning is employed",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
- "waf": "Reliability"
+ "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type == 'microsoft.search/searchservices' | extend compliant = (sku.name != 'free' and properties.replicaCount >= 3) | project id, compliant",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"severity": "High",
- "text": "Azure AI search service tiers should be choosen to have a SLA ",
- "waf": "Reliability"
+ "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
- "severity": "Low",
- "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=~'Enabled') and (mode=~'Prevention')), enabledState, mode",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
"severity": "High",
- "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
"severity": "High",
- "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
"severity": "High",
- "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/ai-onboarding",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
"severity": "High",
- "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Implement Prompt shields and groundedness detection using Content Safety ",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
"severity": "Medium",
- "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
- "waf": "Security"
+ "text": "Capture logs and metrics by turning on Diagnostic Settings. Include resource activity logs, access logs, health probe logs, and WAF logs. Set up alerts.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
- "waf": "Security"
+ "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Choose a routing method that supports your deployment strategy. The weighted method, which distributes traffic based on the configured weight coefficient, supports active-active models. A priority-based value that configures the primary region to receive all traffic and send traffic to the secondary region as a backup supports active-passive models. Combine the preceding methods with latency so that the origin with the lowest latency receives traffic.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
"severity": "High",
- "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
- "waf": "Security"
+ "text": "Support redundancy by having multiple origins in one or more back-end pools. Always have redundant instances of your application and make sure each instance exposes an endpoint or origin. You can place those origins in one or more back-end pools.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.privateEndpointConnections != '[]' and properties.publicNetworkAccess !~ 'enabled')",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Configure private endpoint for AI services to restrict service access within your network",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Set a timeout on forwarding requests to the back end. Adjust the timeout setting according to your endpoints' needs. If you don't, Azure Front Door might close the connection before the origin sends the response. You can also lower the default timeout for Azure Front Door if all of your origins have a shorter timeout.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Decide if your application requires session affinity. If you have high reliability requirements, we recommend that you disable session affinity.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Send the host header to the back end. The back-end services should be aware of the host name so that they can create rules to accept traffic only from that host.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Use prompt compression tools like LLMLingua or gprtrim",
- "waf": "Cost Optimization"
+ "text": "Use caching for endpoints that support it.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (isnotnull(identity))",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
- "waf": "Security"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "Low",
+ "text": "Disable health checks in single back-end pools. If you have only one origin configured in your Azure Front Door origin group, these calls are unnecessary. This is only recommended if you can't have multiple origins in your endpoint.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
- "waf": "Security"
+ "text": "We recommend using the Premium Tier for leveraging the Security reports while the Standard Azure Front Door Profile provides only traffic reports under built-in analytics/reports.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
- "waf": "Security"
+ "text": "Use wildcard TLS certificates when possible.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "Medium",
- "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
- "waf": "Security"
+ "text": "Optimize your application query string for caching. For purely static content, ignore query strings to maximize your use of the cache. If your application uses query strings, consider including them in the cache key. Including the query strings in the cache key allows Azure Front Door to serve cached responses or other responses, based on your configuration.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (tags != '{}')",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "severity": "Low",
- "text": "Azure AI Services are properly tagged for better management",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Use file compression when you're accessing downloadable content.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
- "severity": "Low",
- "text": "Azure AI Service accounts follows organizational naming conventions",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
+ "severity": "High",
+ "text": "Consider migrating to Standard or Premium SKU if you are using Classic Azure Front Door currently as Classic Azure Front Door will be deprecated by March 2027.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Diagnostic logs in Azure AI services resources should be enabled",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "Consider using Traffic Manager load balancing Azure Front Door and a third party CDN provider CDN profile for mission critical high availability scenario. ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.disableLocalAuth == true)",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
"severity": "High",
- "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
+ "text": "When using Front Door with origin as App services, consider locking down the traffic to app services only through Azure Front Door using access restrictions. ",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required for AKS Windows workloads HostProcess containers can be used",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use KEDA if running event-driven workloads",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Dapr to ease microservice development",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"severity": "High",
- "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
- "waf": "Security"
+ "text": "Use the SLA-backed AKS offering",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Disruption Budgets in your pod and deployment definitions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"severity": "High",
- "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
- "waf": "Operational Excellence"
+ "text": "If using a private registry, configure region replication to store images in multiple regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use an external application such as kubecost to allocate costs to different users",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use scale down mode to delete/deallocate nodes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"severity": "Medium",
- "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
- "waf": "Cost Optimization"
+ "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"severity": "Medium",
- "text": "Plan and manage AI Search Vector storage",
- "waf": "Operational Excellence"
+ "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"severity": "Medium",
- "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
- "waf": "Operational Excellence"
+ "text": "Separate applications from the control plane with user/system node pools",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
- "severity": "High",
- "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Add taint to your system nodepool to make it dedicated",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"severity": "Medium",
- "text": "Evaluate the quality of prompts and applications when switching between model versions",
- "waf": "Operational Excellence"
+ "text": "Use a private registry for your images, such as ACR",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"severity": "Medium",
- "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
- "waf": "Operational Excellence"
+ "text": "Scan your images for vulnerabilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Evaluate your Azure AI Search results based on different search parameters",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"severity": "Medium",
- "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
- "waf": "Operational Excellence"
+ "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
- "waf": "Operational Excellence"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
+ "severity": "High",
+ "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"severity": "Medium",
- "text": "Red team your GenAI applications",
+ "text": "If required add Key Management Service etcd encryption",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required consider using Confidential Compute for AKS",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"severity": "Medium",
- "text": "Provide end users with scoring options for LLM responses and track these scores. ",
- "waf": "Operational Excellence"
+ "text": "Consider using Defender for Containers",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"severity": "High",
- "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
- "waf": "Cost Optimization"
+ "text": "Use managed identities instead of Service Principals",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
- "waf": "Operational Excellence"
+ "text": "Integrate authentication with AAD (using the managed integration)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"severity": "Medium",
- "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
- "waf": "Reliability"
+ "text": "Limit access to admin kubeconfig (get-credentials --admin)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"severity": "Medium",
- "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
- "waf": "Reliability"
+ "text": "Integrate authorization with AAD RBAC",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
"severity": "Medium",
- "text": "Tune content filters to minimize false positives from overly aggressive filters",
- "waf": "Reliability"
+ "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "text": "For AKS non-interactive logins use kubelogin (preview)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' and kind =~ 'contentsafety' | project id, compliant = 1",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"severity": "Medium",
- "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "text": "Disable AKS local accounts",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Configure if required Just-in-time cluster access",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Configure if required AAD conditional access for AKS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
- "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required for Windows AKS workloads configure gMSA ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"severity": "Medium",
- "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
- "waf": "Cost Optimization"
+ "text": "For finer control consider using a managed Kubelet Identity",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"severity": "Medium",
- "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
- "waf": "Cost Optimization"
+ "text": "If using AGIC, do not share an AppGW across clusters",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
- "waf": "Cost Optimization"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
- "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
- "waf": "Operational Excellence"
+ "text": "For Windows workloads use Accelerated Networking",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5855",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
- "service": "Azure OpenAI",
- "severity": "Medium",
- "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
- "waf": "Operational Excellence"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
- "severity": "Medium",
- "text": "Implement an error handling policy at the global level",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
- "severity": "Medium",
- "text": "Ensure all APIs policies include a element.",
- "waf": "Operations"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use the standard ALB (as opposed to the basic one)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
- "waf": "Operations"
+ "text": "If using Azure CNI, consider using different Subnets for NodePools",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
- "waf": "Operations"
+ "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "High",
- "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
- "severity": "Medium",
- "text": "Enable Application Insights for more detailed telemetry",
- "waf": "Operations"
+ "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "High",
- "text": "Configure alerts on the most critical metrics",
- "waf": "Operations"
+ "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "High",
- "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
- "severity": "High",
- "text": "Protect incoming requests to APIs (data plane) with Azure AD",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
- "severity": "Medium",
- "text": "Create appropriate groups to control the visibility of the products",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required add your own CNI plugin",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use Backends feature to eliminate redundant API backend configurations",
- "waf": "Operations"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required configure Public IP per node in AKS",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Named Values to store common values that can be used in policies",
- "waf": "Operations"
+ "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
- "severity": "Medium",
- "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
"severity": "Medium",
- "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
+ "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"severity": "High",
- "text": "Ensure there is an automated backup routine",
- "waf": "Reliability"
+ "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "Low",
- "text": "If you need to log at high performance levels, consider Event Hubs policy",
- "waf": "Operations"
+ "text": "If using a public API endpoint, restrict the IP addresses that can access it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
- "severity": "Medium",
- "text": "Apply throttling policies to control the number of requests per second",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
- "severity": "Medium",
- "text": "Configure autoscaling to scale out the number of instances when the load increases",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
- "severity": "Medium",
- "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
- "waf": "Performance"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use the premium tier for production workloads.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use private clusters if your requirements mandate it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "Medium",
- "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
- "waf": "Reliability"
+ "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "High",
- "text": "Be aware of APIM's limits",
- "waf": "Reliability"
+ "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "High",
- "text": "Ensure that the self-hosted gateway deployments are resilient.",
- "waf": "Reliability"
+ "text": "Use Kubernetes network policies to increase intra-cluster security",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use Azure Front Door in front of APIM for multi-region deployment",
- "waf": "Performance"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use a WAF for web workloads (UIs or APIs)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"severity": "Medium",
- "text": "Deploy the service within a Virtual Network (VNet)",
+ "text": "Use DDoS Standard in the AKS Virtual Network",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
- "severity": "Medium",
- "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required add company HTTP Proxy",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"severity": "Medium",
- "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
+ "text": "Consider using a service mesh for advanced microservice communication management",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"severity": "High",
- "text": "Disable Public Network Access",
- "waf": "Security"
+ "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
- "severity": "Medium",
- "text": "Simplify management with PowerShell automation scripts",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Check regularly Azure Advisor for recommendations on your cluster",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
- "severity": "Medium",
- "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Enable AKS auto-certificate rotation",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
- "severity": "Medium",
- "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
- "severity": "Medium",
- "text": "Implement DevOps and CI/CD in your workflow",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
- "severity": "Medium",
- "text": "Secure APIs using client certificate authentication",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
- "severity": "Medium",
- "text": "Secure backend services using client certificate authentication",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
- "severity": "Medium",
- "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider using AKS command invoke on private clusters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
- "severity": "Medium",
- "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "For planned events consider using Node Auto Drain",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"severity": "High",
- "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
- "waf": "Security"
+ "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
- "severity": "High",
- "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Use custom Node RG (aka 'Infra RG') name",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use managed identities to authenticate to other Azure resources whenever possible",
- "waf": "Security"
+ "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
- "severity": "High",
- "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Taint Windows nodes",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage zone-redundancy to ensure high availability in the event of zone-level failures. Use Premium V2/V3 or Isolated v2 tiers, which provide support for zone-redundant deployments and ensure minimal downtime during disasters.",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
"severity": "Low",
- "text": "Implement a baseline highly available zone-redundant web application architecture. Ensure your Azure App Service is on Premium V2/V3 or Isolated v2 tiers for zone-redundant support.",
- "waf": "Reliability"
+ "text": "Keep windows containers patch level in sync with host patch level",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage staging slots for zero-downtime deployments and automated backups to ensure disaster recovery. Choose the appropriate tier (Standard or Premium) based on the number of slots and disaster recovery requirements.",
- "graph": "resources | where type =~ 'microsoft.web/serverfarms' | extend compliant = (sku.tier == 'Premium' or sku.tier == 'Standard') | distinct id,compliant",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
- "severity": "Medium",
- "text": "Use Premium and Standard tiers for staging slots and automated backups. Align your backup retention period with disaster recovery needs.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Availability Zones provide physical isolation across datacenters in a region, reducing downtime during outages. Verify your region supports Availability Zones and use Premium V2/V3 tiers for zone-redundant deployments.",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-service",
- "service": "App Services",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (Premium V2/V3 tier required). Check region support for Availability Zones.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required use nodePool snapshots",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enable health checks to detect unhealthy instances in real-time and automatically replace them to maintain high availability and application reliability.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.HealthCheckPath != '') | distinct id,compliant",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
- "severity": "Medium",
- "text": "Implement health checks to monitor and detect issues with App Service instances. Health checks enable automatic instance replacement on failure.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider spot node pools for non time-sensitive workloads",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Follow best practices for configuring backups and restores in Azure App Service and ASE to guarantee data availability and ensure recovery during disaster scenarios.",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/azure/app-service/manage-backup",
- "service": "App Services",
- "severity": "High",
- "text": "Refer to backup and restore best practices for Azure App Service and App Service Environments (ASE) to ensure data availability and recovery.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider AKS virtual node for quick bursting",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure high availability by incorporating scaling, fault tolerance, monitoring, and zone redundancy into your App Service architecture. Leverage health checks and availability zones to maintain uptime.",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "High",
- "text": "Implement Azure App Service reliability best practices, including auto-scaling, fault tolerance, health checks, and zone redundancy.",
- "waf": "Reliability"
+ "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Prepare for disaster recovery by implementing region failover strategies. Utilize active-active and active-passive configurations, automated failover, and Infrastructure as Code (IaC) for seamless failover during outages.",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "Low",
- "text": "Familiarize with App Service region failover, including active-active and active-passive configurations, automated failover, and IaC deployment.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure App Service offers built-in reliability features, including scaling, fault tolerance, and service-level agreements (SLAs). Leverage these features to maintain consistent performance during outages.",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-app-service",
- "service": "App Services",
- "severity": "High",
- "text": "Familiarize with reliability support in Azure App Service, including scaling options, SLAs, and automated recovery mechanisms.",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Monitor CPU and memory utilization of the nodes",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enabling 'Always On' for Function Apps ensures that the app does not go idle, maintaining its availability and responsiveness at all times.",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "Medium",
- "text": "Ensure 'Always On' is enabled for Function Apps running on App Service plans to prevent idling and ensure continuous availability.",
- "waf": "Reliability"
+ "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Health checks monitor the health of App Service instances, enabling automatic replacement of unhealthy instances to maintain high availability.",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
"severity": "Medium",
- "text": "Monitor App Service instances using Health checks to detect unhealthy instances and automatically replace them.",
- "waf": "Reliability"
+ "text": "Monitor OS disk queue depth in nodes",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "Medium",
- "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests, ensuring proactive detection of performance issues and downtime.",
- "waf": "Reliability"
+ "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "severity": "Low",
- "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
- "waf": "Reliability"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Subscribe to resource health notifications for your AKS cluster",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Key Vault ensures secrets are encrypted, securely stored, and accessed only by authorized applications. It supports audit logging, and secret versioning, and reduces the risk of accidental exposure of sensitive information.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "High",
- "text": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a secure, managed, and audited environment for storing secrets, and integrates seamlessly with App Service via App Service Key Vault References for enhanced security.",
- "waf": "Security"
+ "text": "Configure requests and limits in your pod specs",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Managed Identity eliminates the need for hard-coded credentials by allowing App Service to authenticate to Azure Key Vault securely. This reduces the risk of credential exposure and simplifies secret management for enhanced security.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Enforce resource quotas for namespaces",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
"severity": "High",
- "text": "Use Managed Identity to securely connect to Azure Key Vault for accessing secrets, through App Service Key Vault References.",
- "waf": "Security"
+ "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Storing TLS certificates in Azure Key Vault enhances security by providing centralized, secure management and automated renewal of certificates. This reduces the risk of manual handling errors and certificate expiration.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
+ "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+ "service": "AKS",
"severity": "High",
- "text": "Use Azure Key Vault to securely store and manage TLS certificates for App Service.",
- "waf": "Security"
+ "text": "Configure Liveness and Readiness probes for all deployments",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "To minimize exposure and improve security, isolate systems processing sensitive data. Leverage separate App Service Plans or App Service Environments for isolation, and use different subscriptions or management groups to enforce stricter boundaries and governance.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medium",
- "text": "Isolate systems that process sensitive information using separate App Service Plans, App Service Environments (ASE), and consider different subscriptions or management groups for enhanced security.",
- "waf": "Security"
+ "text": "Use the Cluster Autoscaler",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
- "severity": "Medium",
- "text": "Do not store sensitive data on local disk",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Customize node configuration for AKS node pools",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use Microsoft Entra ID or B2C for secure user authentication and Single Sign-On (SSO) across applications. Integrate using the built-in App Service Authentication/Authorization feature for streamlined security and compliance with modern authentication protocols like OpenID Connect.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medium",
- "text": "Use Microsoft Entra ID or B2C for secure authentication and Single Sign-On (SSO).",
- "waf": "Security"
+ "text": "Use the Horizontal Pod Autoscaler when required",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure all code deployments to App Service originate from a controlled, secured environment, such as a well-managed DevOps pipeline. This practice mitigates the risk of deploying unauthorized or malicious code by enforcing version control, code verification, and secure hosting.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
"severity": "High",
- "text": "Deploy code to App Service from a trusted and secure environment.",
- "waf": "Security"
+ "text": "Consider an appropriate node size, not too large or too small",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM to enhance security by enforcing Microsoft Entra ID secured endpoints for deployment. This ensures that only authenticated users using Microsoft Entra ID credentials can access deployment services, including the SCM site.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
- "severity": "High",
- "text": "Disable basic authentication for FTP/FTPS and WebDeploy/SCM.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Wherever possible, use Managed Identity to securely connect to Microsoft Entra ID-secured resources without storing credentials. If this is not feasible, store secrets in Azure Key Vault and access them using Managed Identity to maintain security and reduce the risk of credential exposure.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "severity": "High",
- "text": "Use Managed Identity to connect to Microsoft Entra ID secured resources.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, pull these images using a Managed Identity to avoid storing credentials. This ensures secure access to container images and reduces the risk of credential exposure.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
- "severity": "High",
- "text": "Pull container images from Azure Container Registry using a Managed Identity.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "For long running operation on an AKS cluster consider event termination",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure diagnostic settings to send telemetry and security logs (including HTTP, platform, and audit logs) to Log Analytics. Centralized logging enhances monitoring, threat detection, and compliance reporting.",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
- "severity": "Medium",
- "text": "Send App Service runtime and security logs to Log Analytics for centralized monitoring and alerting.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "Low",
+ "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
- "severity": "Medium",
- "text": "Send App Service activity logs to Log Analytics",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "High",
+ "text": "Use ephemeral OS disks",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use regional VNet integration, Network Security Groups (NSGs), and User-Defined Routes (UDRs) to control outbound network access. Route traffic through a Network Virtual Appliance (NVA), such as Azure Firewall, and monitor firewall logs to ensure traffic is properly controlled and secure.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
- "severity": "Medium",
- "text": "Control outbound network access for App Service using VNet integration, NSGs, UDRs, and firewalls.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
+ "severity": "High",
+ "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Provide a stable outbound IP by using VNet integration with a NAT Gateway or Network Virtual Appliance (NVA) like Azure Firewall. This enables the receiving party to allow-list based on IP, if necessary. For communications with Azure services, use mechanisms like Service Endpoints or private endpoints to avoid relying on static IPs, ensuring secure and efficient connectivity.",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
"severity": "Low",
- "text": "Ensure a stable IP for outbound communications by using VNet NAT Gateway or Azure Firewall.",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Control inbound network access by configuring App Service Access Restrictions, Service Endpoints, or Private Endpoints. Ensure appropriate restrictions are set for both the web app and the SCM (deployment) site to limit unauthorized access and enhance security.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "High",
- "text": "Control inbound network access using Access Restrictions, Service Endpoints, or Private Endpoints.",
- "waf": "Security"
+ "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Protect App Service from malicious inbound traffic by deploying a Web Application Firewall (WAF) using Azure Application Gateway or Azure Front Door. Ensure WAF logs are monitored regularly to detect and respond to security threats.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
- "severity": "High",
- "text": "Use a Web Application Firewall (WAF) in front of App Service.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "To prevent the Web Application Firewall (WAF) from being bypassed, lock down access to App Service by using Access Restrictions, Service Endpoints, and Private Endpoints. This ensures that all traffic is routed through the WAF, providing a secure front layer of protection.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "High",
- "text": "Ensure the WAF cannot be bypassed by securing access to App Service.",
- "waf": "Security"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
+ "severity": "Medium",
+ "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the minimum TLS policy is set to 1.2 or higher, with a preference for TLS 1.3, to enhance security through stronger encryption protocols. TLS 1.3 provides additional security improvements and faster handshake times, reducing vulnerabilities associated with older versions.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"severity": "Medium",
- "text": "Set minimum TLS policy to 1.2 or higher, preferably 1.3, in App Service configuration.",
- "waf": "Security"
+ "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure App Service to enforce HTTPS-only, automatically redirecting all HTTP traffic to HTTPS. Additionally, implement HTTP Strict Transport Security (HSTS) in your code or via a Web Application Firewall (WAF) to ensure browsers only access the site over HTTPS, enhancing security by preventing downgrade attacks.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Use HTTPS only and consider enabling HTTP Strict Transport Security (HSTS).",
- "waf": "Security"
+ "text": "Follow Metaprompting guardrails for resonsible AI",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Do not use wildcards (*) in your CORS configuration, as this permits unrestricted access from any origin, compromising security. Instead, explicitly specify trusted origins that are allowed to access the service, ensuring controlled access.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Avoid using wildcards for CORS; specify allowed origins explicitly.",
- "waf": "Security"
+ "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Remote debugging should not be enabled in production as it opens additional ports, increasing the attack surface. Although App Service automatically turns off remote debugging after 48 hours, it is recommended to disable it manually in production to maintain a secure environment.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Turn off remote debugging in production environments.",
- "waf": "Security"
+ "text": "Enable monitoring for your AOAI instances",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
- "severity": "Medium",
- "text": "Enable Defender for Cloud - Defender for App Service",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.insights/metricalerts' | extend compliant = (properties.targetResourceType =~ 'Microsoft.CognitiveServices/accounts') | project id, compliant",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
- "severity": "Medium",
- "text": "Enable DDOS Protection Standard on the WAF VNet",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Monitor token usage to prevent service disruptions due to capacity",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "When using images stored in Azure Container Registry, ensure they are pulled over a virtual network by using a private endpoint and configuring the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'. This ensures secure communication between App Service and the registry, preventing exposure to the public internet.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Pull container images over a Virtual Network from Azure Container Registry.",
- "waf": "Security"
+ "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Perform a penetration test on the web application in accordance with Azure's penetration testing rules of engagement. This helps identify vulnerabilities and security weaknesses that can be addressed before they are exploited.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
- "severity": "Medium",
- "text": "Conduct a penetration test on the web application.",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
+ "severity": "Low",
+ "text": "Enable and configure Diagnostics for the Azure OpenAI Service. If not sufficient, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that only trusted code, which has been validated and scanned for vulnerabilities, is deployed to production following DevSecOps practices. This minimizes the risk of introducing security vulnerabilities into the application environment.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
- "severity": "Medium",
- "text": "Deploy validated and vulnerability-scanned code.",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ensure that the latest versions of supported platforms, programming languages, protocols, and frameworks are used. Regular updates mitigate the risk of security vulnerabilities and ensure compatibility with security patches.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage Auto-Healing in Azure App Service to automatically restart instances or trigger custom actions based on pre-defined failure conditions like memory thresholds, HTTP errors, or specific event logs.",
- "guid": "60b3a935-33e5-45c9-87c7-53882e395b46",
- "link": "https://learn.microsoft.com/azure/app-service/overview-diagnostics",
- "service": "App Services",
- "severity": "Medium",
- "text": "Use Auto-Healing with custom rules to restart App Service instances automatically when failures occur.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure Azure Monitor alerts based on Application Insights metrics for response times, failure rates, and overall availability. Alerts help detect issues proactively and reduce mean-time-to-recovery (MTTR).",
- "guid": "e52e4514-02a7-4e81-a98e-88ce1b18e557",
- "link": "https://learn.microsoft.com/azure/azure-monitor/app/alerts",
- "service": "App Services",
- "severity": "Medium",
- "text": "Set up alerts for critical Application Insights metrics, such as response time and failure rates.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Evaluate usage of Provisioned throughput model ",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use Azure Policy to enforce security, compliance, and governance configurations for App Service. Policies can ensure that critical settings such as TLS versions, backup configurations, and network restrictions are enforced across all App Service instances.",
- "guid": "361e886f-ca40-4ead-a8e9-1379c642ae9c",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Apply Azure Policy to enforce compliance across App Service configurations.",
- "waf": "Governance"
+ "text": "Review and implement Azure AI content safety",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Leverage Azure Cost Management to track and forecast App Service expenses. Set up alerts for budget thresholds to avoid overspending, and optimize costs based on resource utilization trends.",
- "guid": "42eb48f0-28ff-497c-b2c0-a8fa1f989832",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/",
- "service": "App Services",
- "severity": "Low",
- "text": "Monitor App Service costs using Azure Cost Management and create cost alerts.",
- "waf": "Cost"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "If you have predictable and steady usage of App Service, purchasing Reserved Instances can significantly reduce long-term costs. Commit to one or three years for lower pricing compared to pay-as-you-go.",
- "guid": "e489221b-487e-48a3-aaab-48e3d205ca12",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/",
- "service": "App Services",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Purchase reserved instances for App Service plans to optimize long-term costs.",
- "waf": "Cost"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
- "waf": "Security"
+ "text": "Improve latency of the system by limiting token sizes, streaming options for applications like chatbots or conversational interfaces. Streaming can enhance the perceived performance of Azure OpenAI applications by delivering responses to users in an incremental manner",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
- "waf": "Security"
+ "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
- "severity": "Medium",
- "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
- "waf": "Security"
+ "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
- "waf": "Security"
+ "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
- "severity": "Medium",
- "text": "Has an RBAC model been created for use within VMware vSphere",
- "waf": "Security"
+ "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
- "waf": "Security"
+ "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
- "severity": "High",
- "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "Low",
+ "text": "Deploy multiple OAI instances across regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
- "waf": "Security"
+ "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
- "severity": "High",
- "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
- "waf": "Performance"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
- "waf": "Operations"
+ "text": "Deploy separate fine tuned models across regions if finetuning is employed",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
- "waf": "Operations"
+ "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.search/searchservices' | extend compliant = (sku.name != 'free' and properties.replicaCount >= 3) | project id, compliant",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
- "waf": "Operations"
+ "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
- "severity": "High",
- "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "severity": "Low",
+ "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
- "severity": "Medium",
- "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Limit use of CloudAdmin account to emergency access only",
+ "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
- "severity": "Medium",
- "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
+ "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/ai-onboarding",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
+ "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Is East-West traffic filtering implemented within NSX-T",
+ "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
- "waf": "Security"
+ "text": "Implement Prompt shields and groundedness detection using Content Safety ",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
- "severity": "Medium",
- "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
- "severity": "Medium",
- "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
- "severity": "Low",
- "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
- "severity": "Low",
- "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.privateEndpointConnections != '[]' and properties.publicNetworkAccess !~ 'enabled')",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Configure private endpoint for AI services to restrict service access within your network",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
- "severity": "Medium",
- "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
- "waf": "Reliability"
+ "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Use prompt compression tools like LLMLingua or gprtrim",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (isnotnull(identity))",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
- "waf": "Reliability"
+ "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "waf": "Operations"
+ "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
- "waf": "Operations"
+ "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
- "severity": "Medium",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
- "waf": "Cost"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (tags != '{}')",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
"severity": "Low",
- "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
- "waf": "Cost"
+ "text": "Azure AI Services are properly tagged for better management",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
- "severity": "Medium",
- "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "Low",
+ "text": "Azure AI Service accounts follows organizational naming conventions",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure all required resource reside within the same Azure availability zone(s)",
- "waf": "Performance"
+ "text": "Diagnostic logs in Azure AI services resources should be enabled",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
- "severity": "Medium",
- "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type =~ 'Microsoft.CognitiveServices/accounts' or type == 'microsoft.search/searchservices' | project id, compliant = (properties.disableLocalAuth == true)",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
- "severity": "Medium",
- "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
- "severity": "Medium",
- "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
- "severity": "Medium",
- "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "waf": "Operations"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
- "severity": "Medium",
- "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
- "severity": "Medium",
- "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
- "severity": "Medium",
- "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
- "waf": "Security"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
- "severity": "High",
- "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "waf": "Operations"
+ "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
- "severity": "High",
- "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Set a maximum limit on the number of tokens per model response (max_tokens and the number of completions to generate). Optimize the size to ensure it is large enough for a valid response",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
- "waf": "Operations"
+ "text": "Plan and manage AI Search Vector storage",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
- "severity": "Low",
- "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
- "waf": "Operations"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Ensure deployment of Azure OpenAI instances across your various environments, such as development, test, and production supporting lrarning & experimentation. Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
"severity": "High",
- "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
- "waf": "Operations"
+ "text": "Evaluate usage of billing models - PAYG vs PTU. Start with PAYG and consider PTU when the usage is predictable in production since it offers dedicated memory and compute, reserved capacity, and consistent maximum latency for the specified model version",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
- "waf": "Operations"
+ "text": "Evaluate the quality of prompts and applications when switching between model versions",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "waf": "Operations"
+ "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence and fluency",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
- "waf": "Operations"
+ "text": "Evaluate your Azure AI Search results based on different search parameters",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "waf": "Operations"
+ "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
- "waf": "Operations"
+ "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "waf": "Operations"
+ "text": "Red team your GenAI applications",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
- "waf": "Security"
+ "text": "Provide end users with scoring options for LLM responses and track these scores. ",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "severity": "High",
+ "text": "Consider Quota management practices. Use dynamic quota for certain use cases when your application can use extra capacity opportunistically or the application itself is driving the rate at which the Azure OpenAI API is called",
+ "waf": "Cost Optimization"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
- "waf": "Reliability"
+ "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc411",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning?tabs=turbo%2Cpython-new&pivots=programming-language-studio#import-training-data-from-azure-blob-store",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
+ "text": "Follow the guidance for fine-tuning with large data files and import the data from an Azure blob store. Large files, 100 MB or larger, can become unstable when uploaded through multipart forms because the requests are atomic and can't be retried or resumed",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc412",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
+ "text": "Manage rate limits for your model deployments and monitor usage of tokens per minute (TPM) and requests per minute (RPM) for pay-as-you-go deployments",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
- "severity": "High",
- "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc413",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Monitor provision-managed utilization if you're using the provisioned throughput payment model",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc414",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/content-filters",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
+ "text": "Tune content filters to minimize false positives from overly aggressive filters",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
- "severity": "High",
- "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc415",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/encrypt-data-at-rest",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Use customer-managed keys for fine-tuned models and training data that's uploaded to Azure OpenAI",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "graph": "resources | where type == 'microsoft.cognitiveservices/accounts' and kind =~ 'contentsafety' | project id, compliant = 1",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc416",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
- "waf": "Reliability"
+ "text": "Implement jailbreak risk detection to safeguard your language model deployments against prompt injection attacks",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc417",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitor-openai",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
- "waf": "Reliability"
+ "text": "Use security controls like throttling, service isolation and gateway pattern to prevent attacks that might exhaust model usage quotas",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a9",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
- "waf": "Reliability"
+ "text": "Develop your cost model, considering prompt sizes. Understanding prompt input and response sizes and how text translates into tokens helps you create a viable cost model",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a1",
+ "link": "https://azure.microsoft.com/pricing/details/cognitive-services/openai-service/",
+ "service": "Azure OpenAI",
"severity": "Medium",
- "text": "Deploy your backup solution outside of vSan, on Azure native components",
- "waf": "Reliability"
+ "text": "Consider model pricing and capabilities when you choose models. Start with less-costly models for less-complex tasks like text generation or completion tasks and for complex tasks like language translation or content understanding, consider using more advanced models. Optimize costs while still achieving the desired application performance",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "Low",
- "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
- "waf": "Reliability"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Maximize Azure OpenAI price breakpoints like fine-tuning and model breakpoints like image generation to your advantage. Fine-tuning is charged per hour, use as much time as you have available per hour to improve results without slipping into the next billing period. The cost for generating 100 images is the same as the cost for 1 image",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a3",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Remove unused fine-tuned models when they're no longer being consumed to avoid incurring an ongoing hosting fee",
+ "waf": "Cost Optimization"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8g",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Create concise prompts that provide enough context for the model to generate a useful response. Also ensure that you optimize the limit of the response length.",
+ "waf": "Cost Optimization"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec219",
+ "link": "https://learn.microsoft.com/azure/ai-services/create-account-bicep",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Use infrastructure as code (IaC) to deploy Azure OpenAI, model deployments, and other infrastructure required for fine-tuning models",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5855",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/openai",
+ "service": "Azure OpenAI",
+ "severity": "Medium",
+ "text": "Consider using dedicated model deployments per consumer group to provide per-model usage isolation that can help prevent noisy neighbors between your consumer groups",
+ "waf": "Operational Excellence"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
+ "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
+ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
+ "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable Azure Container Registry image export",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
+ "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Enable Azure Policies for Azure Container Registry",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
+ "guid": "d345293c-7639-4637-a551-c5c04e401955",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Sign and Verify containers with notation (Notary v2)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
+ "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
+ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Encrypt registry with a customer managed key",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
+ "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Use Managed Identities to connect instead of Service Principals",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable local authentication for management plane access",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable anonymous pull/push access",
+ "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
+ "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
+ "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Disable Anonymous pull access",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
+ "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Disable repository-scoped access tokens",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
+ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Deploy images from a trusted environment",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
+ "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Disable Azure ARM audience tokens for authentication",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
+ "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
+ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Enable diagnostics logging",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
+ "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Control inbound network access with Private Link",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Disable public network access if inbound network access is secured using Private Link",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Disable Public Network access",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Only the ACR Premium SKU supports Private Link access",
+ "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
+ "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "service": "ACR",
+ "severity": "Low",
+ "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
+ "service": "ACR",
+ "severity": "Medium",
+ "text": "Deploy validated container images",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure Container Registry Security Review",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
+ "service": "ACR",
+ "severity": "High",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
+ "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
+ "service": "Azure Data Explorer",
+ "text": "Leverage External Tables and Continuous data export overview to reduce costs",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
+ "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
+ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
+ "service": "Azure Data Explorer",
+ "text": "To share data, explore Leader-follower cluster configuration",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
+ "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
+ "service": "Azure Data Explorer",
+ "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
+ "service": "Azure Data Explorer",
+ "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
+ "service": "Azure Data Explorer",
+ "text": "Ingest data into each cluster in parallel",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
+ "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
+ "service": "Azure Data Explorer",
+ "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
+ "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
+ "service": "Azure Data Explorer",
+ "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
+ "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
+ "service": "Azure Data Explorer",
+ "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
+ "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
+ "service": "Azure Data Explorer",
+ "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
+ "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
+ "text": "Wrap DevOps and source control around all your code",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
+ "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Kusto/clusters",
+ "checklist": "Azure Data Explorer Review Checklist",
+ "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
+ "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
+ "severity": "Medium",
+ "text": "Leverage FTA Resiliency Playbook for Azure Data Factory",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "High",
+ "text": "Use zone redundant pipelines in regions that support Availability Zones",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
+ "severity": "Medium",
+ "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "Medium",
+ "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "Medium",
+ "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
+ "severity": "Low",
+ "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
"service": "AVS",
- "severity": "Low",
- "text": "For manual deployments, all configuration and deployments must be documented",
+ "severity": "Medium",
+ "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Has an RBAC model been created for use within VMware vSphere",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
+ "severity": "High",
+ "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
"service": "AVS",
- "severity": "Low",
- "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "severity": "Medium",
+ "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
"service": "AVS",
- "severity": "Low",
- "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "severity": "Medium",
+ "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
"service": "AVS",
- "severity": "Low",
- "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "severity": "High",
+ "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Limit use of CloudAdmin account to emergency access only",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Is East-West traffic filtering implemented within NSX-T",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "graph": "resources| where type =~ 'Microsoft.Network/virtualNetworkGateways'| mv-expand ipConfigurations=properties.ipConfigurations| project subnetId=tostring(ipConfigurations.properties.subnet.id)| where isnotempty(subnetId)| join (resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | project id, compliant = (enableDdosProtection == 'true')",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
"service": "AVS",
- "severity": "Low",
- "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
"service": "AVS",
- "severity": "Low",
- "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
"service": "AVS",
- "severity": "Low",
- "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
"service": "AVS",
- "severity": "Low",
- "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "severity": "Medium",
+ "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
"service": "AVS",
- "severity": "Low",
- "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "severity": "Medium",
+ "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
"waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
"service": "AVS",
"severity": "Medium",
- "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "waf": "Performance"
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
"service": "AVS",
- "severity": "Medium",
- "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
+ "waf": "Cost"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
"service": "AVS",
"severity": "Medium",
- "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "waf": "Performance"
+ "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
"service": "AVS",
- "severity": "Medium",
- "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "severity": "High",
+ "text": "Ensure all required resource reside within the same Azure availability zone(s)",
"waf": "Performance"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
"service": "AVS",
"severity": "Medium",
- "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "waf": "Performance"
+ "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
"service": "AVS",
"severity": "Medium",
- "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "waf": "Operations"
+ "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
"service": "AVS",
"severity": "High",
- "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Reliability"
+ "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
"service": "AVS",
- "severity": "High",
- "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
"service": "AVS",
"severity": "Medium",
- "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
- "waf": "Performance"
+ "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
"service": "AVS",
"severity": "Medium",
- "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
- "waf": "Performance"
+ "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
"service": "AVS",
"severity": "Medium",
- "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
- "waf": "Reliability"
+ "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
"service": "AVS",
- "severity": "Medium",
- "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
"service": "AVS",
- "severity": "Medium",
- "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
"service": "AVS",
"severity": "Medium",
- "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "waf": "Security"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
"service": "AVS",
"severity": "High",
- "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
- "waf": "Reliability"
+ "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
"service": "AVS",
"severity": "High",
- "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
- "waf": "Reliability"
+ "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "graph": "resources| where type =~ 'Microsoft.AVS/privateClouds'| join kind=leftouter(resources| where type =~ 'Microsoft.Insights/metricalerts'| mv-expand scopes=properties.scopes| mv-expand criteria=properties.criteria.allOf| extend metricName=criteria.metricName| distinct tostring(scopes), tostring(metricName))on $left.id == $right.scopes| extend compliant=toint(metricName in ('UsageAverage', 'EffectiveCpuAverage', 'DiskUsedPercentage'))| summarize compliant=min(compliant) by id",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
"service": "AVS",
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
- "waf": "Reliability"
+ "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "graph": "resources| distinct subscriptionId| join kind=leftouter( resources | where type =~ 'microsoft.insights/activitylogalerts' | mv-expand condition1 = properties.condition.allOf | mv-expand condition2 = condition1.anyOf | extend alertEnabled = tostring(properties.enabled) | summarize set_condition1=make_set(condition1.equals), set_condition2=make_set(condition2.equals) by id, name,type,tenantId,resourceGroup,subscriptionId, alertEnabled | where set_has_element(set_condition1, 'ServiceHealth') | extend category = 'ServiceHealth' | extend all = iff(set_has_element(set_condition1, 'ServiceHealth') and array_length(set_condition2) == 0, true, false) | extend incident = iff(all, true, iff(set_has_element(set_condition1, 'Incident'), true, set_has_element(set_condition2, 'Incident'))) | extend maintenance = iff(all, true, iff(set_has_element(set_condition1, 'Maintenance'), true, set_has_element(set_condition2, 'Maintenance'))) | extend informational = iff(all, true, iff(set_has_element(set_condition1, 'Informational') or set_has_element(set_condition1, 'ActionRequired'), true, set_has_element(set_condition2, 'Informational') or set_has_element(set_condition2, 'ActionRequired'))) | extend security = iff(all, true, iff(set_has_element(set_condition1, 'Security'), true, set_has_element(set_condition2, 'Security'))) | project id, name, subscriptionId, category, tostring(alertEnabled), tostring(incident), tostring(maintenance), tostring(informational), tostring(security) | summarize count_alertEnabled=countif(alertEnabled == 'true'), count_incident=countif(incident == 'True'), count_maintenance=countif(maintenance == 'True'), count_informational=countif(informational == 'True'), count_security=countif(security == 'True') by subscriptionId) on subscriptionId| project subscriptionId, alertEnabled=iff(isnotnull(count_alertEnabled), count_alertEnabled, 0), incident=iff(isnotnull(count_incident), count_incident, 0), security=iff(isnotnull(count_security), count_security, 0), maintenance=iff(isnotnull(count_maintenance), count_maintenance, 0), informational=iff(isnotnull(count_informational), count_informational, 0)| order by incident, maintenance, informational, security desc| project id=subscriptionId, compliant=(alertEnabled > 0 and incident > 0 and security > 0 and maintenance > 0 and informational > 0)",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
"service": "AVS",
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
- "waf": "Reliability"
+ "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
"service": "AVS",
- "severity": "High",
- "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "High",
- "text": "Select the right Function hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
- "service": "Azure Functions",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
"severity": "Medium",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"severity": "High",
- "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
- "waf": "Reliability"
+ "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
"severity": "Medium",
- "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
- "waf": "Reliability"
+ "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"severity": "Medium",
- "text": "Follow reliability support recommendations in Azure Bot Service",
- "waf": "Reliability"
+ "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"severity": "Medium",
- "text": "Deploying bots with local data residency and regional compliance",
- "waf": "Reliability"
+ "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
"severity": "Medium",
- "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
- "waf": "Reliability"
+ "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
"severity": "Medium",
- "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
- "waf": "Reliability"
+ "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
"severity": "Medium",
- "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"severity": "Medium",
- "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
"severity": "Medium",
- "text": "Use more than 1 app instance for your apps",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
- "severity": "Medium",
- "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"severity": "Medium",
- "text": "Set up autoscaling in Spring Cloud Gateway",
+ "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
- "severity": "Low",
- "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
"severity": "Medium",
- "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
"severity": "Medium",
- "text": "Consider the 'Azure security baseline for storage'",
- "waf": "Security"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ('Succeeded') or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') | extend compliant = (isnotnull(properties.privateEndpointConnections) and properties.privateEndpointConnections[0].properties.provisioningState == 'Succeeded' and properties.publicNetworkAccess == 'Disabled') | distinct id, compliant",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider using private endpoints for Azure Storage",
- "waf": "Security"
+ "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
"severity": "Medium",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
- "waf": "Security"
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | project storageAccountId = id | join kind=leftouter (resourceContainers | where type == 'microsoft.security/pricings' | where name == 'StorageAccounts' | project resourceId = id, pricingTier = properties.pricingTier) on $left.storageAccountId == $right.resourceId | where isnull(pricingTier) or pricingTier != 'Standard' | extend compliant = false | distinct storageAccountId, compliant",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Enable Microsoft Defender for all of your storage accounts",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Deploy your backup solution outside of vSan, on Azure native components",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Enable 'soft delete' for blobs",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Disable 'soft delete' for blobs",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For manual deployments, all configuration and deployments must be documented",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Enable 'soft delete' for containers",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Disable 'soft delete' for containers",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Enable resource locks on storage accounts",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider immutable blobs",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (properties.supportsHttpsTrafficOnly == false) | distinct id, compliant",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "severity": "High",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Enforce the latest TLS version for a storage account",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
+ "severity": "Low",
+ "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Use Microsoft Entra ID tokens for blob access",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"severity": "Medium",
- "text": "Least privilege in IaM permissions",
- "waf": "Security"
+ "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "High",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
"severity": "Medium",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
- "waf": "Security"
+ "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Consider configuring an SAS expiration policy",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
+ "severity": "High",
+ "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "Consider linking SAS to a stored access policy",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
+ "severity": "High",
+ "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"severity": "Medium",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
- "waf": "Security"
+ "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Strive for short validity periods for ad-hoc SAS",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"severity": "Medium",
- "text": "Apply a narrow scope to a SAS",
- "waf": "Security"
+ "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"severity": "Medium",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
- "waf": "Security"
+ "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "Low",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
+ "severity": "Medium",
+ "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
"severity": "High",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
- "waf": "Security"
+ "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
- "severity": "Medium",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
- "waf": "Security"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
"severity": "High",
- "text": "Avoid overly broad CORS policies",
- "waf": "Security"
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"severity": "High",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
+ "severity": "High",
+ "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Determine which/if platform encryption should be used.",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Determine which/if client-side encryption should be used.",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Anonymous access may present a security risk. We recommend that you disable anonymous access for optimal security. Disallowing anonymous access helps to prevent data breaches caused by undesired anonymous access.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"severity": "High",
- "text": "Leverage a storagev2 account type for better performance and reliability",
- "waf": "Reliability"
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "graph": "resources | where type =~ 'Microsoft.Storage/StorageAccounts' | extend compliant = (sku.name != 'Standard_LRS' and sku.name != 'Premium_LRS') | distinct id, compliant",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
- "severity": "High",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
- "waf": "Reliability"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
+ "severity": "Medium",
+ "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "For write operation after failover, use customer-Managed Failover ",
- "waf": "Reliability"
+ "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Understand Microsoft-Managed Failover details",
- "waf": "Reliability"
+ "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Enable Soft Delete",
+ "text": "Leverage FTA Resillency HandBook",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"severity": "High",
- "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "text": "Leverage Availability Zones if regionally applicable",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "text": "Use the Premium or Dedicated SKUs for predicable performance",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"severity": "High",
- "text": "Leverage Availability Zones by enabling read and/or write replicas",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "Medium",
- "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "text": "For Business Critical Applications, use Active Active configuration",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "Medium",
- "text": "Use Azure Traffic Manager to coordinate requests",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
- "severity": "High",
- "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "text": "Design Resilient Event Hubs",
"waf": "Reliability"
},
{
@@ -7216,3942 +7590,4156 @@
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
- "query": "resources | where type =~ 'Microsoft.App/managedEnvironments' | project name, resourceGroup, location, zoneRedundancy = tolower(tostring(properties.zoneRedundant)) | extend Compliance = iff(zoneRedundancy == 'true', true, false)",
- "service": "Container Apps",
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
- "query": "resources | where type =~ 'Microsoft.App/containerApps' | project name, resourceGroup, location, minReplicas = toint(properties.template.scale.minReplicas), maxReplicas = toint(properties.template.scale.maxReplicas) | extend Compliance = iff(minReplicas >= 1, true, false)",
- "service": "Container Apps",
- "severity": "High",
- "text": "Use more than one replica and enable Zone Redundancy.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
- "severity": "High",
- "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.App/containerApps",
- "checklist": "Container Apps Review",
- "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
- "severity": "High",
- "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "FTA Resiliency Playbook",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
- "severity": "High",
- "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Run multiple replicas of the database (>1 ) in Prod",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
- "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
- "service": "CosmosDB",
- "severity": "Medium",
- "text": "Leverage Multi-Region Writes",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Span Cosmos account across two or more regions with multi-region writes",
- "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Distribute your data globally",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
- "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
- "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
- "service": "CosmosDB",
- "severity": "High",
- "text": "Choose from several well-defined consistency models",
+ "text": "Use Standard SKU for production scenarios.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
- "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
- "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
- "service": "CosmosDB",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
+ "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Enable Service managed failover",
+ "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
- "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
- "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
- "service": "CosmosDB",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
+ "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Enable Automatic Backups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
- "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
- "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
- "service": "CosmosDB",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Perform Periodic Backups",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "CosmosDB Review Checklist",
- "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
- "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
- "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
- "service": "CosmosDB",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
+ "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
+ "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "check backup instances with the underlying datasource not found",
+ "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
"waf": "Cost"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
- "waf": "Cost"
+ "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
+ "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Cost"
+ "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "001cbb6f-d88d-4431-8434-d01333397776",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Cost"
+ "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Cost"
+ "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
+ "link": "",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Cost"
+ "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
+ "link": "",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "Make sure advisor is configured for VM right sizing ",
- "waf": "Cost"
+ "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "check by searching the Meter Category Licenses in the Cost analysys",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
+ "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
- "waf": "Cost"
+ "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
+ "checklist": "Azure Service Fabric Review Checklist",
+ "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
+ "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
+ "service": "Azure Service Fabric",
"severity": "Medium",
- "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Cost"
+ "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Cost"
+ "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
- "waf": "Cost"
+ "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "Only larger disks can be reserved => 1 TiB -",
- "waf": "Cost"
+ "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"severity": "Medium",
- "text": "After the right-sizing optimization",
- "waf": "Cost"
+ "text": "Use more than 1 app instance for your apps",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
+ "severity": "Medium",
+ "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
+ "severity": "Medium",
+ "text": "Set up autoscaling in Spring Cloud Gateway",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "Low",
+ "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
+ "severity": "Medium",
+ "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Cost"
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
- "waf": "Cost"
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
+ "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Consider using a VMSS to match demand rather than flat sizing",
- "waf": "Cost"
+ "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
- "severity": "Medium",
- "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
- "waf": "Cost"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "severity": "High",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
- "waf": "Cost"
+ "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"severity": "Medium",
- "text": "Functions - Reuse connections",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Cost"
+ "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
- "severity": "Medium",
- "text": "Functions - Cache data locally",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "32d41e36-11c8-417b-8afb-c410d4391898",
+ "service": "Azure Synapse Analytics",
+ "severity": "High",
+ "text": "Restrict use of local users on sql workloads on Synapse",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "cd289bed-6b17-4cb8-8454-61e1aee3453a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/synapse-service-identity?context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
- "severity": "Medium",
- "text": "Functions - Keep your functions warm",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Cost"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "ec823923-7a15-42d6-ac5e-402925388e5d",
+ "service": "Azure Synapse Analytics",
+ "severity": "High",
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse also includes Synapse role-based access control (RBAC) roles to manage different aspects of Synapse Studio. Leverage these built-in roles to assign permissions to users, groups, or other security principals to manage who can Publish code artifacts and list or access published code artifacts,Execute code on Apache Spark pools and integration runtimes,Access linked (data) services that are protected by credentials,Monitor or cancel job executions, review job output and execution logs.",
+ "guid": "a9c27d9c-42bb-46cd-8c79-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-understand-what-role-you-need",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
- "waf": "Cost"
+ "text": "Use Azure RBAC to control access on storage and Synapse RBAC to control access on workspace level depending on the personas of the team to fine grain the access on data and compute",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "7f42c78e-78cb-46a2-8ad1-a0916e6a8d8f",
+ "link": "https://learn.microsoft.com/sql/relational-databases/security/row-level-security?view=sql-server-ver16&context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
- "waf": "Cost"
+ "text": "Implement RLS, CLS and data masking on sql workloads in dedicated sql pool to add additional layer of security",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create your Azure Synapse workspace, you can choose to associate it to a Microsoft Azure Virtual Network. The Virtual Network associated with your workspace is managed by Azure Synapse. This Virtual Network is called a Managed workspace Virtual Network. This can be selected when deploying a workspace",
+ "guid": "e2436b03-36db-455e-8796-0eee0bdf4cc2",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-vnet?view=sql-server-ver16",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Cost"
+ "text": "Use managed vnet workspace to restrict the access over public internet",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "To protect any sensitive data, it's recommended to disable public access to the workspace endpoints entirely. By doing so, it ensures all workspace endpoints can only be accessed using�private endpoints.",
+ "guid": "efc4d761-c31d-425f-bbb4-7a393a040ed3",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-managed-private-endpoints?view=sql-server-ver16",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
- "waf": "Cost"
+ "text": "Configure private endpoints to connect to the external services and disable public access",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "severity": "Medium",
- "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If public access needs to be enabled, it's highly recommended to configure the IP firewall rules to allow inbound connections only from the specified list of public IP addresses.",
+ "guid": "294798b1-178a-42c5-a46c-eb544350d092",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/synapse-workspace-ip-firewall",
+ "service": "Azure Synapse Analytics",
+ "text": "If enabling public access highly recommended to configure IP firewall rules",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "d234292b-7528-4537-a551-c5bf4e4f1854",
+ "link": "https://learn.microsoft.com/azure/data-factory/create-self-hosted-integration-runtime?tabs=data-factory",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Consider archiving tiers for less used data",
- "waf": "Cost"
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This can be done only when deploying the workspace, but Python libraries installed from public repositories like PyPI are not supported. (Think about the limitation before enabling it)",
+ "guid": "287d5cdc-126c-4c03-8af5-b1fc6898a535",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/how-to-create-a-workspace-with-data-exfiltration-protection",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
- "waf": "Cost"
+ "text": "Enable Data Exfiltration Protection (DEP)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "First layer of encryption is done by Microsoft managed keys, you can add a second layer of encryption using Customer managed Keys",
+ "guid": "e337897e-31b6-47d6-9be5-962a1193846d",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/security/workspaces-encryption",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "Consider using standard SSD rather than Premium or Ultra where possible",
- "waf": "Cost"
+ "text": "Data Encryption at rest using Customer managed Keys for workspace",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Synapse leverages TLS to ensure data is encrypted in motion. SQL dedicated pools support TLS 1.0, TLS 1.1, and TLS 1.2 versions for encryption wherein Microsoft-provided drivers use TLS 1.2 by default. Serverless SQL pool and Apache Spark pool use TLS 1.2 for all outbound connections.",
+ "guid": "697cc391-ed16-4b2d-886f-0a1241bddde6",
+ "link": "https://learn.microsoft.com/azure/synapse-analytics/guidance/security-white-paper-data-protection#data-in-transit",
+ "service": "Azure Synapse Analytics",
"severity": "Medium",
- "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
- "waf": "Cost"
+ "text": "Data Encryption in transit ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "severity": "Medium",
- "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
- "waf": "Cost"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Keyvaults to store your secrets and credentials",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25e4d5",
+ "service": "Azure Synapse Analytics",
+ "severity": "High",
+ "text": "Store passwords, secerts and keys in Azure key vault",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Restrict the use of local authentication methods for data plane access. Instead, use Microsoft Entra ID as the default authentication method to control your data plane access.",
+ "guid": "0bdf4cc2-efc4-4d76-8c31-d25ffbb47a39",
+ "service": "Azure Data Factory",
+ "severity": "High",
+ "text": "Restrict use of local users whereever necessary",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed identities eliminate the need to manage credentials. Managed identities provide an identity for the service instance when connecting to resources that support Microsoft Entra authentication.",
+ "guid": "3a040ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://learn.microsoft.com/azure/data-factory/data-factory-service-identity",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Storage accounts: check hot tier and/or GRS necessary",
- "waf": "Cost"
+ "text": "Use managed identity to authenticate to the services",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "severity": "Medium",
- "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
- "waf": "Cost"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If not required for routine administrative operations, disable or restrict any local admin accounts for only emergency use.",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "service": "Azure Data Factory",
+ "severity": "High",
+ "text": "Separate and limit highly privileged/administrative users and enable MFA and conditional policies",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6898a535-e337-4897-b31b-67d67be5962a",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
- "waf": "Cost"
+ "text": "Deploy SHIR VMs in your vnet if you are working with sensitive data that shouldn�t leave your corporate network",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you create an Azure integration runtime within a Data Factory managed virtual network, the integration runtime is provisioned with the managed virtual network. It uses private endpoints to securely connect to supported data stores.",
+ "guid": "1193846d-697c-4c39-8ed1-6b2d186f0a12",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Export cost data to a storage account for additional data analysis.",
- "waf": "Cost"
+ "text": "Use managed vnet IR to restrict the access over public internet for Azure Integration Runtime",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Managed private endpoints are private endpoints created in the Data Factory managed virtual network that establishes a private link to Azure resources. Data Factory manages these private endpoints on your behalf.",
+ "guid": "41bddde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/data-factory/managed-virtual-network-private-endpoint#managed-private-endpoints",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
- "waf": "Cost"
+ "text": "Configure managed private endpoints to connect to resources using managed azure IR",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "6ceb5443-5135-4922-9442-93bb628637a5",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
- "waf": "Cost"
+ "text": "Data Encryption at rest by Microsoft managed keys",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This is a default setting",
+ "guid": "5119b08e-8f58-4543-a7e9-cec166cd072a",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Create multiple Apache Spark pool definitions of various sizes.",
- "waf": "Cost"
+ "text": "Data Encryption in transit by Microsoft managed keys",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "When you specify a customer-managed key, Data Factory uses�both�the factory system key and the CMK to encrypt customer data. Missing either would result in Deny of Access to data and factory.",
+ "guid": "f9b241a9-98a5-435e-9378-97e71ca7da8c",
+ "link": "https://learn.microsoft.com/azure/data-factory/enable-customer-managed-key",
+ "service": "Azure Data Factory",
"severity": "Medium",
- "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "text": "Data Encryption in transit by BYOK (Customer managed keys)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "faa62a15-9495-46da-a7dc-3a23267b2258",
+ "link": "https://learn.microsoft.com/azure/data-factory/store-credentials-in-key-vault, https:/learn.microsoft.com/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities",
+ "service": "Azure Data Factory",
+ "severity": "High",
+ "text": "Store passwords, secrets in Azure Key Vault",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6db55f57-9603-4334-adf9-cc23418db612",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "text": "Define roles and responsibilities to manage Microsoft Purview in control plane and data plane",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Azure RBACs for this",
+ "guid": "8126504b-b47a-4393-a080-427294798b15",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Right-sizing all VMs",
- "waf": "Cost"
+ "text": "Define roles and tasks required to deploy and manage Microsoft Purview inside an Azure subscription (control plane)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Use Microsoft Purview roles for this.",
+ "guid": "78b219a4-6ceb-4544-9513-5922744293bb",
+ "link": "https://learn.microsoft.com/purview/classic-data-governance-permissions#roles, https://learn.microsoft.com/azure/role-based-access-control/best-practices",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Swap VM sized with normalized and most recent sizes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "text": "Define roles and task needed to perform data management and governance using Microsoft Purview. (Data plane for Data Map and Data Catalog.)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "628637a5-5119-4b08-b8f5-854387e9cec1",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "text": "Assign roles to Microsoft Entra groups instead of assigning roles to individual users.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "66cd072a-f9b2-441a-a98a-535e737897e7",
+ "link": "https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-overview",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Containerizing an application can improve VM density and save money on scaling it",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Cost"
+ "text": "Use Azure�Active Directory Entitlement Management�to map user access to Microsoft Entra groups using Access Packages.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "1ca7da8c-faa6-42a1-9949-56da97dc3a23",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "text": "Enforce multifactor authentication for Microsoft Purview users, especially, for users with privileged roles such as collection admins, data source admins or data curators.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "267b2258-6f4a-4165-8bdd-dea8a487cdec",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
+ "text": "Use Microsoft Entra ID to provide authentication and authorization to all users, security groups registered in Entra, service principal and managed identities inside collections in Microsoft Purview",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "4861bc3b-c14a-4eb7-b66e-8d9a3bec218e",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6436b173-6db5-45f5-9960-3334bdf9cc23",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Enable�end-to-end network isolation�using Private Link Service. (Microsoft Purview Data Map)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "418db612-8126-4504-ab47-a393a0804272",
+ "link": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
- "waf": "Operations"
+ "text": "Use�Microsoft Purview Firewall�to disable Public access. (Microsoft Purview Data Map)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
- "waf": "Reliability"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "94798b15-78b2-419a-96ce-b54435135922",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Deploy�Network Security Group (NSG) rules�for subnets where Azure data sources private endpoints, Microsoft Purview private endpoints and self-hosted runtime VMs are deployed. (Microsoft Purview Data Map)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "744293bb-6286-437a-9511-9b08e8f58543",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Implement Microsoft Purview with private endpoints managed by a Network Virtual Appliance, such as�Azure Firewall�for network inspection and network filtering. (Microsoft Purview Data Map)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "This private endpoint is also a prerequisite for the portal private endpoint. The Microsoft Purview�portal�private endpoint is required to enable connectivity to Microsoft Purview governance portal using a private network. Microsoft Purview can scan data sources in Azure or an on-premises environment by using ingestion private endpoints. Limitations on using private endpoints https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "87e9cec1-66cd-4072-af9b-241a998a535e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-network",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Deploy private endpoints for Microsoft Purview accounts to add another layer of security, so only client calls that are originated from within the virtual network are allowed to access the Microsoft Purview account",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "Device Update Review",
- "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Device Update for IoT Hub",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/catalog-private-link-end-to-end#firewalls-to-restrict-public-access. Limitation to be reviewed: https://learn.microsoft.com/purview/catalog-private-link-troubleshoot",
+ "guid": "b7bcdb3b-51eb-42ec-84ed-a6e59d8d9a2e",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Block public access using Microsoft Purview firewall",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "db217e67-6abf-4669-aa48-e5a96f2223ec",
+ "link": "https://learn.microsoft.com/azure/private-link/disable-private-endpoint-network-policy, https:/learn.microsoft.com/purview/concept-best-practices-security#use-network-security-groups",
+ "service": "Microsoft Purview",
+ "severity": "Medium",
+ "text": "Use Network Security Groups to filter network traffic to and from Azure resources in an Azure virtual network",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-security#apply-security-best-practices-for-self-hosted-runtime-vms",
+ "guid": "e8cb1231-8ca5-4017-b158-e3fb3aa3c2de",
+ "service": "Microsoft Purview",
+ "severity": "High",
+ "text": "If you have sensitive data that cannot leave the boundary of your on-prem vnet it is highly recommended to use SHIR VMs inside your corporate vnet to extract your metadata ",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Metadata is extracted and stored in Microsoft Purview Data Map, if you are not using managed storage account for your Purview account they are open to be accessed by all so implement proper RBACs and retrict the access of Data to only intended users. Applicable to Accounts deployed after December 15, 2023 (or deployed using API version 2023-05-01-preview onwards",
+ "guid": "7f3165c3-a87a-405b-9a20-9949bda47778",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "Use Azure RBACs to restrict the access of your storage account (not managed by MS) only to intended users.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "f24d1167-85c2-4fa5-9c56-a948008be7d7",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "text": "Data in rest is encrypted by microsoft managed keys",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "27f7b9e9-1be1-4f38-aff3-9812bd463cbb",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "Data in transit is encrypted by TLS 1.3",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "bc8ac199-ebb9-41a4-9d90-dae2cc881370",
+ "service": "Microsoft Purview",
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Always use Azure key vaults to store all credentials if not using managed identities or without password need methods",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "6f7c0cba-fe61-4465-add4-57e927139b82",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "Prevent accidental deletion of Microsoft Purview accounts by applying resource Locks",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "https://learn.microsoft.com/purview/concept-best-practices-collections#design-recommendations",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4722d928",
+ "link": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "Plan for a break glass strategy for your Microsoft Entra tenant, Azure subscription and Microsoft Purview accounts to prevent tenant-wide account lockout.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "guid": "15f51296-5398-4e6d-bd23-7dd142b16c21",
+ "service": "Microsoft Purview",
"severity": "Medium",
- "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Integrate with Microsoft 365 and Microsoft Defender for Cloud",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
- "severity": "Medium",
- "text": "Leverage FTA Resillency HandBook",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Separate admin accounts from normal user accounts.",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "service": "Azure Databricks",
+ "severity": "High",
+ "text": "Define Least Privilege model and Lower exposure of privileged accounts",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Databricks supports Microsoft Entra ID conditional access, which allows administrators to control where and when users are permitted to sign in to Azure Databricks. Conditional access policies can restrict sign-in to your corporate network or can require multi-factor authentication (MFA).",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/#single-sign-on",
+ "service": "Azure Databricks",
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "text": "Configure single sign-on and unified login. Enable multi-factor authentication.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Customers can use the Token Management API or UI controls to enable or disable personal access tokens (PATs) for REST API authentication, limit the users who are allowed to use PATs, set the maximum lifetime for new tokens, and manage existing tokens. Highly-secure customers typically provision a maximum token lifetime for new tokens for a workspace. This feature requires the Premium pricing tier.",
+ "guid": "352beee0-79b5-488d-bfc5-972cd4cd21b0",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/access-control/tokens",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Use the Premium or Dedicated SKUs for predicable performance",
- "waf": "Reliability"
+ "text": "Use token management.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "If you have Databricks administrators who are also normal users of the Databricks platform (for example, there�s a lead data engineer who administers the platform and also does data engineering work), Databricks recommends creating a separate account for administrative tasks. It�s important to note that as part of the Azure RBAC model, users that are given Contributor or above permissions to the Resource Group for a deployed Azure Databricks workspace automatically become administrators when they login to that workspace. Therefore, the same considerations outlined above should be applied to Azure portal users too.",
+ "guid": "77036e5e-6b4b-4fd3-b503-547c1447dc56",
+ "service": "Azure Databricks",
"severity": "High",
- "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
- "waf": "Reliability"
+ "text": "Separate admin accounts from normal user accounts",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "SCIM (System for Cross-domain Identity Management) allows you to sync users and groups from Microsoft Entra ID to Azure Databricks. There are three major benefits of this approach: 1. When you remove a user, the user is automatically removed from Databricks. 2. Users can also be disabled temporarily via SCIM. Customers have used this capability for scenarios where customers believe that an account may be compromised and need to investigate 3. Groups are automatically synchronized Please refer to the documentation for detailed instructions on how to configure SCIM for Azure Databricks. This feature requires the Premium pricing tier",
+ "guid": "028a71ff-f1ce-415d-b3f0-d5e872d42e36",
+ "link": "https://learn.microsoft.com/azure/databricks/admin/users-groups/scim/",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "For Business Critical Applications, use Active Active configuration",
- "waf": "Reliability"
+ "text": "SCIM synchronization of users and groups.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Using either cluster policies or the older cluster ACLs, admins can define what users or groups within the organization are able to create clusters. Cluster ACLs allow you to specify which users can attach a notebook to a given cluster. Note that if a user shares a notebook already attached to a standard mode cluster, the recipient will also be able to execute code on that cluster. This does not apply to clusters that enforce user isolation: SQL Warehouses, high concurrency with table ACLs clusters, and high concurrency with credential passthrough clusters. Customers who use Unity Catalog can also enable single-user clusters to enforce isolation clusters.",
+ "guid": "11cc57b4-a4b1-4410-b43a-58a9c2289b3d",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Design Resilient Event Hubs",
- "waf": "Reliability"
+ "text": "Limit cluster creation rights.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
- "severity": "Medium",
- "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It�s important to note that even if customers use Azure Key Vault to store their secrets, access controls still need to be defined within Azure Databricks. This is because the same service identity is used to retrieve the secret for all users of an Azure Databricks workspace.",
+ "guid": "8b662d6c-15f5-4129-9539-8e6ded237dd1",
+ "service": "Azure Databricks",
+ "severity": "High",
+ "text": "Store passwords, secrets in Azure Key Vault",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Clusters with user isolation include enforcement such that each user runs as a different non-privileged user account on the cluster host. Languages are also limited to those that can be implemented in an isolated manner (SQL and Python), and Spark APIs must be on an allowlist of those we believe to be isolation-safe.",
+ "guid": "78c06a73-a22a-4495-9e7a-8dc4a20e27c3",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
- "waf": "Reliability"
+ "text": "Use clusters that support user isolation.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "It is against security best practices to tie production workloads to individual user accounts, and so we recommend configuring Service Principals within Databricks. Service Principles separate administrator and user actions from the workload and prevent workloads from being impacted if a user leaves an organization. With Databricks, you can configure jobs to run as service principals and generate Personal Access Tokens for Service Principals.",
+ "guid": "e29711b1-352b-4eee-879b-588defc5972c",
+ "link": "https://learn.microsoft.com/azure/databricks/security/auth/access-control/",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Custom brand assets should be hosted on a CDN",
- "waf": "Performance"
+ "text": "Use service principals to run production jobs. Use proper access control for workspace level (ACLs), account level (RBACs) and data level (Unity catalog) security controls",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "Low",
- "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "By default, DBFS is a filesystem that is accessible to all users of the given workspace and can be accessed via API. This is not necessarily a major data exfiltration concern as you can limit access to accessing data via the DBFS API or Databricks cli using IP access lists or private network access. However, as use of Azure Databricks grows and more users join a workspace, those users would have access to any data stored in DBFS, creating the potential for undesired information sharing. Databricks recommends that our customers do not store production data in DBFS.",
+ "guid": "d4cd21b0-7703-46e5-b6b4-bfd3d503547c",
+ "service": "Azure Databricks",
+ "severity": "High",
+ "text": "Avoid storing production data in DBFS.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "For the storage accounts that you manage, it is your responsibility to ensure that the storage accounts are protected according to your requirements. Examples might include: Encryption with your customer-managed key, Restrict access to trusted networks with a storage firewall, Anonymous public access is not allowed",
+ "guid": "1447dc56-028a-471f-bf1c-e15dd3f0d5e8",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
- "waf": "Reliability"
+ "text": "Encrypt storage and restrict access.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Add a customer-managed key for select data stored within the Azure Databricks control plane, such as notebooks, secrets, Databricks SQL queries, and Databricks SQL query history and for the root storage account used for DBFS. Azure Databricks requires access to this key for ongoing operations. You can revoke access to the key to prevent Azure Databricks from accessing encrypted data within the control plane (or in our backups). This is like a �nuclear option� where the workspace ceases to function, but it provides an emergency control for extreme situations. This feature requires the Premium pricing tier.",
+ "guid": "72d42e36-11cc-457b-9a4b-1410e43a58a9",
+ "link": "https://learn.microsoft.com/azure/databricks/security/keys/customer-managed-keys",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Don't replicate! Replication can create issues with directory synchronization",
- "waf": "Reliability"
+ "text": "Add a customer-managed key for managed services and workspace storage",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Configure IP access lists that restrict the IP addresses that can authenticate to Databricks at account console and workspace level by checking if the user or API client is coming from a known good IP address range such as a VPN or office network. Established user sessions do not work if the user moves to a bad IP address, such as when disconnecting from the VPN. ",
+ "guid": "277de183-b1ac-4252-a9a9-b64608489a8f",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/front-end/ip-access-list",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Have active-active for multi-regions",
- "waf": "Reliability"
+ "text": "Enable IP access lists to restrict access to certain IP addresses.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Use the 'Import latest checklist' button to get the latest version of a review checklist",
+ "description": "Azure Private Link provides a private network route from one Azure environment to another. Private Link can be configured both between Azure Databricks users and the control plane, and also between the control plane and the data plane. Between Databricks users and the control plane, Private Link provides strong controls that limit the source for inbound requests. If a company already routes traffic through an Azure environment, they can use Private Link so that the communication between users and the Azure Databricks control plane does not traverse public IP addresses. This feature requires the Premium pricing tier. Use Azure Private Link to connect from Azure Databricks to your Azure resources. Not only does Private Link ensure",
+ "guid": "82db8eb9-d1ba-473b-86a5-a57eba8dd4b3",
+ "link": "https://learn.microsoft.com/azure/databricks/security/network/classic/private-link",
+ "service": "Azure Databricks",
"severity": "Medium",
- "text": "Add Azure AD Domain service stamps to additional regions and locations",
- "waf": "Reliability"
+ "text": "Configure and use Azure Private Link to access Azure resources.",
+ "waf": "Security"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"severity": "Medium",
- "text": "Use Replica Sets for DR",
+ "text": "Leverage Flexible Server",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"severity": "Medium",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.",
+ "text": "Leverage Data-in replication for cross-region DR scenarios",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Ensure you are using Application Gateway v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "High",
- "text": "Learn how to trigger a manual failover.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
+ "severity": "Medium",
+ "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
- "severity": "High",
- "text": "Learn how to fail back after a failover.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
+ "severity": "Medium",
+ "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "High",
- "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
- "waf": "Reliability"
+ "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/application-gateway/tutorial-protect-application-gateway-ddos",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
- "waf": "Reliability"
+ "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "text": "Configure autoscaling with a minimum amount of instances of two.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "text": "Deploy Application Gateway across Availability Zones",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "High",
- "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
+ "severity": "Medium",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "Low",
- "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
+ "severity": "High",
+ "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "Low",
- "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
- "waf": "Reliability"
+ "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Low",
- "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
- "waf": "Reliability"
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
+ "severity": "High",
+ "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
- "severity": "Medium",
- "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
+ "severity": "High",
+ "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
"severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
+ "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
"severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
+ "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
"severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "Leverage Flexible Server",
- "waf": "Reliability"
+ "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "Leverage Data-in replication for cross-region DR scenarios",
- "waf": "Reliability"
+ "text": "Use WAF Policies instead of the legacy WAF configuration.",
+ "waf": "Operations"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
"service": "App Gateway",
"severity": "Medium",
- "text": "Ensure you are using Application Gateway v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
- "severity": "Medium",
- "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways'| extend compliant = (properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443') |where properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443'|distinct id,name,compliant",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
+ "severity": "High",
+ "text": "You should encrypt traffic to the backend servers.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
- "severity": "Medium",
- "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
+ "severity": "High",
+ "text": "You should use a Web Application Firewall.",
"waf": "Security"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
"service": "App Gateway",
"severity": "Medium",
- "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Redirect HTTP to HTTPS",
"waf": "Security"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
"service": "App Gateway",
"severity": "Medium",
- "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
+ "severity": "High",
+ "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
"waf": "Security"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/application-gateway/tutorial-protect-application-gateway-ddos",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
+ "severity": "Low",
+ "text": "Create custom error pages to display a personalized user experience",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
"service": "App Gateway",
"severity": "Medium",
- "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
"waf": "Security"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
"service": "App Gateway",
"severity": "Medium",
- "text": "Configure autoscaling with a minimum amount of instances of two.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
"service": "App Gateway",
"severity": "Medium",
- "text": "Deploy Application Gateway across Availability Zones",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "Use transport layer load balancing",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
- "severity": "High",
- "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
+ "severity": "Medium",
+ "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "waf": "Security"
},
{
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"severity": "Low",
- "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
"waf": "Security"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
"severity": "Medium",
- "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Security"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "High",
- "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
+ "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
"waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
- "severity": "High",
- "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
- "waf": "Security"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | extend compliant = (properties['policySettings']['requestBodyCheck'] == 'true' and properties['policySettings']['state'] =~ 'Enabled') | distinct id, name, compliant",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
- "severity": "High",
- "text": "Ensure if request body inspection feature is enabled in Azure Application Gateway WAF policy.",
- "waf": "Security"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
- "severity": "High",
- "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
- "waf": "Security"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "waf": "Reliability"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"severity": "High",
- "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
- "waf": "Security"
+ "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "Low",
+ "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
- "waf": "Security"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Low",
+ "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
- "waf": "Security"
+ "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
- "waf": "Security"
+ "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ "text": "RBAC is recommended to control access to your key vault. Familiarize yourself with the Key Vault's access control guidance.",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
"severity": "Medium",
- "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
- "waf": "Operations"
+ "text": "Deploy your Azure landing zone connectivity resources in multiple regions, so that you can quickly support multi-region application landing zones and disaster recovery scenarios.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"severity": "Medium",
- "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "Low",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Use WAF Policies instead of the legacy WAF configuration.",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
- "waf": "Security"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways'| extend compliant = (properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443') |where properties['backendHttpSettingsCollection'][0]['properties']['port'] =~ '443'|distinct id,name,compliant",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"severity": "High",
- "text": "You should encrypt traffic to the backend servers.",
- "waf": "Security"
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
"severity": "High",
- "text": "You should use a Web Application Firewall.",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"severity": "Medium",
- "text": "Redirect HTTP to HTTPS",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
"severity": "Medium",
- "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
- "waf": "Operations"
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"severity": "High",
- "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
- "severity": "Low",
- "text": "Create custom error pages to display a personalized user experience",
- "waf": "Operations"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
"severity": "Medium",
- "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "Medium",
- "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
- "waf": "Performance"
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "Medium",
- "text": "Use transport layer load balancing",
- "waf": "Performance"
+ "text": "When using Microsoft Entra Domain Services use replica sets. Replica sets will improve the resiliency of your managed domain and allow you to deploy to additional regions. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"severity": "Medium",
- "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
- "severity": "Medium",
- "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout. MFA will be turned on by default for all users in Oct 2024. We recommend updating these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "Low",
- "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
- "service": "PostgreSQL",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"severity": "Medium",
- "text": "Leverage Flexible Server",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
- "service": "PostgreSQL",
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
- "waf": "Reliability"
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
- "checklist": "PostgreSQL Review Checklist",
- "guid": "31b67c67-be59-4519-8083-845d587cb391",
- "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
- "service": "PostgreSQL",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"severity": "Medium",
- "text": "Leverage cross-region read replicas for BCDR",
- "waf": "Reliability"
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
- "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
- "service": "Purview",
- "severity": "Medium",
- "text": "Leverage FTA Resillency Handbook",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"severity": "High",
- "text": "Plan for Data Center level outage",
- "waf": "Reliability"
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
- "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"severity": "Medium",
- "text": "Practice Failover for BCDR",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
- "severity": "High",
- "text": "Plan a backup strategy and take regular backups",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "Low",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
- "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
"severity": "Low",
- "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
- "waf": "Reliability"
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
- "link": "https://learn.microsoft.com/purview/deployment-best-practices",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"severity": "Medium",
- "text": "Follow Purview accounts architectures and deployment best practices",
- "waf": "Reliability"
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"severity": "Medium",
- "text": "Follow Collection Architectures and best practices",
- "waf": "Reliability"
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "Medium",
- "text": "Follow Assest lifecycle best practices",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "Medium",
- "text": "Follow automation best practices",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Backup and Migration Best practices",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Purview Glossary Best Practices",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "High",
+ "text": "Use Standard Load Balancer SKU with a zone-redundant deployment, Selecting Standard SKU Load Balancer enhances reliability through availability zones and zone resiliency, ensuring deployments withstand zone and region failures. Unlike Basic, it supports global load balancing and offers an SLA.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
- "link": "https://learn.microsoft.com/purview/concept-workflow",
- "service": "Purview",
- "severity": "Low",
- "text": "Leverage Workflows ",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "High",
+ "text": "Ensure load balancer backend pool(s) contains at least two instances, Deploying Azure Load Balancers with at least two instances in the backend prevents a single point of failure and supports scalability.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
- "service": "Purview",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Follow Purview Security Best Practices",
- "waf": "Reliability"
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
- "service": "Purview",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Follow Purview Data Lineage Best Practices",
- "waf": "Reliability"
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
- "service": "Purview",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "Medium",
- "text": "Follow Best Practices for Scanning Registered Sources",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
- "service": "Purview",
- "severity": "Medium",
- "text": "Follow Classification Best Practices in Governance Portal",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
+ "severity": "High",
+ "text": "Use Standard SKU and Zone-Redundant IPs when applicable, Public IP addresses in Azure can be of standard SKU, available as non-zonal, zonal, or zone-redundant. Zone-redundant IPs are accessible across all zones, resisting any single zone failure, thereby providing higher resilience. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
- "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"severity": "Medium",
- "text": "Perform Sensitivity Labelling in the Purview Data Map",
- "waf": "Reliability"
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
- "link": "https://learn.microsoft.com/purview/concept-data-share",
- "service": "Purview",
- "severity": "Low",
- "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
"severity": "Low",
- "text": "Leverage Data Estate Insights",
- "waf": "Reliability"
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
- "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Use Data stewardship and Catalog adoption",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "High",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Use Inventory and Ownership",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "Implement a plan for managing DNS resolution between multiple Azure regions and when services fail over to another region",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
- "link": "https://learn.microsoft.com/purview/glossary-insights",
- "service": "Purview",
- "severity": "Low",
- "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
- "link": "https://learn.microsoft.com/purview/compliance-manager",
- "service": "Purview",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"severity": "Medium",
- "text": "Generate assessment scores",
- "waf": "Reliability"
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
- "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
- "service": "Purview",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
"severity": "Medium",
- "text": "Profiling- get summaries of data content",
- "waf": "Reliability"
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
- "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
- "service": "Purview",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"severity": "Low",
- "text": "Follow Microsoft Purview Data Owner access policies",
- "waf": "Reliability"
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
- "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
- "service": "Purview",
- "severity": "Low",
- "text": "Follow Self-service access policies",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "High",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Purview/accounts",
- "checklist": "Microsoft Purview Review Checklist",
- "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
- "link": "https://learn.microsoft.com/purview/concept-policies-devops",
- "service": "Purview",
- "severity": "Low",
- "text": "Follow DevOps policies",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
"severity": "High",
- "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
- "severity": "Medium",
- "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
- "waf": "Reliability"
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
- "checklist": "Resiliency Review",
- "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
- "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
- "service": "VMSS",
- "severity": "Low",
- "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
- "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"severity": "High",
- "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
- "waf": "Reliability"
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
- "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
"severity": "High",
- "text": "Use Premium or Ultra disks for production VMs",
- "waf": "Reliability"
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
- "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
- "service": "VM",
- "severity": "High",
- "text": "Ensure Managed Disks are used for all VMs",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
- "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
- "waf": "Reliability"
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
- "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Leverage Availability Zones for your VMs in regions where they are supported",
- "waf": "Reliability"
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
- "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "VM",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"severity": "Medium",
- "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
- "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "VM",
- "severity": "High",
- "text": "Avoid running a production workload on a single VM",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
+ "severity": "Medium",
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
- "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
"severity": "High",
- "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
- "waf": "Reliability"
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
- "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
- "service": "VM",
- "severity": "Low",
- "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
- "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
- "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
- "service": "VM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Increase quotas in DR region before testing failover with ASR",
- "waf": "Reliability"
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
- "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
- "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
- "service": "VM",
- "severity": "Low",
- "text": "Utilize Scheduled Events to prepare for VM maintenance",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
- "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
- "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "Low",
- "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
- "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
- "severity": "Low",
- "text": "Enable soft delete for Storage Account Containers",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Resiliency Review",
- "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
- "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "Low",
- "text": "Enable soft delete for blobs",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
- "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "service": "Azure Backup",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
- "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
- "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
- "service": "Azure Backup",
- "severity": "Low",
- "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Resiliency Review",
- "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
- "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
- "service": "Azure Backup",
- "severity": "Low",
- "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Resiliency Review",
- "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
- "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "service": "DNS",
- "severity": "Low",
- "text": "Implement DNS Failover using Azure DNS Private Resolvers",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.PowerBI/gateways",
- "checklist": "Resiliency Review",
- "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
- "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
- "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
- "service": "Data Gateways",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
- "waf": "Reliability"
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Resiliency Review",
- "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
- "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
- "severity": "High",
- "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
- "waf": "Reliability"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "Low",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "Operations"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "Medium",
- "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
- "training": "https://github.com/Azure/sap-automation",
- "waf": "Operations"
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
- "severity": "Medium",
- "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
- "severity": "Medium",
- "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
"severity": "High",
- "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "Medium",
- "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
"severity": "High",
- "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Reliability"
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
- "severity": "Low",
- "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"severity": "Medium",
- "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
- "waf": "Reliability"
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
- "severity": "Low",
- "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "High",
- "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "High",
- "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
- "severity": "High",
- "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "High",
- "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"severity": "High",
- "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "High",
- "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
- "severity": "High",
- "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
- "severity": "High",
- "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "High",
- "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs and metrics.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
- "severity": "High",
- "text": "Make sure the Floating IP is enabled on the Load balancer",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"severity": "High",
- "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "text": "Deploy Azure Firewall across multiple availability zones. Azure Firewall offers different SLAs depending on its deployment; in a single availability zone or across multiple, potentially improving reliability and performance.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "High",
- "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "text": "Configure DDoS Protection on the Azure Firewall VNet, Associate a DDoS protection plan with the virtual network hosting Azure Firewall to provide enhanced mitigation against DDoS attacks. Azure Firewall Manager integrates the creation of firewall infrastructure and DDoS protection plans. ",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"severity": "High",
- "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "Medium",
- "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Reliability"
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
"severity": "High",
- "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "High",
- "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
- "waf": "Reliability"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
"severity": "High",
- "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
- "waf": "Reliability"
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"severity": "High",
- "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
"severity": "Medium",
- "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"severity": "Medium",
- "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
- "waf": "Reliability"
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
"severity": "Medium",
- "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "High",
- "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
- "severity": "High",
- "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
- "severity": "High",
- "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Reliability"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "High",
- "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
"severity": "Medium",
- "text": "Automate SAP System Start-Stop to manage costs.",
- "waf": "Cost"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Low",
- "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
- "waf": "Cost"
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Low",
- "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
- "waf": "Cost"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
- "severity": "High",
- "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
"severity": "Medium",
- "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
- "waf": "Security"
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "Medium",
- "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
- "waf": "Security"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "severity": "High",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Medium",
- "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
- "severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
- "severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "Low",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
- "severity": "Medium",
- "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "Medium",
- "text": "Implement SSO to SAP HANA",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Medium",
- "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
"severity": "Medium",
- "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
"severity": "Medium",
- "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
"severity": "Medium",
- "text": "Implement SSO to SAP BTP",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
"severity": "Medium",
- "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "description": "Keep your management group hierarchy reasonably flat, no more than four.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
"severity": "Medium",
- "text": "enforce existing Management Group policies to SAP Subscriptions",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "High",
- "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "Operations"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Decide whether to use a single Azure Monitor Logs workspace for all regions or to create multiple workspaces to cover various geographical regions. Each approach has advantages and disadvantages, including potential cross-region networking charges",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "High",
- "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
- "severity": "Low",
- "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
- "severity": "High",
- "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "Medium",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
"severity": "Medium",
- "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "High",
- "text": "Help protect your HANA database by using the Azure Backup service.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Reliability"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
"severity": "Medium",
- "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
- "waf": "Reliability"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
- "severity": "High",
- "text": "Ensure time-zone matches between the operating system and the SAP system.",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
"severity": "Medium",
- "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
"severity": "Low",
- "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
- "waf": "Cost"
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
"severity": "Medium",
- "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
- "waf": "Operations"
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
"severity": "Medium",
- "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "Operations"
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
- "severity": "Low",
- "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
"severity": "Medium",
- "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"severity": "High",
- "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
"severity": "Medium",
- "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
- "waf": "Operations"
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
- "waf": "Operations"
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "High",
- "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Performance"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Reliability"
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
- "waf": "Operations"
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "severity": "Low",
- "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
- "waf": "Performance"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
- "waf": "Performance"
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "severity": "Low",
- "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
- "waf": "Performance"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"severity": "Medium",
- "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Performance"
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"severity": "Medium",
- "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Performance"
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
"severity": "High",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "Operations"
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "Medium",
- "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "High",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "description": "When configuring VNet peering, use the Allow traffic to remote virtual networks setting.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "Medium",
- "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "Reliability"
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "High",
- "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "Performance"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "Operations"
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"severity": "Medium",
- "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operations"
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"severity": "Medium",
- "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operations"
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
"severity": "High",
- "text": "Public IP assignment to VM running SAP Workload is not recommended.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
"severity": "High",
- "text": "Consider reserving IP address on DR side when configuring ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operations"
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
"severity": "High",
- "text": "Avoid using overlapping IP address ranges for production and DR sites.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
- "severity": "Medium",
- "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "Operations"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
+ "severity": "High",
+ "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
+ "service": "Azure Functions",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
- "waf": "Security"
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "Security"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
- "severity": "Medium",
- "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
+ "service": "Azure Functions",
+ "severity": "High",
+ "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
"severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Performance"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"severity": "Medium",
- "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
- "waf": "Security"
+ "text": "Implement an error handling policy at the global level",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
- "severity": "High",
- "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Performance"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Ensure all APIs policies include a element.",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"severity": "Medium",
- "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Security"
+ "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
"severity": "Medium",
- "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
- "waf": "Security"
+ "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"severity": "High",
- "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "Medium",
- "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "Performance"
+ "text": "Enable Application Insights for more detailed telemetry",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "High",
- "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Performance"
+ "text": "Configure alerts on the most critical metrics",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"severity": "High",
- "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Cost"
+ "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"severity": "High",
- "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Performance"
+ "text": "Protect incoming requests to APIs (data plane) with Azure AD",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"severity": "Medium",
- "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
+ "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "High",
- "text": "Review SAP HANA database backups for Azure VMs.",
- "waf": "Cost"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review Site Recovery built-in monitoring, where used for SAP.",
- "waf": "Cost"
+ "text": "Create appropriate groups to control the visibility of the products",
+ "waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
- "severity": "High",
- "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Use Backends feature to eliminate redundant API backend configurations",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review Oracle Database in Azure Linux VM backup strategies.",
+ "text": "Use Named Values to store common values that can be used in policies",
"waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
- "waf": "Operations"
+ "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review the use of Automated Backup v2 for Azure VMs.",
- "waf": "Operations"
+ "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"severity": "High",
- "text": "Enabling Write accelerator for M series when using premium disks(V1)",
- "waf": "Operations"
+ "text": "Ensure there is an automated backup routine",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "Medium",
- "text": "Test availability zone latency.",
- "waf": "Performance"
+ "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
- "severity": "Medium",
- "text": "Activate SAP EarlyWatch Alert for all SAP components.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Performance"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
+ "severity": "Low",
+ "text": "If you need to log at high performance levels, consider Event Hubs policy",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
+ "text": "Apply throttling policies to control the number of requests per second",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
"waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review SQL Server performance monitoring using CCMS.",
+ "text": "Configure autoscaling to scale out the number of instances when the load increases",
"waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"severity": "Medium",
- "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
+ "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
"waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"severity": "Medium",
- "text": "Review SAP HANA studio alerts.",
- "waf": "Performance"
+ "text": "Use the premium tier for production workloads.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"severity": "Medium",
- "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
- "waf": "Performance"
+ "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "Medium",
- "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "waf": "Security"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
+ "severity": "High",
+ "text": "Be aware of APIM's limits",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "Medium",
- "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "Security"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
+ "severity": "High",
+ "text": "Ensure that the self-hosted gateway deployments are resilient.",
+ "waf": "Reliability"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "Low",
- "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
- "waf": "Security"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Use Azure Front Door in front of APIM for multi-region deployment",
+ "waf": "Performance"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "High",
- "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
- "training": "https://me.sap.com/notes/3019299/E",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Deploy the service within a Virtual Network (VNet)",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "High",
- "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"severity": "Medium",
- "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Disable Public Network Access",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
"severity": "Medium",
- "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "Security"
+ "text": "Simplify management with PowerShell automation scripts",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
"severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Security"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
- "severity": "High",
- "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
- "waf": "Security"
+ "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "High",
- "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
- "waf": "Security"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
- "severity": "High",
- "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "waf": "Security"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Implement DevOps and CI/CD in your workflow",
+ "waf": "Operations"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Low",
- "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Secure APIs using client certificate authentication",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"severity": "Medium",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Secure backend services using client certificate authentication",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "High",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "severity": "High",
- "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
"severity": "High",
- "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"severity": "High",
- "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "Security"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "Low",
- "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "Low",
- "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
+ "severity": "Medium",
+ "text": "Use managed identities to authenticate to other Azure resources whenever possible",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"severity": "High",
- "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
- "waf": "Security"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Low",
- "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
"waf": "Security"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Security"
+ "text": "FTA Resiliency Playbook",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
+ "severity": "High",
+ "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Security"
+ "text": "Run multiple replicas of the database (>1 ) in Prod",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
+ "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "text": "Leverage Multi-Region Writes",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Microsoft Entra ID provides superior security and ease of use over shared access signatures (SAS). With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Service Bus applications when possible.",
- "graph": "Resources | where type =~ 'microsoft.servicebus/namespaces' | extend compliant = iif(properties.disableLocalAuth == 'false', 'No', 'Yes') | project id, compliant",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Span Cosmos account across two or more regions with multi-region writes",
+ "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "When possible, disable SAS key authentication (or local authentication) and use only Microsoft Entra ID for authentication",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "Distribute your data globally",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
+ "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
+ "service": "CosmosDB",
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "text": "Choose from several well-defined consistency models",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
+ "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Enable Service managed failover",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
+ "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "Enable Automatic Backups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
+ "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "text": "Perform Periodic Backups",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant = (sku=~'{\"name\":\"Standard\"}') | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/overview-managed-cluster#service-fabric-managed-cluster-skus",
- "service": "Azure Service Fabric",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
+ "checklist": "CosmosDB Review Checklist",
+ "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
+ "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
+ "service": "CosmosDB",
"severity": "Medium",
- "text": "Use Standard SKU for production scenarios.",
+ "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/clusters' | extend nodeTypes= array_concat(properties.nodeTypes) | mv-expand nodeTypes | summarize BronzeDurabilityCount = countif(nodeTypes.durabilityLevel == 'Bronze') by id | extend compliant = (BronzeDurabilityCount == 0) | distinct id,compliant",
- "guid": "182840d2-9ef8-4238-8fd6-0d76186830ac",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-cluster-capacity#durability-characteristics-of-the-cluster",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
+ "service": "PostgreSQL",
"severity": "Medium",
- "text": "Use durability level Silver (5 VMs) or greater for production scenarios",
+ "text": "Leverage Flexible Server",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.ServiceFabric/managedClusters' | extend compliant= ( properties.zonalResiliency =~ 'true') | distinct id,compliant",
- "guid": "2363878d-55c4-4cbd-9bc2-94523c85f12e",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-availability-zones",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Consider using Availability Zones for your Service Fabric clusters. Service Fabric managed cluster supports deployments that span across multiple Availability Zones to provide zone resiliency. This configuration will ensure high-availability of the critical system services and your applications to protect from single-points-of-failure.",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
+ "service": "PostgreSQL",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5ba74cc8-3ca2-44d5-9a67-bdc8e102e7b4",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-api-management-overview",
- "service": "Azure Service Fabric",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "checklist": "PostgreSQL Review Checklist",
+ "guid": "31b67c67-be59-4519-8083-845d587cb391",
+ "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
+ "service": "PostgreSQL",
"severity": "Medium",
- "text": "Consider using Azure API Management to expose and offload cross-cutting functionality for APIs hosted on the cluster. API Management can integrate with Service Fabric directly.",
+ "text": "Leverage cross-region read replicas for BCDR",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "ef17bb8f-4e2c-488b-8ceb-a07c3d750dd3",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-reliable-services-introduction",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "For stateful workload scenarios, consider using Reliable Services. The Reliable Services model allows your services to stay up even in unreliable environments where your machines fail or hit network issues, or in cases where the services themselves encounter errors and crash or fail. For stateful services, your state is preserved even in the presence of network or other failures.",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
"waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | summarize compliant = countif(sku.name matches regex '^Standard_[^d]*$' ) by id",
- "guid": "4da21268-f775-4c89-a271-eb80543c8df7",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Avoid VM SKUs with temp disk offerings. Service Fabric uses managed disks by default, so avoiding temp disk offerings ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "1890b796-f300-41a3-a8d4-29738c1f4ad0",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-stateless-node-type#temporary-disk-support",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "If you need to select a certain VM SKU for capacity reasons and it happens to offer temp disk, consider using temporary disk support for your stateless workloads.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "5247bb32-6778-49c7-8b40-e171c9a3ce1e",
- "service": "Azure Service Fabric",
- "severity": "Medium",
- "text": "Align SKU selection and managed disk size with workload requirements. Matching your selection to your workload demands ensures you don't pay for unneeded resources.",
- "waf": "Cost"
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
+ "checklist": "Device Update Review",
+ "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Device Update for IoT Hub",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "6028759b-446a-41bc-8b0e-7728e61ca704",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-cluster-networking#manage-nsg-rules",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"severity": "Medium",
- "text": "Ensure Network Security Groups (NSG) are configured to restrict traffic flow between subnets and node types. For example, you may have an API Management instance (one subnet), a frontend subnet (exposing a website directly), and a backend subnet (accessible only to frontend).",
- "waf": "Security"
+ "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "graph": "resources | where type=~'Microsoft.Compute/virtualMachineScaleSets' | extend vmssExtension= array_concat(properties.virtualMachineProfile.extensionProfile.extensions) | mv-expand vmssExtension | where vmssExtension.properties.publisher matches regex '^Microsoft.Azure.ServiceFabric.*' | summarize arg_max(id, *) | extend compliant = (isnotnull(properties.virtualMachineProfile.osProfile.secrets))",
- "guid": "4e98c903-14cf-4c72-9c45-b8b23bc4cbd8",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#deploy-key-vault-certificates-to-service-fabric-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "Medium",
- "text": "Deploy Key Vault certificates to Service Fabric cluster virtual machine scale sets. Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked.",
- "waf": "Security"
+ "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "001cbb6f-d88d-4431-8434-d01333397776",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#apply-an-access-control-list-acl-to-your-certificate-for-your-service-fabric-cluster",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"severity": "Medium",
- "text": "Apply an Access Control List (ACL) to your client certificate for your Service Fabric cluster. Using an ACL provides an additional level of authentication.",
- "waf": "Security"
+ "text": "Custom brand assets should be hosted on a CDN",
+ "waf": "Performance"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "4b74b7a5-bb1e-4fca-948c-037ba95fb73b",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-resource-governance#resource-governance-mechanism",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "Low",
+ "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Medium",
- "text": "Use resource requests and limits to govern resource usage across the nodes in your cluster. Enforcing resource limits helps ensure that one service doesn't consume too many resources and starve other services.",
- "waf": "Security"
+ "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "cd9233ba-f3aa-4353-8d2f-7ea4a64160e6",
- "link": "",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Medium",
- "text": "Encrypt Service Fabric package secret values. Encryption on your secret values provides an additional level of security.",
- "waf": "Security"
+ "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "44b989d4-9f72-42b6-99da-ec2a79f83299",
- "link": "",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Medium",
- "text": "Include client certificates in Service Fabric applications. Having your applications use client certificates for authentication provides opportunities for security at both the cluster and workload level.",
- "waf": "Security"
+ "text": "Have active-active for multi-regions",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "28e66ff7-4a77-4b2c-910d-0335f141208a",
- "link": "https://learn.microsoft.com/azure/service-fabric/how-to-managed-identity-managed-cluster-virtual-machine-scale-sets",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Medium",
- "text": "Authenticate Service Fabric applications to Azure Resources using Managed Identity. Using Managed Identity allow you to securely manage the credentials in your code for authenticating to various services without saving them locally on a developer workstation or in source control.",
- "waf": "Security"
+ "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "waf": "Reliability"
},
{
- "checklist": "Azure Service Fabric Review Checklist",
- "guid": "f16c413c-00a6-43aa-852c-b97292c33a56",
- "link": "https://learn.microsoft.com/azure/service-fabric/service-fabric-best-practices-security#hosting-untrusted-applications-in-a-service-fabric-cluster",
- "service": "Azure Service Fabric",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Medium",
- "text": "Follow Service Fabric best practices when hosting untrusted applications. Following the best practices provides a security standard to follow.",
- "waf": "Security"
+ "text": "Use Replica Sets for DR",
+ "waf": "Reliability"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 08, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.es.json b/checklists/waf_checklist.es.json
index 8073a198a..1e8f328f9 100644
--- a/checklists/waf_checklist.es.json
+++ b/checklists/waf_checklist.es.json
@@ -1,3512 +1,3132 @@
{
"items": [
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Use el token revocable de larga duración, almacene en caché el token y adquiera el token de forma silenciosa mediante la biblioteca de identidades de Microsoft",
- "waf": "Fiabilidad"
+ "text": "Azure Center for SAP solutions (ACSS) es una oferta de Azure que convierte a SAP en una carga de trabajo de nivel superior en Azure. ACSS es una solución integral que permite crear y ejecutar sistemas SAP como una carga de trabajo unificada en Azure y proporciona una base más fluida para la innovación. Puede aprovechar las capacidades de administración de los sistemas SAP basados en Azure nuevos y existentes.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"severity": "Medio",
- "text": "Asegúrese de que los flujos de usuario de inicio de sesión estén respaldados y sean resistentes. Asegúrese de que se ha realizado una copia de seguridad del código que usa para iniciar sesión en los usuarios y se puede recuperar. Interfaces resilientes con procesos externos",
- "waf": "Fiabilidad"
+ "text": "Azure admite la automatización de implementaciones de SAP en Linux y Windows. SAP Deployment Automation Framework es una herramienta de orquestación de código abierto que puede implementar, instalar y mantener entornos SAP.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operaciones"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"severity": "Medio",
- "text": "Los activos de marca personalizados deben estar alojados en una CDN",
- "waf": "Rendimiento"
- },
- {
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "Bajo",
- "text": "Tener varios proveedores de identidad (es decir, iniciar sesión con sus cuentas de Microsoft, Google, Facebook)",
+ "text": "Realice una recuperación a un momento dado para sus bases de datos de producción en cualquier momento y en un período de tiempo que cumpla con su RTO; La recuperación a un momento dado suele incluir errores del operador que eliminan datos en la capa DBMS o a través de SAP, por cierto",
"waf": "Fiabilidad"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"severity": "Medio",
- "text": "Siga las reglas de la máquina virtual para la alta disponibilidad en el nivel de máquina virtual (discos premium, dos o más en una región, en diferentes zonas de disponibilidad)",
+ "text": "Pruebe los tiempos de copia de seguridad y recuperación para verificar que cumplan con los requisitos de RTO para restaurar todos los sistemas simultáneamente después de un desastre.",
"waf": "Fiabilidad"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "Medio",
- "text": "¡No repliques! La replicación puede crear problemas con la sincronización de directorios",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Puede replicar el almacenamiento estándar entre regiones emparejadas, pero no puede usar el almacenamiento estándar para almacenar sus bases de datos o discos duros virtuales. Solo puede replicar copias de seguridad entre las regiones emparejadas que utilice. Para todos los demás datos, ejecute la replicación mediante características nativas de DBMS, como SQL Server Always On o SAP HANA System Replication. Utilice una combinación de Site Recovery, rsync o robocopy y otro software de terceros para la capa de aplicación de SAP.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Fiabilidad"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "Medio",
- "text": "Tener activo-activo para varias regiones",
+ "text": "Al usar Azure Availability Zones para lograr una alta disponibilidad, debe tener en cuenta la latencia entre los servidores de aplicaciones SAP y los servidores de bases de datos. En el caso de las zonas con latencias altas, es necesario implementar procedimientos operativos para garantizar que los servidores de aplicaciones SAP y los servidores de bases de datos se ejecuten en la misma zona en todo momento.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
- "severity": "Medio",
- "text": "Adición de stamps de servicio de dominio de Azure AD a regiones y ubicaciones adicionales",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Configure las conexiones de ExpressRoute desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria. Además, como alternativa al uso de ExpressRoute, considere la posibilidad de configurar conexiones VPN desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
"waf": "Fiabilidad"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
- "severity": "Medio",
- "text": "Uso de conjuntos de réplicas para recuperación ante desastres",
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Replique el contenido del almacén de claves, como certificados, secretos o claves, en todas las regiones para poder descifrar los datos de la región de recuperación ante desastres.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
- "severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad si corresponden regionalmente (esto se habilita automáticamente)",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Empareje las redes virtuales principal y de recuperación ante desastres. Por ejemplo, para la replicación del sistema HANA, una red virtual de base de datos de SAP HANA debe estar emparejada con la red virtual de base de datos de SAP HANA del sitio de recuperación ante desastres.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "Medio",
- "text": "Tenga en cuenta las conmutaciones por error iniciadas por Microsoft. Microsoft los ejerce en situaciones excepcionales para conmutar por error todos los centros de IoT de una región afectada a la región emparejada geográficamente correspondiente.",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Si usa el almacenamiento de Azure NetApp Files para las implementaciones de SAP, como mínimo, cree dos cuentas de Azure NetApp Files en el nivel Premium, en dos regiones.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
+ "text": "Se debe usar la tecnología de replicación de base de datos nativa para sincronizar la base de datos en un par de alta disponibilidad.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
"severity": "Alto",
- "text": "Obtenga información sobre cómo desencadenar una conmutación por error manual.",
+ "text": "El CIDR de la red virtual (VNet) principal no debe entrar en conflicto ni superponerse con el CIDR de la red virtual del sitio de recuperación ante desastres",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
"severity": "Alto",
- "text": "Obtenga información sobre cómo conmutar por recuperación después de una conmutación por error.",
+ "text": "Use Site Recovery para replicar un servidor de aplicaciones en un sitio de recuperación ante desastres. Site Recovery también puede ayudar a replicar máquinas virtuales de clúster de servicios centrales en el sitio de recuperación ante desastres. Al invocar la recuperación ante desastres, deberá volver a configurar el clúster de Linux Pacemaker en el sitio de recuperación ante desastres (por ejemplo, reemplazar el VIP o el SBD, ejecutar corosync.conf, etc.).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "Alto",
- "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO",
+ "text": "Considere la disponibilidad del software de SAP frente a puntos únicos de fallo. Esto incluye puntos únicos de falla dentro de aplicaciones como DBMS utilizados en las arquitecturas SAP NetWeaver y SAP S/4HANA, SAP ABAP y ASCS + SCS. También, otras herramientas como SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"severity": "Alto",
- "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad",
+ "text": "En el caso de SAP y bases de datos de SAP, considere la posibilidad de implementar clústeres de conmutación por error automática. En Windows, los clústeres de conmutación por error de Windows Server admiten la conmutación por error. En Linux, Linux Pacemaker o herramientas de terceros, como SIOS Protection Suite y Veritas InfoScale, admiten la conmutación por error.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
+ "text": "Azure no admite arquitecturas en las que las máquinas virtuales principal y secundaria compartan almacenamiento para los datos de DBMS. Para la capa DBMS, el patrón de arquitectura común es replicar bases de datos al mismo tiempo y con pilas de almacenamiento diferentes a las que usan las máquinas virtuales principales y secundarias.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"severity": "Alto",
- "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
+ "text": "Los datos de DBMS y los archivos de registro de transacciones/puesta al día se almacenan en el almacenamiento en bloque compatible con Azure o en Azure NetApp Files. Azure Files o Azure Premium Files no se admiten como almacenamiento para datos de DBMS ni archivos de registro de puesta al día con la carga de trabajo de SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
- "severity": "Medio",
- "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica",
- "waf": "Operaciones"
- },
- {
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
- "severity": "Medio",
- "text": "Aproveche el servidor flexible",
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Puede usar discos compartidos de Azure en Windows para componentes ASCS + SCS y escenarios específicos de alta disponibilidad. Configure los clústeres de conmutación por error por separado para los componentes de la capa de aplicación de SAP y la capa de DBMS. Actualmente, Azure no admite arquitecturas de alta disponibilidad que combinen los componentes de la capa de aplicación de SAP y la capa de DBMS en un clúster de conmutación por error.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente",
+ "text": "La mayoría de los clústeres de conmutación por error para los componentes de la capa de aplicación (ASCS) de SAP y la capa de DBMS requieren una dirección IP virtual para un clúster de conmutación por error. Azure Load Balancer debe controlar la dirección IP virtual para todos los demás casos. Un principio de diseño es usar un equilibrador de carga por configuración de clúster. Te recomendamos que utilices la versión estándar del equilibrador de carga (SKU de Standard Load Balancer).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
- "severity": "Medio",
- "text": "Aproveche la replicación de entrada de datos para escenarios de recuperación ante desastres entre regiones",
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Asegúrese de que la IP flotante esté habilitada en el equilibrador de carga",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aplicación de las instrucciones del banco de pruebas de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Tenga en cuenta la \"Línea base de seguridad de Azure para el almacenamiento\"",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Antes de implementar la infraestructura de alta disponibilidad, y en función de la región que elija, determine si desea implementar con un conjunto de disponibilidad de Azure o con una zona de disponibilidad.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de Azure Compute que necesitan acceso, lo que elimina la exposición a la Internet pública",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
- "waf": "Seguridad"
+ "text": "Si desea cumplir los acuerdos de nivel de servicio de infraestructura para sus aplicaciones para componentes de SAP (servicios centrales, servidores de aplicaciones y bases de datos), debe elegir las mismas opciones de alta disponibilidad (máquinas virtuales, conjuntos de disponibilidad, zonas de disponibilidad) para todos los componentes.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, etcétera de auditoría, estén habilitados. Asegúrese de que no haya cuentas de almacenamiento antiguas con el modelo de implementación clásico en una suscripción",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "No mezcle servidores de diferentes roles en el mismo conjunto de disponibilidad. Mantenga las máquinas virtuales de servicios centrales, las máquinas virtuales de bases de datos y las máquinas virtuales de aplicaciones en sus propios conjuntos de disponibilidad",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidad"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "Medio",
- "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usen el \"modelo de implementación clásica\"",
- "waf": "Seguridad"
+ "text": "No se pueden implementar conjuntos de disponibilidad de Azure en una zona de disponibilidad de Azure a menos que se usen grupos de selección de ubicación por proximidad.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aproveche Microsoft Defender para obtener información sobre actividades sospechosas y configuraciones incorrectas.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"severity": "Alto",
- "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
- "waf": "Seguridad"
+ "text": "Al crear conjuntos de disponibilidad, use el número máximo de dominios de error y dominios de actualización disponibles. Por ejemplo, si implementa más de dos máquinas virtuales en un conjunto de disponibilidad, use el número máximo de dominios de error (tres) y suficientes dominios de actualización para limitar el efecto de posibles errores de hardware físico, interrupciones de red o interrupciones de energía, además del mantenimiento planeado de Azure. El número predeterminado de dominios de error es dos y no se puede cambiar en línea más adelante.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Habilitación de la \"eliminación temporal\" para blobs",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Cuando se usan grupos de selección de ubicación de proximidad de Azure en una implementación de conjunto de disponibilidad, los tres componentes de SAP (servicios centrales, servidor de aplicaciones y base de datos) deben estar en el mismo grupo de selección de ubicación por proximidad.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Deshabilitación de la \"eliminación temporal\" para blobs",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Utilice un grupo de ubicación de proximidad por SID de SAP. Los grupos no se extienden entre zonas de disponibilidad ni regiones de Azure",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "Alto",
- "text": "Habilitación de la \"eliminación temporal\" para contenedores",
- "waf": "Seguridad"
+ "text": "Utilice uno de los siguientes servicios para ejecutar clústeres de servicios centrales de SAP, en función del sistema operativo.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"severity": "Medio",
- "text": "Deshabilitar la \"eliminación temporal\" para contenedores",
- "waf": "Seguridad"
+ "text": "Actualmente, Azure no admite la combinación de ASCS y DB HA en el mismo clúster de Linux Pacemaker; sepárelos en grupos individuales. Sin embargo, puede combinar hasta cinco clústeres de servicios centrales en un par de máquinas virtuales.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Implemente ambas máquinas virtuales en el par de alta disponibilidad en un conjunto de disponibilidad o en zonas de disponibilidad. Estas máquinas virtuales deben tener el mismo tamaño y la misma configuración de almacenamiento.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere la posibilidad de blobs inmutables",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Azure admite la instalación y configuración de SAP HANA, ASCS/SCS e instancias de ERS en el mismo clúster de alta disponibilidad que se ejecuta en Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 no protegido a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas contra la integridad y el servidor esté autenticado. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "Alto",
- "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
- "waf": "Seguridad"
+ "text": "Ejecute todos los sistemas de producción en SSD administradas Premium y use Azure NetApp Files o Ultra Disk Storage. Al menos el disco del sistema operativo debe estar en el nivel Premium para que pueda lograr un mejor rendimiento y el mejor Acuerdo de Nivel de Servicio.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"severity": "Alto",
- "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
- "waf": "Seguridad"
+ "text": "Debe ejecutar SAP HANA en Azure solo en los tipos de almacenamiento certificados por SAP. Tenga en cuenta que ciertos volúmenes deben ejecutarse en ciertas configuraciones de disco, cuando corresponda. Estas configuraciones incluyen la habilitación del Acelerador de escritura y el uso del almacenamiento Premium. También debe asegurarse de que el sistema de archivos que se ejecuta en el almacenamiento sea compatible con el DBMS que se ejecuta en la máquina.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blob ayuda a minimizar el riesgo de pérdida de credenciales.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de configurar la alta disponibilidad en función del tipo de almacenamiento que utilice para las cargas de trabajo de SAP. Algunos servicios de almacenamiento disponibles en Azure no son compatibles con Azure Site Recovery, por lo que la configuración de alta disponibilidad puede diferir.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ". Al aplicar la versión más reciente de TLS, se rechazarán las solicitudes de los clientes que utilicen la versión anterior. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aplicación de la versión más reciente de TLS para una cuenta de almacenamiento",
- "waf": "Seguridad"
+ "text": "Es posible que los diferentes servicios de almacenamiento nativo de Azure (como Azure Files, Azure NetApp Files, Azure Shared Disk) no estén disponibles en todas las regiones. Por lo tanto, para tener una configuración de SAP similar en la región de recuperación ante desastres después de la conmutación por error, asegúrese de que el servicio de almacenamiento correspondiente se ofrezca en el sitio de recuperación ante desastres.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Los tokens de identificador de Microsoft Entra deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Uso de tokens de identificador de Microsoft Entra para el acceso a blobs",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Automatice SAP System Start-Stop para gestionar los costes.",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Privilegio mínimo en los permisos de IaM",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad con respecto a la SAS de servicio. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en clave de cuenta de almacenamiento.",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "En el caso de usar Azure Premium Storage con SAP HANA, el almacenamiento SSD estándar de Azure se puede usar para seleccionar una solución de almacenamiento económica en cuanto a costos. Sin embargo, tenga en cuenta que la elección del almacenamiento SSD estándar o HDD estándar de Azure afectará al Acuerdo de Nivel de Servicio de las máquinas virtuales individuales. Además, para sistemas con menor rendimiento de E/S y baja latencia, como entornos que no son de producción, se pueden usar máquinas virtuales de series inferiores.",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Las claves de la cuenta de almacenamiento ('claves compartidas') tienen muy pocas capacidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de ID de Entra facilita la vinculación del acceso al almacenamiento de un usuario. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a Microsoft Entra ID (y SAS de delegación de usuarios).",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Como configuración alternativa de menor costo (multipropósito), puede elegir una SKU de bajo rendimiento para las máquinas virtuales de servidor de base de datos HANA que no son de producción. Sin embargo, es importante tener en cuenta que algunos tipos de máquinas virtuales, como la serie E, no están certificadas por HANA (directorio de hardware de SAP HANA) o no pueden alcanzar una latencia de almacenamiento inferior a 1 ms.",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Utilice los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etcétera).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "text": "Aplicación de un modelo RBAC para grupos de administración, suscripciones, grupos de recursos y recursos",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Una política de caducidad de claves le permite establecer un recordatorio para la rotación de las claves de acceso de la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"severity": "Medio",
- "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
+ "text": "Aplicación de la propagación de la entidad de seguridad para reenviar la identidad de la aplicación en la nube de SAP a SAP local (incluida la IaaS) a través del conector en la nube",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de caducidad de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
+ "text": "Implemente SSO en aplicaciones SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics y SAP C4C con Azure AD mediante SAML.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
+ "text": "Implemente SSO en aplicaciones web basadas en SAP NetWeaver, como SAP Fiori y SAP Web GUI, mediante SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
+ "text": "Implemente SSO en aplicaciones web basadas en SAP NetWeaver, como SAP Fiori y SAP Web GUI, mediante SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si eso no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Puede implementar el inicio de sesión único en la interfaz gráfica de usuario de SAP mediante el inicio de sesión único de SAP NetWeaver o una solución de socio.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Utilice los tiempos de caducidad a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, solo es válida durante un corto período de tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una política de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlos en él.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Esfuércese por períodos de validez cortos para SAS ad-hoc",
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Para SSO para SAP GUI y acceso al navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociación GSSAPI simple y protegido) debido a su facilidad de configuración y mantenimiento. Para SSO con certificados de cliente X.509, considere la posibilidad de utilizar SAP Secure Login Server, que es un componente de la solución SAP SSO.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"severity": "Medio",
- "text": "Aplicación de un ámbito limitado a una SAS",
+ "text": "Para SSO para SAP GUI y acceso al navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociación GSSAPI simple y protegido) debido a su facilidad de configuración y mantenimiento. Para SSO con certificados de cliente X.509, considere la posibilidad de utilizar SAP Secure Login Server, que es un componente de la solución SAP SSO.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Una SAS puede incluir parámetros sobre las direcciones IP de cliente o los intervalos de direcciones que están autorizados a solicitar un recurso mediante la SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de definir el ámbito de SAS a una dirección IP de cliente específica, siempre que sea posible",
+ "text": "Implemente el inicio de sesión único mediante OAuth para SAP NetWeaver a fin de permitir que aplicaciones personalizadas o de terceros accedan a los servicios OData de SAP NetWeaver.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenidos malintencionados de gran tamaño.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "Bajo",
- "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan utilizado una SAS para cargar un archivo. ",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Implementación de SSO en SAP HANA",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Al acceder al almacenamiento de blobs a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente es compatible con el punto de conexión SFTP",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Considere Azure AD como un proveedor de identidades para sistemas SAP hospedados en RISE. Para obtener más información, consulte Integración del servicio con Azure AD.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"severity": "Medio",
- "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
+ "text": "En el caso de las aplicaciones que acceden a SAP, es posible que desee utilizar la propagación de entidades de seguridad para establecer el inicio de sesión único.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente aflojar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Evite las políticas de CORS demasiado amplias",
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Si usa servicios BTP de SAP o soluciones SaaS que requieren SAP Identity Authentication Service (IAS), considere la posibilidad de implementar SSO entre SAP Cloud Identity Authentication Services y Azure AD para acceder a esos servicios de SAP. Esta integración permite a SAP IAS actuar como proveedor de identidades de proxy y reenvía las solicitudes de autenticación a Azure AD como almacén de usuarios central y proveedor de identidades.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Los datos en reposo siempre se cifran en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede producirse mediante una clave administrada por la plataforma (valor predeterminado) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob al almacenamiento de Azure o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Implementación de SSO en SAP BTP",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
"severity": "Medio",
- "text": "Determine cuál o si se debe utilizar el cifrado de la plataforma.",
+ "text": "Si usa SAP SuccessFactors, considere la posibilidad de usar el aprovisionamiento automatizado de usuarios de Azure AD. Con esta integración, a medida que agregue nuevos empleados a SAP SuccessFactors, puede crear automáticamente sus cuentas de usuario en Azure AD. Opcionalmente, puede crear cuentas de usuario en Microsoft 365 u otras aplicaciones SaaS compatibles con Azure AD. Utilice la reescritura de la dirección de correo electrónico en SAP SuccessFactors.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "description": "Mantenga la jerarquía del grupo de administración razonablemente plana, no más de cuatro.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"severity": "Medio",
- "text": "Determine qué cifrado del lado del cliente se debe usar, si se debe usar.",
- "waf": "Seguridad"
+ "text": "aplicar las directivas de grupo de administración existentes a las suscripciones de SAP",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere si es necesario el acceso anónimo de blob público o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
- "waf": "Seguridad"
+ "text": "Integre aplicaciones estrechamente acopladas en la misma suscripción de SAP para evitar la complejidad adicional del enrutamiento y la administración",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveche un tipo de cuenta storagev2 para mejorar el rendimiento y la confiabilidad",
- "waf": "Fiabilidad"
+ "text": "Aprovechar la suscripción como unidad de escala y escalar nuestros recursos, considere implementar la suscripción por entorno, por ejemplo. Sandbox, no prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveche el almacenamiento GRS, ZRS o GZRS para obtener la máxima disponibilidad",
- "waf": "Fiabilidad"
+ "text": "Garantizar el aumento de la cuota como parte del aprovisionamiento de suscripciones (por ejemplo, el total de núcleos de máquina virtual disponibles dentro de una suscripción)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Para la operación de escritura después de la conmutación por error, use la conmutación por error administrada por el cliente ",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "La API de cuota es una API de REST que puede usar para ver y administrar las cuotas de los servicios de Azure. Considere usarlo si es necesario.",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Descripción de los detalles de la conmutación por error administrada por Microsoft",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Si se implementa en una zona de disponibilidad, asegúrese de que la implementación de zona de la máquina virtual esté disponible una vez que se haya aprobado la cuota. Envíe una solicitud de soporte técnico con la suscripción, la serie de máquinas virtuales, el número de CPU y la zona de disponibilidad necesarias.",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Asegúrese de que los servicios y funciones necesarios estén disponibles dentro de las regiones de implementación elegidas, por ejemplo. ANF, Zona, etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operaciones"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"severity": "Medio",
- "text": "Habilitar eliminación temporal",
- "waf": "Fiabilidad"
+ "text": "Aproveche la etiqueta de recurso de Azure para la categorización de costos y la agrupación de recursos (: BillTo, Departamento (o unidad de negocio), Medio ambiente (producción, Fase, Desarrollo), Nivel (nivel web, nivel de aplicación), Propietario de la aplicación, Nombre del proyecto)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "Alto",
- "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO",
+ "text": "Ayude a proteger la base de datos de HANA mediante el servicio Azure Backup.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "severity": "Alto",
- "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad",
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Si implementa Azure NetApp Files para la base de datos HANA, Oracle o DB2, use la herramienta Azure Application Consistent Snapshot (AzAcSnap) para tomar instantáneas coherentes con la aplicación. AzAcSnap también es compatible con bases de datos de Oracle. Considere la posibilidad de usar AzAcSnap en una máquina virtual central en lugar de en máquinas virtuales individuales.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "Alto",
- "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
- "waf": "Fiabilidad"
+ "text": "Asegúrese de que las zonas horarias coincidan entre el sistema operativo y el sistema SAP.",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "severity": "Alto",
- "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "No agrupe diferentes servicios de aplicaciones en el mismo clúster. Por ejemplo, no combine DRBD y clústeres de servicios centrales en el mismo clúster. Sin embargo, puede usar el mismo clúster de Pacemaker para administrar aproximadamente cinco servicios centrales diferentes (clúster de varios SID).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de ejecutar sistemas de desarrollo y pruebas en un modelo de repetición para ahorrar y optimizar los costos de ejecución de Azure.",
+ "waf": "Costar"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica",
+ "text": "Si se asocia con los clientes mediante la administración de sus propiedades de SAP, considere la posibilidad de Azure Lighthouse. Azure Lighthouse permite a los proveedores de servicios administrados usar los servicios de identidad nativos de Azure para autenticarse en el entorno de los clientes. Pone el control en manos de los clientes, ya que pueden revocar el acceso en cualquier momento y auditar las acciones de los proveedores de servicios.",
"waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Use Azure Update Manager para comprobar el estado de las actualizaciones disponibles para una sola máquina virtual o varias máquinas virtuales y considere la posibilidad de programar la aplicación periódica de revisiones.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operaciones"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"severity": "Bajo",
- "text": "Consulte la arquitectura de aplicación web de redundancia de zona de alta disponibilidad de línea de base para conocer los procedimientos recomendados",
- "waf": "Fiabilidad"
+ "text": "Optimice y gestione las operaciones de SAP Basis mediante SAP Landscape Management (LaMa). Use el conector de SAP LaMa para Azure para reubicar, copiar, clonar y actualizar sistemas SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Medio",
- "text": "Utilice los niveles Premium y Estándar. Estos niveles admiten ranuras de ensayo y copias de seguridad automatizadas.",
- "waf": "Fiabilidad"
+ "text": "Use las soluciones de Azure Monitor para SAP para supervisar las cargas de trabajo de SAP (SAP HANA, clústeres de SUSE de alta disponibilidad y sistemas SQL) en Azure. Considere la posibilidad de complementar las soluciones de Azure Monitor para SAP con SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (requiere el nivel Premium v2 o v3)",
- "waf": "Fiabilidad"
+ "text": "Ejecute una extensión de máquina virtual para la comprobación de SAP. VM Extension for SAP usa la identidad administrada asignada de una máquina virtual (VM) para acceder a los datos de configuración y supervisión de VM. La comprobación garantiza que todas las métricas de rendimiento de la aplicación SAP procedan de la extensión de Azure para SAP subyacente.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
"severity": "Medio",
- "text": "Implementación de comprobaciones de estado",
- "waf": "Fiabilidad"
+ "text": "Use Azure Policy para el control de acceso y los informes de cumplimiento. Azure Policy proporciona la capacidad de aplicar la configuración de toda la organización para garantizar el cumplimiento coherente de las directivas y la detección rápida de infracciones. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
- "severity": "Alto",
- "text": "Consulte los procedimientos recomendados de copia de seguridad y restauración para Azure App Service",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Use el Monitor de conexión en Azure Network Watcher para supervisar las métricas de latencia de las bases de datos y los servidores de aplicaciones de SAP. O bien, recopile y muestre medidas de latencia de red mediante Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Realice una comprobación de calidad de SAP HANA en la infraestructura de Azure aprovisionada para comprobar que las máquinas virtuales aprovisionadas cumplen con los procedimientos recomendados de SAP HANA en Azure.",
+ "waf": "Operaciones"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "Alto",
- "text": "Implementación de los procedimientos recomendados de confiabilidad de Azure App Service",
- "waf": "Fiabilidad"
+ "text": "Para cada suscripción de Azure, ejecute una prueba de latencia en las zonas de disponibilidad de Azure antes de la implementación zonal para elegir zonas de baja latencia para la implementación de SAP en Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "Bajo",
- "text": "Familiarizarse con cómo mover una aplicación de App Service a otra región durante un desastre",
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Ejecute el informe de resistencia para asegurarse de que la configuración de toda la infraestructura de Azure aprovisionada (proceso, base de datos, redes, almacenamiento, Site Recovery) cumpla con la configuración definida por Cloud Adaption Framework para Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
- "severity": "Alto",
- "text": "Familiarizarse con la compatibilidad con la confiabilidad en Azure App Service",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Implemente la protección contra amenazas mediante la solución Microsoft Sentinel para SAP. Utilice esta solución para supervisar sus sistemas SAP y detectar amenazas sofisticadas en toda la lógica empresarial y las capas de aplicación.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
"severity": "Medio",
- "text": "Asegúrese de que \"Siempre activado\" está habilitado para las aplicaciones de funciones que se ejecutan en un plan de App Service",
- "waf": "Fiabilidad"
+ "text": "El etiquetado de Azure se puede aprovechar para agrupar y realizar un seguimiento lógicos de los recursos, automatizar sus implementaciones y, lo que es más importante, proporcionar visibilidad de los costos incurridos.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Utilice la supervisión de latencia entre máquinas virtuales para aplicaciones sensibles a la latencia.",
+ "waf": "Rendimiento"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "Medio",
- "text": "Supervisión de instancias de App Service mediante comprobaciones de estado",
+ "text": "Use la supervisión de Azure Site Recovery para mantener el estado del servicio de recuperación ante desastres para los servidores de aplicaciones de SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "Medio",
- "text": "Supervisión de la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web mediante pruebas de disponibilidad de Application Insights",
- "waf": "Fiabilidad"
+ "text": "Excluya todos los sistemas de archivos de bases de datos y programas ejecutables de los análisis antivirus. Incluirlos podría provocar problemas de rendimiento. Consulte con los proveedores de bases de datos para obtener detalles prescriptivos sobre la lista de exclusión. Por ejemplo, Oracle recomienda excluir /oracle//sapdata de los análisis antivirus.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"severity": "Bajo",
- "text": "Uso de la prueba estándar de Application Insights para supervisar la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web",
- "waf": "Fiabilidad"
+ "text": "Considere la posibilidad de recopilar estadísticas completas de bases de datos que no sean de HANA después de la migración. Por ejemplo, implemente la nota de SAP 1020260 - Entrega de estadísticas de Oracle.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use Azure Key Vault para almacenar los secretos que necesita la aplicación. Key Vault proporciona un entorno seguro y auditado para almacenar secretos y está bien integrado con App Service a través del SDK de Key Vault o las referencias de Key Vault de App Service.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "Alto",
- "text": "Uso de Key Vault para almacenar secretos",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de usar Oracle Automatic Storage Management (ASM) para todas las implementaciones de Oracle que utilicen SAP en Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use una identidad administrada para conectarse a Key Vault mediante el SDK de Key Vault o a través de las referencias de Key Vault de App Service.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "Alto",
- "text": "Uso de la identidad administrada para conectarse a Key Vault",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "En el caso de SAP en Azure que ejecuta Oracle, una colección de scripts SQL puede ayudarle a diagnosticar problemas de rendimiento. Los informes de Automatic Workload Repository (AWR) contienen información valiosa para diagnosticar problemas en el sistema Oracle. Le recomendamos que ejecute un informe de AWR durante varias sesiones y elija las horas punta para él, a fin de garantizar una amplia cobertura del análisis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Almacene el certificado TLS de App Service en Key Vault.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use Key Vault para almacenar el certificado TLS.",
- "waf": "Seguridad"
+ "text": "Use la supervisión de Azure Site Recovery para mantener el estado del servicio de recuperación ante desastres para los servidores de aplicaciones de SAP.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Los sistemas que procesan información confidencial deben estar aislados. Para ello, use planes del Servicio de aplicaciones o entornos del Servicio de aplicaciones independientes y considere la posibilidad de usar suscripciones o grupos de administración diferentes.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Aísle los sistemas que procesan información confidencial",
+ "text": "Para la entrega segura de aplicaciones HTTP/S, use Application Gateway v2 y asegúrese de que la protección y las directivas de WAF estén habilitadas.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Los discos locales de App Service no están cifrados y los datos confidenciales no deben almacenarse en ellos. (Por ejemplo: D:\\\\Local y %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "Medio",
- "text": "No almacene datos confidenciales en el disco local",
- "waf": "Seguridad"
+ "text": "Si el DNS o el nombre virtual de la máquina virtual no se cambia durante la migración a Azure, el DNS en segundo plano y los nombres virtuales conectan muchas interfaces del sistema en el entorno de SAP, y los clientes solo a veces son conscientes de las interfaces que los desarrolladores definen a lo largo del tiempo. Surgen desafíos de conexión entre varios sistemas cuando los nombres virtuales o de DNS cambian después de las migraciones, y se recomienda conservar los alias de DNS para evitar este tipo de dificultades.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "En el caso de la aplicación web autenticada, use un proveedor de identidades bien establecido, como Azure AD o Azure AD B2C. Aproveche el marco de aplicaciones de su elección para integrarse con este proveedor o use la característica de autenticación o autorización del Servicio de aplicaciones.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "Medio",
- "text": "Usar un proveedor de identidades establecido para la autenticación",
- "waf": "Seguridad"
+ "text": "Utilice diferentes zonas DNS para distinguir cada entorno (espacio aislado, desarrollo, preproducción y producción) entre sí. La excepción es para las implementaciones de SAP con su propia red virtual; aquí, es posible que las zonas DNS privadas no sean necesarias.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Implemente código en App Service desde un entorno controlado y de confianza, como una canalización de implementación de DevOps bien administrada y segura. De este modo, se evita el código que no se ha controlado la versión y se ha comprobado que se implementará desde un host malintencionado.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
- "severity": "Alto",
- "text": "Implementación desde un entorno de confianza",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "description": "Al configurar el emparejamiento de red virtual, use la opción Permitir tráfico a redes virtuales remotas.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "El emparejamiento de red virtual local y global proporciona conectividad y son los enfoques preferidos para garantizar la conectividad entre las zonas de aterrizaje para las implementaciones de SAP en varias regiones de Azure",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Deshabilite la autenticación básica tanto para FTP/FTPS como para WebDeploy/SCM. Esto deshabilita el acceso a estos servicios y exige el uso de puntos de conexión protegidos de Azure AD para la implementación. Tenga en cuenta que el sitio de SCM también se puede abrir con credenciales de Azure AD.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "Alto",
- "text": "Deshabilitar la autenticación básica",
- "waf": "Seguridad"
+ "text": "No se admite la implementación de ninguna NVA entre la aplicación SAP y el servidor de base de datos SAP",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Siempre que sea posible, use Managed Identity para conectarse a los recursos protegidos de Azure AD. Si esto no es posible, almacene los secretos en Key Vault y conéctese a Key Vault mediante una identidad administrada en su lugar.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "severity": "Alto",
- "text": "Uso de la identidad administrada para conectarse a los recursos",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Use Virtual WAN para implementaciones de Azure en redes nuevas, grandes o globales en las que necesite conectividad de tránsito global entre regiones de Azure y ubicaciones locales. Con este enfoque, no tendrá que configurar manualmente el enrutamiento transitivo para las redes de Azure y puede seguir un estándar para las implementaciones de SAP en Azure.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas mediante una identidad administrada.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
- "severity": "Alto",
- "text": "Extracción de contenedores mediante una identidad administrada",
- "waf": "Seguridad"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Al configurar las opciones de diagnóstico de App Service, puede enviar todos los datos de telemetría a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad en tiempo de ejecución de App Service, como los registros HTTP, los registros de aplicaciones, los registros de plataforma, ...",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
- "severity": "Medio",
- "text": "Envío de registros en tiempo de ejecución de App Service a Log Analytics",
- "waf": "Seguridad"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure una configuración de diagnóstico para enviar el registro de actividad a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad del plano de control en el propio recurso de App Service.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"severity": "Medio",
- "text": "Envío de registros de actividad de App Service a Log Analytics",
- "waf": "Seguridad"
+ "text": "Considere la posibilidad de implementar aplicaciones virtuales de red (NVA) entre regiones solo si se usan NVA de asociados. Las aplicaciones virtuales de red entre regiones o redes virtuales no son necesarias si hay aplicaciones virtuales de red nativas. Al implementar tecnologías de redes de asociados y NVA, siga las instrucciones del proveedor para comprobar las configuraciones conflictivas con las redes de Azure.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Controle el acceso saliente a la red mediante una combinación de integración de red virtual regional, grupos de seguridad de red y UDR. El tráfico debe enrutarse a una aplicación virtual de red, como Azure Firewall. Asegúrese de supervisar los registros del cortafuegos.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"severity": "Medio",
- "text": "El acceso a la red saliente debe controlarse",
- "waf": "Seguridad"
+ "text": "Virtual WAN administra la conectividad entre redes virtuales de radio para topologías basadas en WAN virtuales (sin necesidad de configurar el enrutamiento definido por el usuario [UDR] o NVA) y el rendimiento máximo de red para el tráfico de red virtual a red virtual en el mismo centro virtual es de 50 gigabits por segundo. Si es necesario, las zonas de aterrizaje de SAP pueden usar el emparejamiento de red virtual para conectarse a otras zonas de aterrizaje y superar esta limitación de ancho de banda.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Puede proporcionar una dirección IP de salida estable mediante la integración de red virtual y una puerta de enlace NAT de red virtual o una aplicación virtual de red como Azure Firewall. Esto permite a la parte receptora incluir en la lista de permitidos en función de la IP, en caso de que sea necesario. Tenga en cuenta que para las comunicaciones con los servicios de Azure, a menudo no es necesario depender de la dirección IP y, en su lugar, se deben usar mecanismos como los puntos de conexión de servicio. (Además, el uso de puntos de conexión privados en el extremo receptor evita que se produzca SNAT y proporciona un intervalo de IP de salida estable).",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
- "severity": "Bajo",
- "text": "Garantizar una IP estable para las comunicaciones salientes hacia las direcciones de Internet",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "No se recomienda la asignación de direcciones IP públicas a la máquina virtual que ejecuta SAP Workload.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Controle el acceso entrante a la red mediante una combinación de restricciones de acceso al Servicio de aplicaciones, puntos de conexión de servicio o puntos de conexión privados. Se pueden requerir y configurar diferentes restricciones de acceso para la propia aplicación web y el sitio de SCM.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
"severity": "Alto",
- "text": "El acceso a la red entrante debe controlarse",
- "waf": "Seguridad"
+ "text": "Considere la posibilidad de reservar la dirección IP en el lado de la recuperación ante desastres al configurar ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Protéjase contra el tráfico entrante malintencionado mediante un firewall de aplicaciones web como Application Gateway o Azure Front Door. Asegúrese de supervisar los registros del WAF.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"severity": "Alto",
- "text": "Uso de un WAF delante de App Service",
- "waf": "Seguridad"
+ "text": "Evite el uso de intervalos de direcciones IP superpuestos para los sitios de producción y recuperación ante desastres.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Asegúrese de que no se pueda omitir el WAF bloqueando el acceso solo al WAF. Use una combinación de restricciones de acceso, puntos de conexión de servicio y puntos de conexión privados.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "Alto",
- "text": "Evite que se omita WAF",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Aunque Azure le ayuda a crear varias subredes delegadas en una red virtual, solo puede existir una subred delegada en una red virtual para Azure NetApp Files. Se producirá un error al intentar crear un nuevo volumen si se utiliza más de una subred delegada para Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Establezca la directiva TLS mínima en 1.2 en la configuración de App Service.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"severity": "Medio",
- "text": "Establezca la directiva TLS mínima en 1.2",
+ "text": "Use Azure Firewall para controlar el tráfico de salida de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado de tráfico este/oeste (si la organización lo requiere)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure App Service para que use solo HTTPS. Esto hace que App Service se redirija de HTTP a HTTPS. Considere seriamente el uso de HTTP Strict Transport Security (HSTS) en su código o desde su WAF, que informa a los navegadores que solo se debe acceder al sitio mediante HTTPS.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar solo HTTPS",
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Application Gateway y Web Application Firewall tienen limitaciones cuando Application Gateway actúa como proxy inverso para aplicaciones web de SAP, como se muestra en la comparación entre Application Gateway, SAP Web Dispatcher y otros servicios de terceros.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "No utilice caracteres comodín en la configuración de CORS, ya que esto permite que todos los orígenes accedan al servicio (lo que anula el propósito de CORS). En concreto, solo permite los orígenes que esperas poder acceder al servicio.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
- "severity": "Alto",
- "text": "Los comodines no deben usarse para CORS",
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Use las directivas de Azure Front Door y WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "La depuración remota no debe estar activada en producción, ya que esto abre puertos adicionales en el servicio, lo que aumenta la superficie expuesta a ataques. Tenga en cuenta que el servicio desactiva la depuración remota automáticamente después de 48 horas.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
- "severity": "Alto",
- "text": "Desactivar la depuración remota",
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Aproveche las directivas de firewall de aplicaciones web de Azure Front Door cuando use Azure Front Door y Application Gateway para proteger las aplicaciones HTTP/S. Bloquee Application Gateway para recibir tráfico solo desde Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Habilite Defender para App Service. Esto (entre otras amenazas) detecta comunicaciones a direcciones IP maliciosas conocidas. Revise las recomendaciones de Defender para App Service como parte de las operaciones.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Habilitación de Defender for Cloud: Defender for App Service",
+ "text": "Utilice un firewall de aplicaciones web para analizar su tráfico cuando esté expuesto a Internet. Otra opción es usarlo con el equilibrador de carga o con recursos que tengan funcionalidades de firewall integradas, como Application Gateway o soluciones de terceros.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure proporciona protección básica contra DDoS en su red, que se puede mejorar con funcionalidades inteligentes de DDoS Standard que aprenden sobre los patrones de tráfico normales y pueden detectar comportamientos inusuales. DDoS Standard se aplica a una red virtual, por lo que debe configurarse para el recurso de red delante de la aplicación, como Application Gateway o una aplicación virtual de red.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Habilitación del estándar de protección DDoS en la red virtual de WAF",
- "waf": "Seguridad"
+ "text": "Use Virtual WAN para implementaciones de Azure en redes nuevas, grandes o globales en las que necesite conectividad de tránsito global entre regiones de Azure y ubicaciones locales. Con este enfoque, no tendrá que configurar manualmente el enrutamiento transitivo para las redes de Azure y puede seguir un estándar para las implementaciones de SAP en Azure.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas a través de una red virtual desde Azure Container Registry mediante su punto de conexión privado y la configuración de la aplicación \"WEBSITE_PULL_IMAGE_OVER_VNET\".",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"severity": "Medio",
- "text": "Extracción de contenedores a través de una red virtual",
+ "text": "Para evitar la pérdida de datos, use Azure Private Link para acceder de forma segura a los recursos de la plataforma como servicio, como Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, etc. Azure Private Endpoint también puede ayudar a proteger el tráfico entre redes virtuales y servicios como Azure Storage, Azure Backup, etc. El tráfico entre la red virtual y el servicio habilitado para el punto de conexión privado viaja a través de la red global de Microsoft, lo que impide su exposición a la red pública de Internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Realice una prueba de penetración en la aplicación web siguiendo las reglas de participación de las pruebas de penetración.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Asegúrese de que las redes aceleradas de Azure estén habilitadas en las máquinas virtuales usadas en las capas de aplicación SAP y DBMS.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Rendimiento"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Realizar una prueba de penetración",
+ "text": "Asegúrese de que las implementaciones internas de Azure Load Balancer están configuradas para usar Direct Server Return (DSR). Esta configuración (Habilitación de IP flotante) reducirá la latencia cuando se utilicen configuraciones de equilibrador de carga internas para configuraciones de alta disponibilidad en la capa DBMS.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Implemente código de confianza que se haya validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"severity": "Medio",
- "text": "Implementación de código validado",
+ "text": "Puede usar el grupo de seguridad de aplicaciones (ASG) y las reglas de NSG para definir listas de control de acceso de seguridad de red entre la aplicación SAP y las capas de DBMS. Los ASG agrupan las máquinas virtuales para ayudar a administrar su seguridad.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Utilice las versiones más recientes de plataformas, lenguajes de programación, protocolos y marcos compatibles.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"severity": "Alto",
- "text": "Utilizar plataformas, lenguajes, protocolos y marcos actualizados",
- "waf": "Seguridad"
+ "text": "No se admite la colocación de la capa de aplicación de SAP y DBMS de SAP en diferentes redes virtuales de Azure que no están emparejadas.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "Bajo",
- "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Para obtener una latencia de red óptima con aplicaciones SAP, considere la posibilidad de usar grupos de selección de ubicación por proximidad de Azure.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Los espacios de nombres de Azure Event Hubs permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Event Hubs para requerir que los clientes envíen y reciban datos con una versión más reciente de TLS. Si un espacio de nombres de Event Hubs requiere una versión mínima de TLS, se producirá un error en las solicitudes realizadas con una versión anterior. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
- "severity": "Medio",
- "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "NO se admite en absoluto la ejecución de una capa de servidor de aplicaciones SAP y una capa de DBMS dividida entre local y Azure. Ambas capas deben residir completamente en el entorno local o en Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Al crear un espacio de nombres de Event Hubs, se crea automáticamente una regla de directiva denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "Medio",
- "text": "Evite usar la cuenta raíz cuando no sea necesario",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Seguridad"
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "No se recomienda hospedar el sistema de administración de bases de datos (DBMS) y las capas de aplicación de los sistemas SAP en diferentes redes virtuales y conectarlas con el emparejamiento de redes virtuales debido a los costos sustanciales que puede producir un tráfico de red excesivo entre las capas. Se recomienda usar subredes dentro de la red virtual de Azure para separar la capa de aplicación de SAP y la capa de DBMS.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Las identidades administradas para los recursos de Azure pueden autorizar el acceso a los recursos de Event Hubs mediante credenciales de Azure AD desde aplicaciones que se ejecutan en Azure Virtual Machines (VM), aplicaciones de funciones, conjuntos de escalado de máquinas virtuales y otros servicios. Mediante el uso de identidades administradas para los recursos de Azure junto con la autenticación de Azure AD, puede evitar el almacenamiento de credenciales con las aplicaciones que se ejecutan en la nube. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Si utiliza Load Balancer con sistemas operativos invitados Linux, compruebe que el parámetro de red de Linux net.ipv4.tcp_timestamps esté establecido en 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Rendimiento"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"severity": "Medio",
- "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Event Hub. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "En el caso de las implementaciones de SAP RISE/ECS, el emparejamiento virtual es la forma preferida de establecer la conectividad con el entorno de Azure existente del cliente. Tanto la red virtual de SAP como las redes virtuales del cliente están protegidas con grupos de seguridad de red (NSG), lo que permite la comunicación en SAP y los puertos de base de datos a través del emparejamiento de redes virtuales",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Al crear permisos, proporcione un control específico sobre el acceso de un cliente al Centro de eventos de Azure. Los permisos del Centro de eventos de Azure pueden y deben limitarse al nivel de recurso individual, por ejemplo, grupo de consumidores, entidad del centro de eventos, espacios de nombres del centro de eventos, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "Alto",
- "text": "Uso de RBAC de plano de datos con privilegios mínimos",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Seguridad"
+ "text": "Revise las copias de seguridad de bases de datos de SAP HANA para máquinas virtuales de Azure.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Los registros de recursos del Centro de eventos de Azure incluyen registros operativos, registros de red virtual y registros de Kafka. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para todas las operaciones de acceso al plano de datos (como eventos de envío o recepción) en Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Medio",
- "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para capturar métricas y registros, como registros de recursos, registros de auditoría en tiempo de ejecución y registros de Kafka",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Seguridad"
+ "text": "Revise la supervisión integrada de Site Recovery, donde se use para SAP.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "De forma predeterminada, Azure Event Hub tiene una dirección IP pública y es accesible a través de Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y Azure Event Hubs a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se usan. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Revise la guía Supervisión del panorama del sistema SAP HANA.",
+ "waf": "Operaciones"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de usar puntos de conexión privados para acceder al Centro de eventos de Azure y deshabilitar el acceso a la red pública cuando corresponda.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Seguridad"
+ "text": "Revise las estrategias de copia de seguridad de Oracle Database en máquinas virtuales Linux de Azure.",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Con el firewall IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"severity": "Medio",
- "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres del Centro de eventos de Azure desde direcciones IP o intervalos específicos",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Seguridad"
+ "text": "Revise el uso de Azure Blob Storage con SQL Server 2016.",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"severity": "Medio",
- "text": "Aproveche el Manual de Resiliencia de los TLC",
- "waf": "Fiabilidad"
+ "text": "Revise el uso de Copia de seguridad automatizada v2 para máquinas virtuales de Azure.",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": " Esto se activará automáticamente para un nuevo espacio de nombres EH creado desde el portal con SKU Premium, Dedicado o Estándar en una región habilitada para zonas. Tanto los metadatos de EH como los propios datos de eventos se replican en todas las zonas",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad si corresponde regionalmente",
- "waf": "Fiabilidad"
+ "text": "Habilitación del acelerador de escritura para la serie M cuando se utilizan discos premium (V1)",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"severity": "Medio",
- "text": "Usa las SKU Premium o Dedicadas para obtener un rendimiento predecible",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "La característica integrada de recuperación ante desastres geográfica, cuando está habilitada, garantiza que toda la configuración de un espacio de nombres (Event Hubs, grupos de consumidores y configuración) se replique continuamente desde un espacio de nombres principal a un espacio de nombres secundario, y permite un movimiento de conmutación por error de una sola vez del principal al secundario en cualquier momento. La característica Activo/Pasivo está diseñada para facilitar la recuperación y el abandono de una región de Azure con errores sin tener que cambiar las configuraciones de la aplicación",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
- "severity": "Alto",
- "text": "Planeación de la recuperación ante desastres geográfica mediante la configuración pasiva activa",
- "waf": "Fiabilidad"
+ "text": "Pruebe la latencia de la zona de disponibilidad.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Debe utilizarse para configuraciones de recuperación ante desastres en las que no se puede tolerar una interrupción o pérdida de datos de eventos en la región inactiva. En estos casos, siga las instrucciones de replicación y no use la capacidad de recuperación ante desastres geográfica integrada (activa/pasiva). Con Activo/Activo, mantenga varios centros de eventos en diferentes regiones y espacios de nombres, y los eventos se replicarán entre los centros",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"severity": "Medio",
- "text": "En el caso de las aplicaciones críticas para la empresa, use la configuración Active Active",
- "waf": "Fiabilidad"
+ "text": "Active SAP EarlyWatch Alert para todos los componentes de SAP.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"severity": "Medio",
- "text": "Diseño de centros de eventos resilientes",
- "waf": "Fiabilidad"
+ "text": "Revise la latencia del servidor de aplicaciones SAP al servidor de bases de datos mediante el informe ABAPMeter de SAP /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Siga las barreras de seguridad de Metaprompting para una IA responsable",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Revise la supervisión del rendimiento de SQL Server mediante CCMS.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Considere la posibilidad de crear patrones de puerta de enlace con APIM o soluciones como AI Central para mejorar la limitación de velocidad, el equilibrio de carga, la autenticación y el registro",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Pruebe la latencia de red entre las máquinas virtuales de la capa de aplicación de SAP y las máquinas virtuales de DBMS (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Habilitación de la supervisión para las instancias de AOAI",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Revise las alertas de SAP HANA Studio.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Cree alertas para notificar a los equipos de eventos, como una entrada en el registro de actividad creada por una acción realizada en el recurso, como la regeneración de sus claves de suscripción, o un umbral de métrica, como el número de errores que superan los 10 en una hora",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Realice comprobaciones de estado de SAP HANA mediante HANA_Configuration_Minichecks.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Supervise el uso de tokens para evitar interrupciones del servicio debido a la capacidad",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "Si ejecuta máquinas virtuales Windows y Linux en Azure, en el entorno local o en otros entornos en la nube, puede usar el Centro de administración de actualizaciones de Azure Automation para administrar las actualizaciones del sistema operativo, incluidas las revisiones de seguridad.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"severity": "Medio",
- "text": "Observe métricas como tokens de inferencia procesados, tokens de finalización generados, monitoree el límite de velocidad",
- "waf": "Excelencia Operacional"
+ "text": "Revise de forma rutinaria las notas del OSS de seguridad de SAP, ya que SAP publica parches de seguridad muy críticos, o correcciones en caliente, que requieren una acción inmediata para proteger sus sistemas SAP.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"severity": "Bajo",
- "text": "Si los diagnósticos no son suficientes para usted, considere la posibilidad de usar una puerta de enlace como Azure API Managements frente a Azure OpenAI para registrar tanto los mensajes entrantes como las respuestas salientes, cuando esté permitido",
- "waf": "Excelencia Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Use la infraestructura como código para implementar el servicio Azure OpenAI, las implementaciones de modelos y todos los recursos relacionados",
- "waf": "Excelencia Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Uso de la autenticación de Microsoft Entra con identidad administrada en lugar de clave de API",
+ "text": "En el caso de SAP en SQL Server, puede deshabilitar la cuenta de administrador del sistema de SQL Server porque los sistemas SAP en SQL Server no usan la cuenta. Asegúrese de que otro usuario con derechos de administrador del sistema pueda acceder al servidor antes de deshabilitar la cuenta de administrador del sistema original.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"severity": "Alto",
- "text": "Evalúe el rendimiento/precisión del sistema con un conjunto de datos dorado conocido que tenga las entradas y las respuestas correctas. Aproveche las capacidades de PromptFlow para la evaluación.",
- "waf": "Excelencia Operacional"
+ "text": "Deshabilite xp_cmdshell. La característica SQL Server xp_cmdshell habilita un shell de comandos del sistema operativo interno de SQL Server. Es un riesgo potencial en las auditorías de seguridad.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "Alto",
- "text": "Evaluación del uso del modelo de rendimiento aprovisionado ",
- "waf": "Rendimiento"
+ "text": "El cifrado de servidores de base de datos de SAP HANA en Azure usa la tecnología de cifrado nativa de SAP HANA. Además, si usa SQL Server en Azure, use el cifrado de datos transparente (TDE) para proteger los datos y los archivos de registro y asegurarse de que las copias de seguridad también estén cifradas.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Revisión e implementación de la seguridad del contenido de Azure AI",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
+ "severity": "Medio",
+ "text": "El cifrado de Azure Storage está habilitado para todas las cuentas de Azure Resource Manager y de almacenamiento clásico, y no se puede deshabilitar. Dado que los datos están cifrados de forma predeterminada, no es necesario modificar el código ni las aplicaciones para usar el cifrado de Azure Storage.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"severity": "Alto",
- "text": "Defina y evalúe el rendimiento del sistema en función de los tokens y la respuesta por minuto y alinee con los requisitos",
- "waf": "Rendimiento"
+ "text": "Uso de Azure Key Vault para almacenar los secretos y las credenciales",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "Medio",
- "text": "Mejore la latencia del sistema limitando el tamaño de los tokens, las opciones de transmisión",
- "waf": "Rendimiento"
+ "text": "Se recomienda bloquear los recursos de Azure después de la implementación correcta para protegerse contra cambios no autorizados. También puede aplicar restricciones y reglas de LOCK por suscripción mediante directivas de Azure personalizadas (rol Custome).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"severity": "Medio",
- "text": "Calcule las demandas de elasticidad para determinar la segregación de solicitudes sincrónicas y por lotes en función de la prioridad. Para la prioridad alta, utilice el enfoque sincrónico y para la prioridad baja, se prefiere el procesamiento por lotes asincrónico con cola",
- "waf": "Rendimiento"
+ "text": "Aprovisione Azure Key Vault con las directivas de eliminación temporal y purga habilitadas para permitir la protección de retención para los objetos eliminados.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
"severity": "Alto",
- "text": "Compare los requisitos de consumo de tokens en función de las demandas estimadas de los consumidores. Considere la posibilidad de usar la herramienta de pruebas comparativas de Azure OpenAI para ayudarle a validar el rendimiento si usa implementaciones de unidades de rendimiento aprovisionadas",
- "waf": "Rendimiento"
+ "text": "En función de los requisitos existentes, controles normativos y de cumplimiento (internos y externos): determine qué rol de Azure Policies y Azure RBAC son necesarios",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Si usa unidades de rendimiento aprovisionadas (PTU), considere la posibilidad de implementar una implementación de token por minuto (TPM) para las solicitudes de desbordamiento. Use una puerta de enlace para enrutar las solicitudes a la implementación de TPM cuando se alcancen los límites de PTU.",
- "waf": "Rendimiento"
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Al habilitar Microsoft Defender para punto de conexión en el entorno de SAP, se recomienda excluir los archivos de datos y registros en servidores DBMS en lugar de dirigirse a todos los servidores. Siga las recomendaciones de su proveedor de DBMS al excluir archivos de destino.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"severity": "Alto",
- "text": "Elija el modelo adecuado para la tarea correcta. Elija modelos con el equilibrio adecuado entre velocidad, calidad de respuesta y complejidad de salida",
- "waf": "Rendimiento"
+ "text": "Delegue un rol personalizado de administrador de SAP con acceso Just-In-Time de Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Tener una línea de base para el rendimiento sin ajuste fino para saber si el ajuste fino ha mejorado o no el rendimiento del modelo",
- "waf": "Rendimiento"
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "cifre los datos en tránsito integrando el producto de seguridad de terceros con comunicaciones de red seguras (SNC) para DIAG (SAP GUI), RFC y SPNEGO para HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "Bajo",
- "text": "Implementación de varias instancias de OAI en todas las regiones",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Implemente reintentos y comprobaciones de estado con el patrón de puerta de enlace como APIM",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "Medio",
- "text": "Asegúrese de tener cuotas adecuadas de TPM y RPM para la carga de trabajo",
- "waf": "Fiabilidad"
+ "text": "De forma predeterminada, use claves administradas por Microsoft para la funcionalidad de cifrado principal y use claves administradas por el cliente cuando sea necesario.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Revise las consideraciones de la guía del kit de herramientas de HAI y aplique esas prácticas de interacción para el slution",
- "waf": "Excelencia Operacional"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Use una instancia de Azure Key Vault por aplicación, por entorno, por región.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Implemente modelos de ajuste de precisión independientes en todas las regiones si se emplea el ajuste de precisión",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Para controlar y administrar las claves y los secretos de cifrado de disco para sistemas operativos Windows y Windows que no son de HANA, use Azure Key Vault. SAP HANA no es compatible con Azure Key Vault, por lo que debe usar métodos alternativos como SAP ABAP o claves SSH.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Realice copias de seguridad y replique regularmente los datos críticos para garantizar la disponibilidad y la capacidad de recuperación de los datos en caso de pérdida de datos o fallos del sistema. Aproveche los servicios de copia de seguridad y recuperación ante desastres de Azure para proteger sus datos.",
- "waf": "Fiabilidad"
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Personalice los roles de control de acceso basado en roles (RBAC) para las suscripciones de SAP en Azure spoke para evitar cambios accidentales relacionados con la red",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"severity": "Alto",
- "text": "Los niveles de servicio de búsqueda de Azure AI deben elegirse para tener un Acuerdo de Nivel de Servicio ",
- "waf": "Fiabilidad"
+ "text": "Aísle las DMZ y las NVA del resto del patrimonio de SAP, configure Azure Private Link y administre y controle de forma segura los recursos de SAP en Azure",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
"severity": "Bajo",
- "text": "Clasifique los datos y la confidencialidad, etiquetando con Microsoft Purview antes de generar las incrustaciones y asegúrese de tratar las incrustaciones generadas con la misma confidencialidad y clasificación",
+ "text": "Considere la posibilidad de usar el software antimalware de Microsoft en Azure para proteger sus máquinas virtuales de archivos malintencionados, adware y otras amenazas.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Cifre los datos utilizados para RAG con cifrado SSE/Disk con BYOK opcional",
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "Para una protección aún más eficaz, considere la posibilidad de usar Microsoft Defender para punto de conexión.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"severity": "Alto",
- "text": "Asegúrese de que TLS se aplica a los datos en tránsito a través de fuentes de datos, la búsqueda de IA utilizada para la generación aumentada de recuperación (RAG) y la comunicación de LLM",
+ "text": "Aísle los servidores de bases de datos y aplicaciones de SAP de Internet o de la red local pasando todo el tráfico a través de la red virtual del concentrador, que está conectada a la red radial mediante el emparejamiento de red virtual. Las redes virtuales emparejadas garantizan que la solución de SAP en Azure esté aislada de la red pública de Internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Use RBAC para administrar el acceso a los servicios de Azure OpenAI. Asigne los permisos adecuados a los usuarios y restrinja el acceso en función de sus funciones y responsabilidades",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Bajo",
+ "text": "En el caso de las aplicaciones orientadas a Internet, como SAP Fiori, asegúrese de distribuir la carga según los requisitos de la aplicación mientras se mantienen los niveles de seguridad. Para la seguridad de nivel 7, puede usar un firewall de aplicaciones web (WAF) de terceros disponible en Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Medio",
- "text": "Implemente técnicas de cifrado, enmascaramiento o redacción de datos para ocultar datos confidenciales o reemplazarlos con valores ofuscados en entornos que no sean de producción o al compartir datos con fines de prueba o solución de problemas",
+ "text": "Para habilitar la comunicación segura en las soluciones de Azure Monitor para SAP, puede optar por usar un certificado raíz o un certificado de servidor. Le recomendamos encarecidamente que utilice certificados raíz.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"severity": "Alto",
- "text": "Use Azure Defender para detectar y responder a las amenazas de seguridad y configurar mecanismos de supervisión y alerta para identificar actividades sospechosas o infracciones. Aproveche Azure Sentinel para la detección y respuesta a amenazas avanzadas",
+ "text": "Asegúrese de que los controladores de dominio ADDS se implementan en la suscripción de identidad en Azure nativo",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"severity": "Medio",
- "text": "Establezca políticas de retención y eliminación de datos para cumplir con las regulaciones de cumplimiento. Implemente métodos de eliminación seguros para los datos que ya no son necesarios y mantenga un registro de auditoría de las actividades de retención y eliminación de datos",
+ "text": "Asegúrese de que los sitios y servicios de ADDS están configurados para mantener las solicitudes de autenticación de los recursos basados en Azure (incluida Azure VMware Solution) locales en Azure",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"severity": "Alto",
- "text": "Implemente los escudos de aviso y la detección de conexión a tierra mediante Content Safety ",
- "waf": "Excelencia Operacional"
+ "text": "Asegúrese de que vCenter esté conectado a ADDS para habilitar la autenticación basada en \"cuentas de usuario designadas\"",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Garantice el cumplimiento de las normativas de protección de datos pertinentes, como el RGPD o la HIPAA, mediante la implementación de controles de privacidad y la obtención de los consentimientos o permisos necesarios para las actividades de tratamiento de datos.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "Asegúrese de que la conexión de vCenter a ADDS utilice un protocolo seguro (LDAPS)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"severity": "Medio",
- "text": "Eduque a sus empleados sobre las mejores prácticas de seguridad de datos, la importancia de manejar los datos de forma segura y los riesgos potenciales asociados con las violaciones de datos. Anímelos a seguir diligentemente los protocolos de seguridad de datos.",
+ "text": "La cuenta de CloudAdmin en vCenter IdP solo se utiliza como una cuenta de emergencia (break-glass)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"severity": "Alto",
- "text": "Mantenga los datos de producción separados de los datos de desarrollo y pruebas. Utilice únicamente datos confidenciales reales en producción y utilice datos anónimos o sintéticos en entornos de desarrollo y prueba.",
+ "text": "Asegúrese de que NSX-Manager esté integrado con un proveedor de identidades externo (LDAPS)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"severity": "Medio",
- "text": "Si tiene distintos niveles de confidencialidad de datos, considere la posibilidad de crear índices independientes para cada nivel. Por ejemplo, podría tener un índice para los datos generales y otro para los datos confidenciales, cada uno gobernado por diferentes protocolos de acceso",
+ "text": "¿Se ha creado un modelo RBAC para su uso en VMware vSphere?",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"severity": "Medio",
- "text": "Lleve la segregación un paso más allá colocando conjuntos de datos confidenciales en diferentes instancias del servicio. Cada instancia se puede controlar con su propio conjunto específico de políticas RBAC",
+ "text": "Los permisos RBAC deben concederse a grupos ADDS y no a usuarios específicos",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"severity": "Alto",
- "text": "Reconozca que las incrustaciones y los vectores generados a partir de información confidencial son en sí mismos confidenciales. Estos datos deben recibir las mismas medidas de protección que el material de origen",
+ "text": "Los permisos de RBAC en el recurso de Azure VMware Solution en Azure están \"bloqueados\" solo para un conjunto limitado de propietarios",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"severity": "Alto",
- "text": "Aplique RBAC a los almacenes de datos que tienen incrustaciones y vectores y alcance el acceso en función de los requisitos de acceso del rol",
+ "text": "Asegúrese de que todos los roles personalizados tengan el ámbito de las autorizaciones permitidas de CloudAdmin",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"severity": "Alto",
- "text": "Configure un punto de conexión privado para que los servicios de IA restrinjan el acceso al servicio dentro de su red",
- "waf": "Seguridad"
+ "text": "¿Se ha seleccionado el modelo de conectividad de Azure VMware Solution correcto para el caso de uso del cliente en cuestión?",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
"severity": "Alto",
- "text": "Aplique un estricto control del tráfico entrante y saliente con Azure Firewall y UDR, y limite los puntos de integración externos",
- "waf": "Seguridad"
+ "text": "Asegúrese de que las conexiones de ExpressRoute o VPN desde el entorno local a Azure se supervisan mediante el \"monitor de conexiones\"",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Implemente la segmentación de la red y los controles de acceso para restringir el acceso a la aplicación LLM solo a los usuarios y sistemas autorizados y evitar el movimiento lateral",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "Asegúrese de que se crea un monitor de conexión desde un recurso nativo de Azure a una máquina virtual de Azure VMware Solution para supervisar la conexión de ExpressRoute back-end de Azure VMware Solution",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"severity": "Medio",
- "text": "Utilice herramientas de compresión rápida como LLMLingua o gprtrim",
- "waf": "Optimización de costes"
+ "text": "Asegúrese de que se crea un monitor de conexión desde un recurso local a una máquina virtual de Azure VMware Solution para supervisar la conectividad de extremo a extremo",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"severity": "Alto",
- "text": "Asegúrese de que las API y los puntos finales utilizados por la aplicación LLM estén correctamente protegidos con mecanismos de autenticación y autorización, como identidades administradas, claves de API u OAuth, para evitar el acceso no autorizado.",
- "waf": "Seguridad"
+ "text": "Cuando se utiliza el servidor de rutas, asegúrese de que no se propaguen más de 1000 rutas desde el servidor de rutas a la puerta de enlace de ExR al entorno local (límite de ARS).",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Aplique mecanismos sólidos de autenticación de usuario final, como la autenticación multifactor, para evitar el acceso no autorizado a la aplicación LLM y a los recursos de red asociados",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "¿Se ha implementado Privileged Identity Management para los roles que administran el recurso de Azure VMware Solution en Azure Portal (no se permiten permisos permanentes)?",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Implemente herramientas de monitoreo de red para detectar y analizar el tráfico de red en busca de actividades sospechosas o maliciosas. Habilite el registro para capturar eventos de red y facilitar el análisis forense en caso de incidentes de seguridad",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Los informes de auditoría de Privileged Identity Management deben implementarse para los roles PIM de Azure VMware Solution",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"severity": "Medio",
- "text": "Realizar auditorías de seguridad y pruebas de penetración para identificar y abordar cualquier debilidad o vulnerabilidad de seguridad de red en la infraestructura de red de la aplicación LLM",
+ "text": "Si se usa Privileged Identity Management, asegúrese de que se crea una cuenta válida habilitada para Entra ID con un registro SMTP válido para las notificaciones de reemplazo automático de host de Azure VMware Solution. (se requieren permisos permanentes)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "severity": "Bajo",
- "text": "Los servicios de Azure AI están etiquetados correctamente para una mejor administración",
- "waf": "Excelencia Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
- "severity": "Bajo",
- "text": "Las cuentas de Azure AI Service siguen las convenciones de nomenclatura de la organización",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Limite el uso de la cuenta de CloudAdmin solo al acceso de emergencia",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Los registros de diagnóstico en los recursos de servicios de Azure AI deben estar habilitados",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "Cree funciones RBAC personalizadas en vCenter para implementar un modelo de privilegios mínimos dentro de vCenter",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Se recomienda deshabilitar el acceso a claves (autenticación local) por seguridad. Después de deshabilitar el acceso basado en claves, el identificador de Microsoft Entra se convierte en el único método de acceso, lo que permite mantener el principio de privilegio mínimo y el control granular. ",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "Es un proceso definido para rotar periódicamente las credenciales de administrador de la nube (vCenter) y administrador (NSX)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"severity": "Alto",
- "text": "Almacene y administre claves de forma segura con Azure Key Vault. Evite codificar de forma rígida o incrustar claves confidenciales en el código de la aplicación de LLM y recupérelas de forma segura de Azure Key Vault mediante identidades administradas",
+ "text": "Uso de un proveedor de identidades centralizado que se usará para las cargas de trabajo (VM) que se ejecutan en Azure VMware Solution",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Rotar y expirar periódicamente las claves almacenadas en Azure Key Vault para minimizar el riesgo de acceso no autorizado.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "¿Se implementa el filtrado de tráfico este-oeste en NSX-T?",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"severity": "Alto",
- "text": "Use tiktoken para comprender los tamaños de los tokens para las optimizaciones de tokens en el modo conversacional",
- "waf": "Optimización de costes"
+ "text": "Las cargas de trabajo de Azure VMware Solution no se exponen directamente a Internet. El tráfico se filtra e inspecciona mediante Azure Application Gateway, Azure Firewall o soluciones de terceros",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"severity": "Alto",
- "text": "Siga prácticas de codificación seguras para evitar vulnerabilidades comunes, como ataques de inyección, secuencias de comandos entre sitios (XSS) o errores de configuración de seguridad.",
+ "text": "La auditoría y el registro se implementan para las solicitudes entrantes de Internet a Azure VMware Solution y a las cargas de trabajo basadas en Azure VMware Solution",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Configurar un proceso para actualizar y parchear regularmente las bibliotecas de LLM y otros componentes del sistema",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "La supervisión de sesiones se implementa para las conexiones salientes a Internet desde Azure VMware Solution o cargas de trabajo basadas en Azure VMware Solution para identificar actividades sospechosas o malintencionadas",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Cumplir con los términos de uso, las directivas y las directrices de Azure OpenAI u otros LLM, así como con los casos de uso permitidos.",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
+ "severity": "Medio",
+ "text": "¿Está habilitada la protección estándar de DDoS en la subred de puerta de enlace de ExR/VPN en Azure?",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"severity": "Medio",
- "text": "Comprenda la diferencia en el costo de los modelos base y los modelos ajustados y los tamaños de paso de token",
- "waf": "Optimización de costes"
+ "text": "Use una estación de trabajo de acceso con privilegios (PAW) dedicada para administrar Azure VMware Solution, vCenter, NSX Manager y HCX Manager",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Solicitudes por lotes, siempre que sea posible, para minimizar la sobrecarga por llamada, lo que puede reducir los costos generales. Asegúrese de optimizar el tamaño del lote",
- "waf": "Optimización de costes"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"severity": "Medio",
- "text": "Configure un sistema de seguimiento de costos que supervise el uso del modelo y use esa información para ayudar a informar las opciones de modelos y los tamaños indicados",
- "waf": "Optimización de costes"
+ "text": "Habilitación de la detección avanzada de amenazas (Microsoft Defender for Cloud, también conocida como ASC) para cargas de trabajo que se ejecutan en Azure VMware Solution",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"severity": "Medio",
- "text": "Establezca un límite máximo en el número de tokens por respuesta de modelo. Optimice el tamaño para asegurarse de que sea lo suficientemente grande para una respuesta válida",
- "waf": "Optimización de costes"
+ "text": "Use Azure ARC for Servers para controlar correctamente las cargas de trabajo que se ejecutan en Azure VMware Solution mediante tecnologías nativas de Azure (Azure ARC for Azure VMware Solution aún no está disponible)",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Revise las instrucciones proporcionadas sobre la configuración de la búsqueda de IA para la confiabilidad",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "Bajo",
+ "text": "Asegúrese de que las cargas de trabajo de Azure VMware Solution usen suficiente cifrado de datos durante el tiempo de ejecución (como el cifrado de disco invitado y SQL TDE). (El cifrado de vSAN en reposo es el predeterminado)",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Planifique y administre el almacenamiento de vectores de búsqueda de IA",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "Bajo",
+ "text": "Cuando se usa el cifrado en invitado, almacene las claves de cifrado en Azure Key Vault siempre que sea posible",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"severity": "Medio",
- "text": "Aplique prácticas de LLMOps para automatizar la gestión del ciclo de vida de sus aplicaciones GenAI",
- "waf": "Excelencia Operacional"
+ "text": "Considere la posibilidad de usar la compatibilidad con actualizaciones de seguridad extendidas para las cargas de trabajo que se ejecutan en Azure VMware Solution (Azure VMware Solution es apta para ESU)",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"severity": "Alto",
- "text": "Evalúe el uso de los modelos de facturación: PAYG frente a PTU",
- "waf": "Optimización de costes"
+ "text": "Asegúrese de que se utiliza el método de redundancia de datos de vSAN adecuado (especificación RAID)",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Evalúe la calidad de los mensajes y las aplicaciones al cambiar entre versiones de modelo",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Asegúrese de que la directiva de error de tolerancia esté implementada para satisfacer sus necesidades de almacenamiento de vSAN",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Evalúe, supervise y perfeccione sus aplicaciones GenAI para características como la fundamentación, la relevancia, la precisión, la coherencia, la fluidez,",
- "waf": "Excelencia Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Asegúrese de que ha solicitado una cuota suficiente, asegurándose de que ha tenido en cuenta el crecimiento y el requisito de recuperación ante desastres",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"severity": "Medio",
- "text": "Evalúe los resultados de búsqueda de Azure AI en función de diferentes parámetros de búsqueda",
- "waf": "Excelencia Operacional"
+ "text": "Asegúrese de que se comprenden las restricciones de acceso a ESXi, ya que existen límites de acceso que pueden afectar a las soluciones de terceros.",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"severity": "Medio",
- "text": "Considere los modelos de ajuste fino como una forma de aumentar la precisión solo cuando haya probado otros enfoques básicos como la ingeniería de avisos y RAG con sus datos",
- "waf": "Excelencia Operacional"
+ "text": "Asegúrese de tener una política en torno a la densidad y la eficiencia del host ESXi, teniendo en cuenta el tiempo de espera para solicitar nuevos nodos",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"severity": "Medio",
- "text": "Utilice técnicas de ingeniería rápida para mejorar la precisión de las respuestas de LLM",
- "waf": "Excelencia Operacional"
+ "text": "Asegúrese de que existe un buen proceso de administración de costos para Azure VMware Solution: se puede usar Azure Cost Management",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Equipo rojo con sus aplicaciones GenAI",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
+ "severity": "Bajo",
+ "text": "¿Se usan instancias reservadas de Azure para optimizar el costo de uso de Azure VMware Solution?",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"severity": "Medio",
- "text": "Proporcione a los usuarios finales opciones de puntuación para las respuestas de LLM y realice un seguimiento de estas puntuaciones. ",
- "waf": "Excelencia Operacional"
+ "text": "Tenga en cuenta el uso de Azure Private-Link cuando use otros servicios nativos de Azure",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
"severity": "Alto",
- "text": "Considere las prácticas de administración de cuotas",
- "waf": "Optimización de costes"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
- "severity": "Medio",
- "text": "Utilice soluciones de equilibrador de carga, como la puerta de enlace basada en APIM, para equilibrar la carga y la capacidad entre servicios y regiones",
- "waf": "Excelencia Operacional"
+ "text": "Asegúrese de que todos los recursos necesarios residen en las mismas zonas de disponibilidad de Azure",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que los controladores de dominio ADDS se implementan en la suscripción de identidad en Azure nativo",
+ "severity": "Medio",
+ "text": "Habilitación de cargas de trabajo de máquina virtual invitada de Microsoft Defender for Cloud for Azure VMware Solution",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que los sitios y servicios de ADDS están configurados para mantener las solicitudes de autenticación de los recursos basados en Azure (incluida Azure VMware Solution) locales en Azure",
+ "text": "Uso de servidores habilitados para Azure Arc para administrar las cargas de trabajo de máquinas virtuales invitadas de Azure VMware Solution",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
"service": "AVS",
"severity": "Alto",
- "text": "Asegúrese de que vCenter esté conectado a ADDS para habilitar la autenticación basada en \"cuentas de usuario designadas\"",
- "waf": "Seguridad"
+ "text": "Habilitación del registro de diagnósticos y métricas en Azure VMware Solution",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que la conexión de vCenter a ADDS utilice un protocolo seguro (LDAPS)",
- "waf": "Seguridad"
+ "text": "Implementación de los agentes de Log Analytics en cargas de trabajo de máquinas virtuales invitadas de Azure VMware Solution",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
"service": "AVS",
"severity": "Medio",
- "text": "La cuenta de CloudAdmin en vCenter IdP solo se utiliza como una cuenta de emergencia (break-glass)",
- "waf": "Seguridad"
+ "text": "Asegúrese de que dispone de una directiva y una solución de copia de seguridad documentadas e implementadas para las cargas de trabajo de máquina virtual de Azure VMware Solution",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que NSX-Manager esté integrado con un proveedor de identidades externo (LDAPS)",
+ "severity": "Medio",
+ "text": "Uso de Microsoft Defender for Cloud para la supervisión del cumplimiento de las cargas de trabajo que se ejecutan en Azure VMware Solution",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
"service": "AVS",
"severity": "Medio",
- "text": "¿Se ha creado un modelo RBAC para su uso en VMware vSphere?",
+ "text": "¿Se agregan las líneas base de cumplimiento aplicables a Microsoft Defender for Cloud?",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
"service": "AVS",
- "severity": "Medio",
- "text": "Los permisos RBAC deben concederse a grupos ADDS y no a usuarios específicos",
+ "severity": "Alto",
+ "text": "¿Se evaluó la residencia de datos al seleccionar las regiones de Azure que se usarán para la implementación de Azure VMware Solution?",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
"service": "AVS",
"severity": "Alto",
- "text": "Los permisos de RBAC en el recurso de Azure VMware Solution en Azure están \"bloqueados\" solo para un conjunto limitado de propietarios",
+ "text": "¿Son claras y documentadas las implicaciones del procesamiento de datos (proveedor de servicios / modelo de consumidor de servicios)?",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que todos los roles personalizados tengan el ámbito de las autorizaciones permitidas de CloudAdmin",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de usar CMK (clave administrada por el cliente) para vSAN solo si es necesario por motivos de cumplimiento.",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
"service": "AVS",
"severity": "Alto",
- "text": "¿Se ha seleccionado el modelo de conectividad de Azure VMware Solution correcto para el caso de uso del cliente en cuestión?",
- "waf": "Rendimiento"
+ "text": "Creación de paneles para habilitar la información principal de supervisión de Azure VMware Solution",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
"service": "AVS",
"severity": "Alto",
- "text": "Asegúrese de que las conexiones de ExpressRoute o VPN desde el entorno local a Azure se supervisan mediante el \"monitor de conexiones\"",
+ "text": "Creación de alertas de advertencia para umbrales críticos para alertas automáticas sobre el rendimiento de Azure VMware Solution (CPU >80 %, memoria media >80 %, vSAN >70 %)",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que se crea un monitor de conexión desde un recurso nativo de Azure a una máquina virtual de Azure VMware Solution para supervisar la conexión de ExpressRoute back-end de Azure VMware Solution",
+ "severity": "Alto",
+ "text": "Asegúrese de que se crea una alerta crítica para supervisar si el consumo de vSAN es inferior al 75 %, ya que se trata de un umbral de soporte de VMware",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que se crea un monitor de conexión desde un recurso local a una máquina virtual de Azure VMware Solution para supervisar la conectividad de extremo a extremo",
+ "severity": "Alto",
+ "text": "Asegúrese de que las alertas están configuradas para las alertas y notificaciones de Azure Service Health",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
"service": "AVS",
- "severity": "Alto",
- "text": "Cuando se utiliza el servidor de rutas, asegúrese de que no se propaguen más de 1000 rutas desde el servidor de rutas a la puerta de enlace de ExR al entorno local (límite de ARS).",
+ "severity": "Medio",
+ "text": "Configure el registro de Azure VMware Solution para que se envíe a una cuenta de Azure Storage o Azure EventHub para su procesamiento",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
"service": "AVS",
- "severity": "Alto",
- "text": "¿Se ha implementado Privileged Identity Management para los roles que administran el recurso de Azure VMware Solution en Azure Portal (no se permiten permisos permanentes)?",
- "waf": "Seguridad"
+ "severity": "Bajo",
+ "text": "Si se requiere una visión profunda de VMware vSphere: ¿Se utiliza vRealize Operations o vRealize Network Insights en la solución?",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
"service": "AVS",
"severity": "Alto",
- "text": "Los informes de auditoría de Privileged Identity Management deben implementarse para los roles PIM de Azure VMware Solution",
- "waf": "Seguridad"
+ "text": "Asegúrese de que la directiva de almacenamiento de vSAN para las máquinas virtuales NO sea la directiva de almacenamiento predeterminada, ya que esta directiva aplica el aprovisionamiento grueso",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
"service": "AVS",
"severity": "Medio",
- "text": "Si se usa Privileged Identity Management, asegúrese de que se crea una cuenta válida habilitada para Entra ID con un registro SMTP válido para las notificaciones de reemplazo automático de host de Azure VMware Solution. (se requieren permisos permanentes)",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
- "severity": "Alto",
- "text": "Limite el uso de la cuenta de CloudAdmin solo al acceso de emergencia",
- "waf": "Seguridad"
+ "text": "Asegúrese de que las bibliotecas de contenido de vSphere no se coloquen en vSAN, ya que vSAN es un recurso finito",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
"service": "AVS",
"severity": "Medio",
- "text": "Cree funciones RBAC personalizadas en vCenter para implementar un modelo de privilegios mínimos dentro de vCenter",
- "waf": "Seguridad"
+ "text": "Asegúrese de que los repositorios de datos de la solución de copia de seguridad se almacenen fuera del almacenamiento de vSAN. Ya sea en Azure nativo o en un almacén de datos respaldado por un grupo de discos",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
"service": "AVS",
"severity": "Medio",
- "text": "Es un proceso definido para rotar periódicamente las credenciales de administrador de la nube (vCenter) y administrador (NSX)",
- "waf": "Seguridad"
+ "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se administran de forma híbrida mediante Azure Arc para servidores (Arc para Azure VMware Solution está en versión preliminar)",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
"service": "AVS",
- "severity": "Alto",
- "text": "Uso de un proveedor de identidades centralizado que se usará para las cargas de trabajo (VM) que se ejecutan en Azure VMware Solution",
- "waf": "Seguridad"
+ "severity": "Medio",
+ "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se supervisan mediante Azure Log Analytics y Azure Monitor",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
"service": "AVS",
"severity": "Medio",
- "text": "¿Se implementa el filtrado de tráfico este-oeste en NSX-T?",
- "waf": "Seguridad"
+ "text": "Inclusión de cargas de trabajo que se ejecutan en Azure VMware Solution en las herramientas de administración de actualizaciones existentes o en Azure Update Management",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
"service": "AVS",
- "severity": "Alto",
- "text": "Las cargas de trabajo de Azure VMware Solution no se exponen directamente a Internet. El tráfico se filtra e inspecciona mediante Azure Application Gateway, Azure Firewall o soluciones de terceros",
- "waf": "Seguridad"
+ "severity": "Medio",
+ "text": "Uso de Azure Policy para incorporar cargas de trabajo de Azure VMware Solution en las soluciones de administración, supervisión y seguridad de Azure",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
"service": "AVS",
- "severity": "Alto",
- "text": "La auditoría y el registro se implementan para las solicitudes entrantes de Internet a Azure VMware Solution y a las cargas de trabajo basadas en Azure VMware Solution",
+ "severity": "Medio",
+ "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se incorporan a Microsoft Defender for Cloud",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
"service": "AVS",
"severity": "Medio",
- "text": "La supervisión de sesiones se implementa para las conexiones salientes a Internet desde Azure VMware Solution o cargas de trabajo basadas en Azure VMware Solution para identificar actividades sospechosas o malintencionadas",
- "waf": "Seguridad"
+ "text": "Asegúrese de que las copias de seguridad no se almacenen en vSAN, ya que vSAN es un recurso finito",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
"service": "AVS",
"severity": "Medio",
- "text": "¿Está habilitada la protección estándar de DDoS en la subred de puerta de enlace de ExR/VPN en Azure?",
- "waf": "Seguridad"
+ "text": "¿Se han considerado todas las soluciones de recuperación ante desastres y se ha decidido por la mejor solución para su negocio? [SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
"service": "AVS",
"severity": "Medio",
- "text": "Use una estación de trabajo de acceso con privilegios (PAW) dedicada para administrar Azure VMware Solution, vCenter, NSX Manager y HCX Manager",
- "waf": "Seguridad"
+ "text": "Uso de Azure Site Recovery cuando la tecnología de recuperación ante desastres sea IaaS nativa de Azure",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
"service": "AVS",
- "severity": "Medio",
- "text": "Habilitación de la detección avanzada de amenazas (Microsoft Defender for Cloud, también conocida como ASC) para cargas de trabajo que se ejecutan en Azure VMware Solution",
- "waf": "Seguridad"
+ "severity": "Alto",
+ "text": "Utilice planes de recuperación automatizados con cualquiera de las soluciones ante desastres, evite las tareas manuales tanto como sea posible",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
"service": "AVS",
"severity": "Medio",
- "text": "Use Azure ARC for Servers para controlar correctamente las cargas de trabajo que se ejecutan en Azure VMware Solution mediante tecnologías nativas de Azure (Azure ARC for Azure VMware Solution aún no está disponible)",
- "waf": "Seguridad"
+ "text": "Usar el par de regiones geopolíticas como entorno secundario de recuperación ante desastres",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
"service": "AVS",
- "severity": "Bajo",
- "text": "Asegúrese de que las cargas de trabajo de Azure VMware Solution usen suficiente cifrado de datos durante el tiempo de ejecución (como el cifrado de disco invitado y SQL TDE). (El cifrado de vSAN en reposo es el predeterminado)",
- "waf": "Seguridad"
+ "severity": "Alto",
+ "text": "Utilice 2 espacios de direcciones diferentes entre las regiones, por ejemplo: 10.0.0.0/16 y 192.168.0.0/16 para las diferentes regiones",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
"service": "AVS",
- "severity": "Bajo",
- "text": "Cuando se usa el cifrado en invitado, almacene las claves de cifrado en Azure Key Vault siempre que sea posible",
- "waf": "Seguridad"
+ "severity": "Medio",
+ "text": "¿Se usará Global Reach de ExpressRoute para la conectividad entre las nubes privadas de Azure VMware Solution principal y secundaria, o el enrutamiento se realiza a través de aplicaciones virtuales de red?",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
"service": "AVS",
"severity": "Medio",
- "text": "Considere la posibilidad de usar la compatibilidad con actualizaciones de seguridad extendidas para las cargas de trabajo que se ejecutan en Azure VMware Solution (Azure VMware Solution es apta para ESU)",
- "waf": "Seguridad"
+ "text": "¿Se han considerado todas las soluciones de copia de seguridad y se ha decidido por la mejor solución para su negocio? [ MABS/CommVault/Metallic.io/Veeam/ . ]",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que se utiliza el método de redundancia de datos de vSAN adecuado (especificación RAID)",
+ "severity": "Medio",
+ "text": "Implemente la solución de copia de seguridad en la misma región que la nube privada de Azure VMware Solution",
"waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que la directiva de error de tolerancia esté implementada para satisfacer sus necesidades de almacenamiento de vSAN",
+ "severity": "Medio",
+ "text": "Implementación de la solución de copia de seguridad fuera de vSan, en componentes nativos de Azure",
"waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que ha solicitado una cuota suficiente, asegurándose de que ha tenido en cuenta el crecimiento y el requisito de recuperación ante desastres",
+ "severity": "Bajo",
+ "text": "¿Existe un proceso para solicitar una restauración de los componentes de VMware administrados por la plataforma Azure?",
"waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que se comprenden las restricciones de acceso a ESXi, ya que existen límites de acceso que pueden afectar a las soluciones de terceros.",
+ "severity": "Bajo",
+ "text": "En el caso de las implementaciones manuales, se deben documentar todas las configuraciones e implementaciones",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de tener una política en torno a la densidad y la eficiencia del host ESXi, teniendo en cuenta el tiempo de espera para solicitar nuevos nodos",
+ "severity": "Bajo",
+ "text": "En el caso de las implementaciones manuales, considere la posibilidad de implementar bloqueos de recursos para evitar acciones accidentales en la nube privada de Azure VMware Solution",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que existe un buen proceso de administración de costos para Azure VMware Solution: se puede usar Azure Cost Management",
- "waf": "Costar"
+ "severity": "Bajo",
+ "text": "Para implementaciones automatizadas, implemente una nube privada mínima y escale según sea necesario",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
"service": "AVS",
"severity": "Bajo",
- "text": "¿Se usan instancias reservadas de Azure para optimizar el costo de uso de Azure VMware Solution?",
- "waf": "Costar"
+ "text": "En el caso de las implementaciones automatizadas, solicite o reserve una cuota antes de iniciar la implementación",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
"service": "AVS",
- "severity": "Medio",
- "text": "Tenga en cuenta el uso de Azure Private-Link cuando use otros servicios nativos de Azure",
- "waf": "Seguridad"
+ "severity": "Bajo",
+ "text": "En el caso de la implementación automatizada, asegúrese de que se crean bloqueos de recursos relevantes a través de la automatización o a través de Azure Policy para una gobernanza adecuada",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
"service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que todos los recursos necesarios residen en las mismas zonas de disponibilidad de Azure",
- "waf": "Rendimiento"
+ "severity": "Bajo",
+ "text": "Implemente nombres comprensibles para las claves de autorización ExR para permitir una fácil identificación del propósito y uso de las claves.",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
"service": "AVS",
- "severity": "Medio",
- "text": "Habilitación de cargas de trabajo de máquina virtual invitada de Microsoft Defender for Cloud for Azure VMware Solution",
- "waf": "Seguridad"
+ "severity": "Bajo",
+ "text": "Uso de Key Vault para almacenar secretos y claves de autorización cuando se usan principios de servicio independientes para implementar Azure VMware Solution y ExpressRoute",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
"service": "AVS",
- "severity": "Medio",
- "text": "Uso de servidores habilitados para Azure Arc para administrar las cargas de trabajo de máquinas virtuales invitadas de Azure VMware Solution",
- "waf": "Seguridad"
+ "severity": "Bajo",
+ "text": "Defina dependencias de recursos para serializar acciones en IaC cuando sea necesario implementar muchos recursos en Azure VMware Solution, ya que Azure VMware Solution solo admite un número limitado de operaciones paralelas.",
+ "waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
"service": "AVS",
- "severity": "Alto",
- "text": "Habilitación del registro de diagnósticos y métricas en Azure VMware Solution",
+ "severity": "Bajo",
+ "text": "Al realizar la configuración automatizada de segmentos de NSX-T con una única puerta de enlace de nivel 1, use las API de Azure Portal en lugar de las API de NSX-Manager",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
"service": "AVS",
"severity": "Medio",
- "text": "Implementación de los agentes de Log Analytics en cargas de trabajo de máquinas virtuales invitadas de Azure VMware Solution",
- "waf": "Operaciones"
+ "text": "Si tiene la intención de usar el escalado horizontal automatizado, asegúrese de solicitar una cuota suficiente de Azure VMware Solution para las suscripciones que ejecutan Azure VMware Solution",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que dispone de una directiva y una solución de copia de seguridad documentadas e implementadas para las cargas de trabajo de máquina virtual de Azure VMware Solution",
- "waf": "Operaciones"
+ "text": "Cuando tenga la intención de usar la reducción horizontal automatizada, asegúrese de tener en cuenta los requisitos de la directiva de almacenamiento antes de realizar dicha acción",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
"service": "AVS",
"severity": "Medio",
- "text": "Uso de Microsoft Defender for Cloud para la supervisión del cumplimiento de las cargas de trabajo que se ejecutan en Azure VMware Solution",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
- "severity": "Medio",
- "text": "¿Se agregan las líneas base de cumplimiento aplicables a Microsoft Defender for Cloud?",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
- "severity": "Alto",
- "text": "¿Se evaluó la residencia de datos al seleccionar las regiones de Azure que se usarán para la implementación de Azure VMware Solution?",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
- "severity": "Alto",
- "text": "¿Son claras y documentadas las implicaciones del procesamiento de datos (proveedor de servicios / modelo de consumidor de servicios)?",
- "waf": "Seguridad"
+ "text": "Las operaciones de escalado siempre deben serializarse dentro de un único SDDC, ya que solo se puede realizar una operación de escalado a la vez (incluso cuando se utilizan varios clústeres)",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
"service": "AVS",
"severity": "Medio",
- "text": "Considere la posibilidad de usar CMK (clave administrada por el cliente) para vSAN solo si es necesario por motivos de cumplimiento.",
- "waf": "Seguridad"
+ "text": "Considerar y validar las operaciones de escalado en soluciones de terceros utilizadas en la arquitectura (compatibles o no)",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
"service": "AVS",
- "severity": "Alto",
- "text": "Creación de paneles para habilitar la información principal de supervisión de Azure VMware Solution",
- "waf": "Operaciones"
+ "severity": "Medio",
+ "text": "Defina y aplique límites máximos de escalado vertical y horizontal para su entorno en las automatizaciones",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
"service": "AVS",
- "severity": "Alto",
- "text": "Creación de alertas de advertencia para umbrales críticos para alertas automáticas sobre el rendimiento de Azure VMware Solution (CPU >80 %, memoria media >80 %, vSAN >70 %)",
+ "severity": "Medio",
+ "text": "Implemente reglas de supervisión para supervisar las operaciones de escalado automatizadas y supervisar el éxito y el fracaso para permitir respuestas adecuadas (automatizadas)",
"waf": "Operaciones"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
"service": "AVS",
"severity": "Alto",
- "text": "Asegúrese de que se crea una alerta crítica para supervisar si el consumo de vSAN es inferior al 75 %, ya que se trata de un umbral de soporte de VMware",
- "waf": "Operaciones"
+ "text": "Al usar MON, tenga en cuenta los límites de las máquinas virtuales configuradas simultáneamente (límite de MON para HCX [400 - estándar, 1000 - dispositivo más grande])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
"service": "AVS",
"severity": "Alto",
- "text": "Asegúrese de que las alertas están configuradas para las alertas y notificaciones de Azure Service Health",
- "waf": "Operaciones"
+ "text": "Al usar MON, no puede habilitar MON en más de 100 extensiones de red",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
"service": "AVS",
"severity": "Medio",
- "text": "Configure el registro de Azure VMware Solution para que se envíe a una cuenta de Azure Storage o Azure EventHub para su procesamiento",
- "waf": "Operaciones"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
- "severity": "Bajo",
- "text": "Si se requiere una visión profunda de VMware vSphere: ¿Se utiliza vRealize Operations o vRealize Network Insights en la solución?",
- "waf": "Operaciones"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
- "severity": "Alto",
- "text": "Asegúrese de que la directiva de almacenamiento de vSAN para las máquinas virtuales NO sea la directiva de almacenamiento predeterminada, ya que esta directiva aplica el aprovisionamiento grueso",
- "waf": "Operaciones"
+ "text": "Si utiliza una conexión VPN para migraciones, ajuste el tamaño de su MTU en consecuencia.",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que las bibliotecas de contenido de vSphere no se coloquen en vSAN, ya que vSAN es un recurso finito",
- "waf": "Operaciones"
+ "text": "En el caso de las regiones de baja conectividad que se conectan a Azure (500 Mbps o menos), considere la posibilidad de implementar el dispositivo de optimización de WAN de HCX",
+ "waf": "Rendimiento"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que los repositorios de datos de la solución de copia de seguridad se almacenen fuera del almacenamiento de vSAN. Ya sea en Azure nativo o en un almacén de datos respaldado por un grupo de discos",
- "waf": "Operaciones"
+ "text": "Asegúrese de que las migraciones se inicien desde el dispositivo local y NO desde el dispositivo en la nube (NO realice una migración inversa)",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se administran de forma híbrida mediante Azure Arc para servidores (Arc para Azure VMware Solution está en versión preliminar)",
- "waf": "Operaciones"
+ "text": "Cuando se usa Azure NetApp Files para ampliar el almacenamiento de Azure VMware Solution, considere la posibilidad de usarlo como almacén de datos de VMware en lugar de adjuntarlo directamente a una máquina virtual.",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
"service": "AVS",
"severity": "Medio",
- "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se supervisan mediante Azure Log Analytics y Azure Monitor",
- "waf": "Operaciones"
+ "text": "Asegúrese de que se usa una puerta de enlace de ExpressRoute dedicada para soluciones de almacenamiento de datos externos",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
"service": "AVS",
"severity": "Medio",
- "text": "Inclusión de cargas de trabajo que se ejecutan en Azure VMware Solution en las herramientas de administración de actualizaciones existentes o en Azure Update Management",
- "waf": "Operaciones"
+ "text": "Asegúrese de que FastPath está habilitado en la puerta de enlace de ExpressRoute que se usa para las soluciones de almacenamiento de datos externos",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
"service": "AVS",
- "severity": "Medio",
- "text": "Uso de Azure Policy para incorporar cargas de trabajo de Azure VMware Solution en las soluciones de administración, supervisión y seguridad de Azure",
- "waf": "Operaciones"
+ "severity": "Alto",
+ "text": "Si utiliza un clúster ampliado, asegúrese de que la solución de recuperación ante desastres seleccionada sea compatible con el proveedor",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se incorporan a Microsoft Defender for Cloud",
- "waf": "Seguridad"
+ "severity": "Alto",
+ "text": "Si utiliza un clúster ampliado, asegúrese de que el Acuerdo de Nivel de Servicio proporcionado cumpla sus requisitos",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
"service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que las copias de seguridad no se almacenen en vSAN, ya que vSAN es un recurso finito",
+ "severity": "Alto",
+ "text": "Si usa un clúster extendido, asegúrese de que ambos circuitos ExpressRoute están conectados al centro de conectividad.",
"waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
"service": "AVS",
- "severity": "Medio",
- "text": "¿Se han considerado todas las soluciones de recuperación ante desastres y se ha decidido por la mejor solución para su negocio? [SRM/JetStream/Zerto/Veeam/...]",
+ "severity": "Alto",
+ "text": "Si usa un clúster extendido, asegúrese de que ambos circuitos ExpressRoute tengan habilitado GlobalReach.",
"waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
"service": "AVS",
- "severity": "Medio",
- "text": "Uso de Azure Site Recovery cuando la tecnología de recuperación ante desastres sea IaaS nativa de Azure",
+ "severity": "Alto",
+ "text": "Haga que la configuración de tolerancia ante desastres del sitio se considere y cambie correctamente para su negocio si es necesario.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Utilice planes de recuperación automatizados con cualquiera de las soluciones ante desastres, evite las tareas manuales tanto como sea posible",
+ "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
- "severity": "Medio",
- "text": "Usar el par de regiones geopolíticas como entorno secundario de recuperación ante desastres",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "severity": "Alto",
+ "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Utilice 2 espacios de direcciones diferentes entre las regiones, por ejemplo: 10.0.0.0/16 y 192.168.0.0/16 para las diferentes regiones",
+ "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
- "severity": "Medio",
- "text": "¿Se usará Global Reach de ExpressRoute para la conectividad entre las nubes privadas de Azure VMware Solution principal y secundaria, o el enrutamiento se realiza a través de aplicaciones virtuales de red?",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
+ "severity": "Alto",
+ "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "Medio",
- "text": "¿Se han considerado todas las soluciones de copia de seguridad y se ha decidido por la mejor solución para su negocio? [ MABS/CommVault/Metallic.io/Veeam/ . ]",
+ "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "Bajo",
+ "text": "Consulte la arquitectura de aplicación web de redundancia de zona de alta disponibilidad de línea de base para conocer los procedimientos recomendados",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "Medio",
- "text": "Implemente la solución de copia de seguridad en la misma región que la nube privada de Azure VMware Solution",
+ "text": "Utilice los niveles Premium y Estándar. Estos niveles admiten ranuras de ensayo y copias de seguridad automatizadas.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
- "severity": "Medio",
- "text": "Implementación de la solución de copia de seguridad fuera de vSan, en componentes nativos de Azure",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (requiere el nivel Premium v2 o v3)",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "Bajo",
- "text": "¿Existe un proceso para solicitar una restauración de los componentes de VMware administrados por la plataforma Azure?",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Implementación de comprobaciones de estado",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
- "severity": "Bajo",
- "text": "En el caso de las implementaciones manuales, se deben documentar todas las configuraciones e implementaciones",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Consulte los procedimientos recomendados de copia de seguridad y restauración para Azure App Service",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
- "severity": "Bajo",
- "text": "En el caso de las implementaciones manuales, considere la posibilidad de implementar bloqueos de recursos para evitar acciones accidentales en la nube privada de Azure VMware Solution",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Implementación de los procedimientos recomendados de confiabilidad de Azure App Service",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
"severity": "Bajo",
- "text": "Para implementaciones automatizadas, implemente una nube privada mínima y escale según sea necesario",
- "waf": "Operaciones"
+ "text": "Familiarizarse con cómo mover una aplicación de App Service a otra región durante un desastre",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
- "severity": "Bajo",
- "text": "En el caso de las implementaciones automatizadas, solicite o reserve una cuota antes de iniciar la implementación",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Familiarizarse con la compatibilidad con la confiabilidad en Azure App Service",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
- "severity": "Bajo",
- "text": "En el caso de la implementación automatizada, asegúrese de que se crean bloqueos de recursos relevantes a través de la automatización o a través de Azure Policy para una gobernanza adecuada",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Asegúrese de que \"Siempre activado\" está habilitado para las aplicaciones de funciones que se ejecutan en un plan de App Service",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
- "severity": "Bajo",
- "text": "Implemente nombres comprensibles para las claves de autorización ExR para permitir una fácil identificación del propósito y uso de las claves.",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Supervisión de instancias de App Service mediante comprobaciones de estado",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
- "severity": "Bajo",
- "text": "Uso de Key Vault para almacenar secretos y claves de autorización cuando se usan principios de servicio independientes para implementar Azure VMware Solution y ExpressRoute",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Supervisión de la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web mediante pruebas de disponibilidad de Application Insights",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"severity": "Bajo",
- "text": "Defina dependencias de recursos para serializar acciones en IaC cuando sea necesario implementar muchos recursos en Azure VMware Solution, ya que Azure VMware Solution solo admite un número limitado de operaciones paralelas.",
- "waf": "Operaciones"
+ "text": "Uso de la prueba estándar de Application Insights para supervisar la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
- "severity": "Bajo",
- "text": "Al realizar la configuración automatizada de segmentos de NSX-T con una única puerta de enlace de nivel 1, use las API de Azure Portal en lugar de las API de NSX-Manager",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use Azure Key Vault para almacenar los secretos que necesita la aplicación. Key Vault proporciona un entorno seguro y auditado para almacenar secretos y está bien integrado con App Service a través del SDK de Key Vault o las referencias de Key Vault de App Service.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Uso de Key Vault para almacenar secretos",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
- "severity": "Medio",
- "text": "Si tiene la intención de usar el escalado horizontal automatizado, asegúrese de solicitar una cuota suficiente de Azure VMware Solution para las suscripciones que ejecutan Azure VMware Solution",
- "waf": "Rendimiento"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use una identidad administrada para conectarse a Key Vault mediante el SDK de Key Vault o a través de las referencias de Key Vault de App Service.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Uso de la identidad administrada para conectarse a Key Vault",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
- "severity": "Medio",
- "text": "Cuando tenga la intención de usar la reducción horizontal automatizada, asegúrese de tener en cuenta los requisitos de la directiva de almacenamiento antes de realizar dicha acción",
- "waf": "Rendimiento"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Almacene el certificado TLS de App Service en Key Vault.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Use Key Vault para almacenar el certificado TLS.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Los sistemas que procesan información confidencial deben estar aislados. Para ello, use planes del Servicio de aplicaciones o entornos del Servicio de aplicaciones independientes y considere la posibilidad de usar suscripciones o grupos de administración diferentes.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "Medio",
- "text": "Las operaciones de escalado siempre deben serializarse dentro de un único SDDC, ya que solo se puede realizar una operación de escalado a la vez (incluso cuando se utilizan varios clústeres)",
- "waf": "Rendimiento"
+ "text": "Aísle los sistemas que procesan información confidencial",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Los discos locales de App Service no están cifrados y los datos confidenciales no deben almacenarse en ellos. (Por ejemplo: D:\\\\Local y %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
"severity": "Medio",
- "text": "Considerar y validar las operaciones de escalado en soluciones de terceros utilizadas en la arquitectura (compatibles o no)",
- "waf": "Rendimiento"
+ "text": "No almacene datos confidenciales en el disco local",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "En el caso de la aplicación web autenticada, use un proveedor de identidades bien establecido, como Azure AD o Azure AD B2C. Aproveche el marco de aplicaciones de su elección para integrarse con este proveedor o use la característica de autenticación o autorización del Servicio de aplicaciones.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
"severity": "Medio",
- "text": "Defina y aplique límites máximos de escalado vertical y horizontal para su entorno en las automatizaciones",
- "waf": "Rendimiento"
+ "text": "Usar un proveedor de identidades establecido para la autenticación",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
- "severity": "Medio",
- "text": "Implemente reglas de supervisión para supervisar las operaciones de escalado automatizadas y supervisar el éxito y el fracaso para permitir respuestas adecuadas (automatizadas)",
- "waf": "Operaciones"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Implemente código en App Service desde un entorno controlado y de confianza, como una canalización de implementación de DevOps bien administrada y segura. De este modo, se evita el código que no se ha controlado la versión y se ha comprobado que se implementará desde un host malintencionado.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Implementación desde un entorno de confianza",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Deshabilite la autenticación básica tanto para FTP/FTPS como para WebDeploy/SCM. Esto deshabilita el acceso a estos servicios y exige el uso de puntos de conexión protegidos de Azure AD para la implementación. Tenga en cuenta que el sitio de SCM también se puede abrir con credenciales de Azure AD.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"severity": "Alto",
- "text": "Al usar MON, tenga en cuenta los límites de las máquinas virtuales configuradas simultáneamente (límite de MON para HCX [400 - estándar, 1000 - dispositivo más grande])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Fiabilidad"
+ "text": "Deshabilitar la autenticación básica",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
- "severity": "Alto",
- "text": "Al usar MON, no puede habilitar MON en más de 100 extensiones de red",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Siempre que sea posible, use Managed Identity para conectarse a los recursos protegidos de Azure AD. Si esto no es posible, almacene los secretos en Key Vault y conéctese a Key Vault mediante una identidad administrada en su lugar.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Uso de la identidad administrada para conectarse a los recursos",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
- "severity": "Medio",
- "text": "Si utiliza una conexión VPN para migraciones, ajuste el tamaño de su MTU en consecuencia.",
- "waf": "Rendimiento"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas mediante una identidad administrada.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Extracción de contenedores mediante una identidad administrada",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Al configurar las opciones de diagnóstico de App Service, puede enviar todos los datos de telemetría a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad en tiempo de ejecución de App Service, como los registros HTTP, los registros de aplicaciones, los registros de plataforma, ...",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "Medio",
- "text": "En el caso de las regiones de baja conectividad que se conectan a Azure (500 Mbps o menos), considere la posibilidad de implementar el dispositivo de optimización de WAN de HCX",
- "waf": "Rendimiento"
+ "text": "Envío de registros en tiempo de ejecución de App Service a Log Analytics",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure una configuración de diagnóstico para enviar el registro de actividad a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad del plano de control en el propio recurso de App Service.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "Medio",
- "text": "Asegúrese de que las migraciones se inicien desde el dispositivo local y NO desde el dispositivo en la nube (NO realice una migración inversa)",
- "waf": "Fiabilidad"
+ "text": "Envío de registros de actividad de App Service a Log Analytics",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Controle el acceso saliente a la red mediante una combinación de integración de red virtual regional, grupos de seguridad de red y UDR. El tráfico debe enrutarse a una aplicación virtual de red, como Azure Firewall. Asegúrese de supervisar los registros del cortafuegos.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"severity": "Medio",
- "text": "Cuando se usa Azure NetApp Files para ampliar el almacenamiento de Azure VMware Solution, considere la posibilidad de usarlo como almacén de datos de VMware en lugar de adjuntarlo directamente a una máquina virtual.",
- "waf": "Fiabilidad"
+ "text": "El acceso a la red saliente debe controlarse",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que se usa una puerta de enlace de ExpressRoute dedicada para soluciones de almacenamiento de datos externos",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Puede proporcionar una dirección IP de salida estable mediante la integración de red virtual y una puerta de enlace NAT de red virtual o una aplicación virtual de red como Azure Firewall. Esto permite a la parte receptora incluir en la lista de permitidos en función de la IP, en caso de que sea necesario. Tenga en cuenta que para las comunicaciones con los servicios de Azure, a menudo no es necesario depender de la dirección IP y, en su lugar, se deben usar mecanismos como los puntos de conexión de servicio. (Además, el uso de puntos de conexión privados en el extremo receptor evita que se produzca SNAT y proporciona un intervalo de IP de salida estable).",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
+ "severity": "Bajo",
+ "text": "Garantizar una IP estable para las comunicaciones salientes hacia las direcciones de Internet",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
- "severity": "Medio",
- "text": "Asegúrese de que FastPath está habilitado en la puerta de enlace de ExpressRoute que se usa para las soluciones de almacenamiento de datos externos",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Controle el acceso entrante a la red mediante una combinación de restricciones de acceso al Servicio de aplicaciones, puntos de conexión de servicio o puntos de conexión privados. Se pueden requerir y configurar diferentes restricciones de acceso para la propia aplicación web y el sitio de SCM.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "El acceso a la red entrante debe controlarse",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Protéjase contra el tráfico entrante malintencionado mediante un firewall de aplicaciones web como Application Gateway o Azure Front Door. Asegúrese de supervisar los registros del WAF.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"severity": "Alto",
- "text": "Si utiliza un clúster ampliado, asegúrese de que la solución de recuperación ante desastres seleccionada sea compatible con el proveedor",
- "waf": "Fiabilidad"
+ "text": "Uso de un WAF delante de App Service",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Asegúrese de que no se pueda omitir el WAF bloqueando el acceso solo al WAF. Use una combinación de restricciones de acceso, puntos de conexión de servicio y puntos de conexión privados.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "Alto",
- "text": "Si utiliza un clúster ampliado, asegúrese de que el Acuerdo de Nivel de Servicio proporcionado cumpla sus requisitos",
- "waf": "Fiabilidad"
+ "text": "Evite que se omita WAF",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
- "severity": "Alto",
- "text": "Si usa un clúster extendido, asegúrese de que ambos circuitos ExpressRoute están conectados al centro de conectividad.",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Establezca la directiva TLS mínima en 1.2 en la configuración de App Service.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Establezca la directiva TLS mínima en 1.2",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure App Service para que use solo HTTPS. Esto hace que App Service se redirija de HTTP a HTTPS. Considere seriamente el uso de HTTP Strict Transport Security (HSTS) en su código o desde su WAF, que informa a los navegadores que solo se debe acceder al sitio mediante HTTPS.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
"severity": "Alto",
- "text": "Si usa un clúster extendido, asegúrese de que ambos circuitos ExpressRoute tengan habilitado GlobalReach.",
- "waf": "Fiabilidad"
+ "text": "Usar solo HTTPS",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "No utilice caracteres comodín en la configuración de CORS, ya que esto permite que todos los orígenes accedan al servicio (lo que anula el propósito de CORS). En concreto, solo permite los orígenes que esperas poder acceder al servicio.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
"severity": "Alto",
- "text": "Haga que la configuración de tolerancia ante desastres del sitio se considere y cambie correctamente para su negocio si es necesario.",
- "waf": "Fiabilidad"
+ "text": "Los comodines no deben usarse para CORS",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
- "text": "Reglas de recopilación de datos en Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "La depuración remota no debe estar activada en producción, ya que esto abre puertos adicionales en el servicio, lo que aumenta la superficie expuesta a ataques. Tenga en cuenta que el servicio desactiva la depuración remota automáticamente después de 48 horas.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Desactivar la depuración remota",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
- "text": "Comprobar las instancias de copia de seguridad con la fuente de datos subyacente no encontrada",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Habilite Defender para App Service. Esto (entre otras amenazas) detecta comunicaciones a direcciones IP maliciosas conocidas. Revise las recomendaciones de Defender para App Service como parte de las operaciones.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Habilitación de Defender for Cloud: Defender for App Service",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "text": "Eliminar o archivar servicios no asociados (discos, NIC, direcciones IP, etc.)",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure proporciona protección básica contra DDoS en su red, que se puede mejorar con funcionalidades inteligentes de DDoS Standard que aprenden sobre los patrones de tráfico normales y pueden detectar comportamientos inusuales. DDoS Standard se aplica a una red virtual, por lo que debe configurarse para el recurso de red delante de la aplicación, como Application Gateway o una aplicación virtual de red.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Habilitación del estándar de protección DDoS en la red virtual de WAF",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
- "text": "Considere un buen equilibrio entre el almacenamiento de recuperación del sitio y la copia de seguridad para aplicaciones que no son críticas",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas a través de una red virtual desde Azure Container Registry mediante su punto de conexión privado y la configuración de la aplicación \"WEBSITE_PULL_IMAGE_OVER_VNET\".",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Extracción de contenedores a través de una red virtual",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
- "text": "Compruebe las oportunidades de gasto y ahorro entre las 40 áreas de trabajo de Log Analytics diferentes: use diferentes retenciones y recopilación de datos para áreas de trabajo que no sean de producción: cree un límite diario para el reconocimiento y el tamaño de los niveles: si establece un límite diario, además de crear una alerta cuando se alcance el límite, asegúrese de crear también una regla de alerta para que se le notifique cuando se alcance algún porcentaje (90 %, por ejemplo). - Considere la posibilidad de transformar el espacio de trabajo si es posible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
- "text": "Aplique una política de purga de registros y automatización (si es necesario, los registros se pueden mover al almacenamiento en frío)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
- "text": "Compruebe que los discos son realmente necesarios, si no: eliminar. Si son necesarios, busque niveles de almacenamiento más bajos o use una copia de seguridad:",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
- "text": "Considere la posibilidad de mover el almacenamiento no utilizado al nivel inferior, con reglas personalizadas: https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
- "text": "Asegúrese de que el asesor está configurado para el tamaño correcto de la máquina virtual ",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "comprobando la búsqueda de las licencias de categoría de contador en el análisis de costes",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "text": "ejecutar el script en todas las máquinas virtuales de Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server: considere la posibilidad de implementar una directiva si las máquinas virtuales de Windows se crean con frecuencia",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
- "text": " esto también se puede poner bajo AHUB si ya tiene licencias https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
- "text": "Consolide familias de máquinas virtuales reservadas con la opción de flexibilidad (no más de 4-5 familias)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
- "text": "Uso de Azure Reserved Instances: esta característica le permite reservar máquinas virtuales durante un período de 1 o 3 años, lo que proporciona un importante ahorro de costos en comparación con los precios de pago por uso.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
- "text": "Solo se pueden reservar discos más grandes => 1 TiB -",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
- "text": "Después de la optimización del tamaño correcto",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "text": "Compruebe si corresponde y aplique la política/cambio https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "text": "El descuento de la parte de la licencia VM + (ahub + 3YRI) es de alrededor del 70% de descuento",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
- "text": "Considere la posibilidad de utilizar un VMSS para satisfacer la demanda en lugar de un tamaño fijo",
- "waf": "Costar"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
- "text": "Use el escalador automático de AKS para que coincida con el uso de los clústeres (asegúrese de que los requisitos de los pods coincidan con el escalador)",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Realice una prueba de penetración en la aplicación web siguiendo las reglas de participación de las pruebas de penetración.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Realizar una prueba de penetración",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
- "text": "Mover los puntos de recuperación al archivo de almacén cuando corresponda (Validar)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Implemente código de confianza que se haya validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
+ "severity": "Medio",
+ "text": "Implementación de código validado",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "text": "Considere la posibilidad de usar máquinas virtuales de acceso puntual con reserva siempre que sea posible. Considere la posibilidad de la terminación automática de clústeres.",
- "waf": "Costar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Utilice las versiones más recientes de plataformas, lenguajes de programación, protocolos y marcos compatibles.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Utilizar plataformas, lenguajes, protocolos y marcos actualizados",
+ "waf": "Seguridad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
"service": "Azure Functions",
- "text": "Funciones - Reutilizar conexiones",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Costar"
+ "severity": "Alto",
+ "text": "Seleccione el plan de hospedaje de funciones adecuado en función de los requisitos de su empresa y SLO",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
"service": "Azure Functions",
- "text": "Funciones: almacenar datos en caché localmente",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Costar"
+ "severity": "Alto",
+ "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (no disponible para el nivel de consumo)",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
"service": "Azure Functions",
- "text": "Funciones - Arranques en frío: utilice la funcionalidad 'Ejecutar desde el paquete'. De esta manera, el código se descarga como un único archivo zip. Esto puede, por ejemplo, resultar en mejoras significativas con las funciones de Javascript, que tienen muchos módulos de nodos. Utilice herramientas específicas del lenguaje para reducir el tamaño del paquete, por ejemplo, aplicaciones Javascript que sacuden el árbol.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Costar"
+ "severity": "Medio",
+ "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
"service": "Azure Functions",
- "text": "Funciones - Mantén tus funciones calientes",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Costar"
+ "severity": "Alto",
+ "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
"service": "Azure Functions",
- "text": "Al usar el escalado automático con diferentes funciones, es posible que haya uno que controle todo el escalado automático para todos los recursos: considere la posibilidad de moverlo a un plan de consumo independiente (y considere un plan superior para la CPU)",
- "waf": "Costar"
+ "severity": "Alto",
+ "text": "Asegúrese de que \"Siempre activado\" esté habilitado para todas las aplicaciones de funciones que se ejecutan en el plan de App Service",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
"service": "Azure Functions",
- "text": "Las aplicaciones de funciones de un plan determinado se escalan juntas, por lo que cualquier problema con el escalado puede afectar a todas las aplicaciones del plan.",
- "waf": "Costar"
+ "severity": "Medio",
+ "text": "Empareje una aplicación de funciones con su propia cuenta de almacenamiento. Intente no volver a usar las cuentas de almacenamiento para las aplicaciones de funciones a menos que estén estrechamente acopladas",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
"service": "Azure Functions",
- "text": "¿Se me factura por el \"tiempo de espera\"? Esta pregunta se suele formular en el contexto de una función de C# que realiza una operación asincrónica y espera el resultado, por ejemplo, await Task.Delay(1000) o await client. GetAsync('http://google.com'). La respuesta es sí: el segundo cálculo de GB se basa en la hora de inicio y finalización de la función y el uso de memoria durante ese período. Lo que realmente sucede durante ese tiempo en términos de actividad de la CPU no se tiene en cuenta en el cálculo. Una excepción a esta regla es si está utilizando funciones duraderas. No se le facturará por el tiempo empleado en las esperas en las funciones de orquestador.aplique técnicas de modelado de la demanda siempre que sea posible (¿entornos de desarrollo?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Costar"
+ "severity": "Medio",
+ "text": "Aproveche Azure DevOps o GitHub para optimizar la CI/CD y proteger el código de la aplicación de funciones",
+ "waf": "Operaciones"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
- "text": "Frontdoor: desactivar la página principal predeterminadaEn la configuración de la aplicación de la aplicación, establezca AzureWebJobsDisableHomepage en true. Esto devolverá un 204 (sin contenido) al PoP para que solo se devuelvan los datos del encabezado.",
- "waf": "Costar"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "text": "Frontdoor: ruta a algo que no devuelve nada. Configure una función, un proxy de función o agregue una ruta en la aplicación web que devuelva 200 (correctamente) y envíe contenido mínimo o nulo. La ventaja de esto es que podrá cerrar la sesión cuando se llame.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
- "text": "Considere la posibilidad de archivar niveles para los datos menos utilizados",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
- "text": "Compruebe los tamaños de disco en los que el tamaño no coincida con el nivel (es decir, un disco de 513 GiB pagará un P30 (1 TiB) y considere la posibilidad de cambiar el tamaño",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "text": "Considere la posibilidad de utilizar un SSD estándar en lugar de Premium o Ultra siempre que sea posible",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "text": "En el caso de las cuentas de almacenamiento, asegúrese de que el nivel elegido no suma cargos por transacción (puede ser más barato pasar al siguiente nivel)",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "text": "Para ASR, considere la posibilidad de usar discos SSD estándar si el RPO/RTO y el rendimiento de replicación lo permiten",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
- "text": "Cuentas de almacenamiento: compruebe el nivel de acceso frecuente o GRS necesario",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "text": "Discos: valide el uso de discos SSD Premium en todas partes: por ejemplo, los que no son de producción podrían cambiar a SSD estándar o SSD Premium bajo demanda ",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
- "text": "Cree presupuestos para administrar los costos y cree alertas que notifiquen automáticamente a las partes interesadas sobre anomalías en el gasto y riesgos de gasto excesivo.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
- "text": "Exporte los datos de costos a una cuenta de almacenamiento para realizar análisis de datos adicionales.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "text": "Controle los costos de un grupo de SQL dedicado pausando el recurso cuando no esté en uso.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "text": "Habilite la función de pausa automática de Apache Spark sin servidor y establezca el valor de tiempo de espera en consecuencia.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
- "text": "Cree varias definiciones de grupo de Apache Spark de varios tamaños.",
- "waf": "Costar"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "text": "Compre unidades de confirmación (SCU) de Azure Synapse durante un año con un plan de compra anticipada para ahorrar en los costos de Azure Synapse Analytics.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "Bajo",
+ "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "text": "Uso de máquinas virtuales de acceso puntual para trabajos interrumpibles: se trata de máquinas virtuales por las que se puede pujar y comprar a un precio reducido, lo que proporciona una solución rentable para cargas de trabajo no críticas.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Los espacios de nombres de Azure Event Hubs permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Event Hubs para requerir que los clientes envíen y reciban datos con una versión más reciente de TLS. Si un espacio de nombres de Event Hubs requiere una versión mínima de TLS, se producirá un error en las solicitudes realizadas con una versión anterior. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
+ "severity": "Medio",
+ "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "text": "Ajustar el tamaño de todas las máquinas virtuales",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Al crear un espacio de nombres de Event Hubs, se crea automáticamente una regla de directiva denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
+ "severity": "Medio",
+ "text": "Evite usar la cuenta raíz cuando no sea necesario",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "text": "Intercambiar el tamaño de la máquina virtual con los tamaños normalizados y más recientes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Las identidades administradas para los recursos de Azure pueden autorizar el acceso a los recursos de Event Hubs mediante credenciales de Azure AD desde aplicaciones que se ejecutan en Azure Virtual Machines (VM), aplicaciones de funciones, conjuntos de escalado de máquinas virtuales y otros servicios. Mediante el uso de identidades administradas para los recursos de Azure junto con la autenticación de Azure AD, puede evitar el almacenamiento de credenciales con las aplicaciones que se ejecutan en la nube. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
+ "severity": "Medio",
+ "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Event Hub. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "Ajustar el tamaño de las máquinas virtuales: comience con la supervisión del uso por debajo del 5 % y, a continuación, trabaje hasta el 40 %",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Al crear permisos, proporcione un control específico sobre el acceso de un cliente al Centro de eventos de Azure. Los permisos del Centro de eventos de Azure pueden y deben limitarse al nivel de recurso individual, por ejemplo, grupo de consumidores, entidad del centro de eventos, espacios de nombres del centro de eventos, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
+ "severity": "Alto",
+ "text": "Uso de RBAC de plano de datos con privilegios mínimos",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "La inclusión de una aplicación en contenedores puede mejorar la densidad de la máquina virtual y ahorrar dinero en su escalado",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Costar"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Los registros de recursos del Centro de eventos de Azure incluyen registros operativos, registros de red virtual y registros de Kafka. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para todas las operaciones de acceso al plano de datos (como eventos de envío o recepción) en Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
+ "severity": "Medio",
+ "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para capturar métricas y registros, como registros de recursos, registros de auditoría en tiempo de ejecución y registros de Kafka",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "De forma predeterminada, Azure Event Hub tiene una dirección IP pública y es accesible a través de Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y Azure Event Hubs a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se usan. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"severity": "Medio",
- "text": "Azure Spring Apps permite dos implementaciones para cada aplicación, de las cuales solo una recibe tráfico de producción. Puede lograr cero tiempo de inactividad con estrategias de implementación azul verde. La implementación azul verde solo está disponible en los niveles Estándar y Enterprise. Puede automatizar la implementación mediante CI/CD con acciones de ADO/GitHub",
- "waf": "Fiabilidad"
+ "text": "Considere la posibilidad de usar puntos de conexión privados para acceder al Centro de eventos de Azure y deshabilitar el acceso a la red pública cuando corresponda.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Con el firewall IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"severity": "Medio",
- "text": "Las instancias de Azure Spring Apps se pueden crear en varias regiones para las aplicaciones y el tráfico se puede enrutar mediante Traffic Manager o Front Door.",
- "waf": "Fiabilidad"
+ "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres del Centro de eventos de Azure desde direcciones IP o intervalos específicos",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"severity": "Medio",
- "text": "En la región admitida, Azure Spring Apps se puede implementar como zona redundante, lo que significa que las instancias se distribuyen automáticamente entre las zonas de disponibilidad. Esta función solo está disponible en los niveles Standard y Enterprise.",
+ "text": "Aproveche el Manual de Resiliencia de los TLC",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
- "severity": "Medio",
- "text": "Usar más de 1 instancia de aplicación para las aplicaciones",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": " Esto se activará automáticamente para un nuevo espacio de nombres EH creado desde el portal con SKU Premium, Dedicado o Estándar en una región habilitada para zonas. Tanto los metadatos de EH como los propios datos de eventos se replican en todas las zonas",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
+ "severity": "Alto",
+ "text": "Aproveche las zonas de disponibilidad si corresponde regionalmente",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "Medio",
- "text": "Supervise Azure Spring Apps con registros, métricas y seguimiento. Integre ASA con la información de las aplicaciones, realice un seguimiento de los errores y cree libros de trabajo.",
+ "text": "Usa las SKU Premium o Dedicadas para obtener un rendimiento predecible",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "severity": "Medio",
- "text": "Configuración del escalado automático en Spring Cloud Gateway",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "La característica integrada de recuperación ante desastres geográfica, cuando está habilitada, garantiza que toda la configuración de un espacio de nombres (Event Hubs, grupos de consumidores y configuración) se replique continuamente desde un espacio de nombres principal a un espacio de nombres secundario, y permite un movimiento de conmutación por error de una sola vez del principal al secundario en cualquier momento. La característica Activo/Pasivo está diseñada para facilitar la recuperación y el abandono de una región de Azure con errores sin tener que cambiar las configuraciones de la aplicación",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
+ "severity": "Alto",
+ "text": "Planeación de la recuperación ante desastres geográfica mediante la configuración pasiva activa",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
- "severity": "Bajo",
- "text": "Habilite el escalado automático para las aplicaciones con el consumo estándar y el plan dedicado.",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Debe utilizarse para configuraciones de recuperación ante desastres en las que no se puede tolerar una interrupción o pérdida de datos de eventos en la región inactiva. En estos casos, siga las instrucciones de replicación y no use la capacidad de recuperación ante desastres geográfica integrada (activa/pasiva). Con Activo/Activo, mantenga varios centros de eventos en diferentes regiones y espacios de nombres, y los eventos se replicarán entre los centros",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
+ "severity": "Medio",
+ "text": "En el caso de las aplicaciones críticas para la empresa, use la configuración Active Active",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "Medio",
- "text": "Use el plan Enterprise para obtener soporte comercial de Spring Boot para aplicaciones de misión crítica. Con otros niveles, obtienes soporte OSS.",
+ "text": "Diseño de centros de eventos resilientes",
"waf": "Fiabilidad"
},
{
@@ -4437,7 +4057,7 @@
"guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
"link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
"service": "Firewall",
- "severity": "Importante",
+ "severity": "Alto",
"text": "Migre de las reglas de Azure Firewall clásico (si existen) a la directiva de firewall.",
"training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Operaciones"
@@ -5386,2145 +5006,2273 @@
"waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Implementar una política de control de errores a nivel global",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Asegúrese de que todas las políticas de API incluyan un elemento.",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Uso de fragmentos de políticas para evitar repetir las mismas definiciones de políticas en varias API",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Si planeas monetizar tus API, revisa el artículo \"Soporte de monetización\" para conocer las prácticas recomendadas",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"severity": "Alto",
- "text": "Habilitación de 2 réplicas para que tengan una disponibilidad del 99,9 % para las operaciones de lectura",
- "waf": "Fiabilidad"
+ "text": "Habilitación de la configuración de diagnóstico para exportar registros a Azure Monitor",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "Medio",
- "text": "Habilitación de 3 réplicas para que tengan una disponibilidad del 99,9 % para las operaciones de lectura y escritura",
- "waf": "Fiabilidad"
+ "text": "Habilitación de Application Insights para obtener telemetría más detallada",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad habilitando réplicas de lectura o escritura",
- "waf": "Fiabilidad"
+ "text": "Configurar alertas sobre las métricas más críticas",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Asegúrese de que los certificados SSL personalizados se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Protección de las solicitudes entrantes a las API (plano de datos) con Azure AD",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"severity": "Medio",
- "text": "En el caso de la reincidencia regional, cree manualmente servicios en 2 o más regiones para la búsqueda, ya que no proporciona un método automatizado para replicar índices de búsqueda en regiones geográficas",
- "waf": "Fiabilidad"
+ "text": "Usar el identificador de Microsoft Entra para autenticar a los usuarios en el Portal para desarrolladores",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"severity": "Medio",
- "text": "Para sincronizar datos entre varios servicios, use indexadores para actualizar contenido en varios servicios o use las API de REST para insertar actualizaciones de contenido en varios servicios",
- "waf": "Fiabilidad"
+ "text": "Crear grupos adecuados para controlar la visibilidad de los productos",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"severity": "Medio",
- "text": "Uso de Azure Traffic Manager para coordinar solicitudes",
+ "text": "Utilice la función Backends para eliminar las configuraciones redundantes de back-end de la API",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Usar valores con nombre para almacenar valores comunes que se pueden usar en directivas",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "En el caso de la recuperación ante desastres, aproveche el nivel premium con implementaciones escaladas en dos o más regiones para un acuerdo de nivel de servicio del 99,99 %",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
- "severity": "Alto",
- "text": "Realice una copia de seguridad y restaure un índice de Azure Cognitive Search. Use este código de ejemplo para realizar una copia de seguridad de la definición del índice y la instantánea en una serie de archivos JSON",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Implemente al menos una unidad en dos o más zonas de disponibilidad para obtener un SLA aumentado del 99,99 %",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"severity": "Alto",
- "text": "Habilite la redundancia de zona para Azure Cache for Redis. Azure Cache for Redis admite configuraciones con redundancia de zona en los niveles Premium y Enterprise. Una caché con redundancia de zona puede colocar sus nodos en diferentes zonas de disponibilidad de Azure en la misma región. Elimina la interrupción del centro de datos o de la zona de disponibilidad como único punto de error y aumenta la disponibilidad general de la memoria caché.",
+ "text": "Asegúrese de que haya una rutina de copia de seguridad automatizada",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "Medio",
- "text": "Configure la persistencia de datos para una instancia de Azure Cache for Redis. Dado que los datos de caché se almacenan en la memoria, un error poco frecuente y no planeado de varios nodos puede hacer que se eliminen todos los datos. Para evitar la pérdida completa de datos, la persistencia de Redis permite tomar instantáneas periódicas de los datos en memoria y almacenarlas en la cuenta de almacenamiento.",
+ "text": "Use directivas para agregar una dirección URL de back-end de conmutación por error y el almacenamiento en caché para reducir las llamadas con errores.",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
+ "severity": "Bajo",
+ "text": "Si necesita iniciar sesión en niveles de alto rendimiento, tenga en cuenta la directiva de Event Hubs",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Aplicación de directivas de limitación para controlar el número de solicitudes por segundo",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Configurar el escalado automático para escalar horizontalmente el número de instancias cuando aumenta la carga",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Implemente puertas de enlace autohospedadas en las que Azure no tenga una región cercana a las API de back-end.",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"severity": "Medio",
- "text": "Use una cuenta de almacenamiento con redundancia geográfica para conservar los datos de Azure Cache for Redis o con redundancia zonal donde la redundancia geográfica no esté disponible",
+ "text": "Use el nivel premium para las cargas de trabajo de producción.",
"waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"severity": "Medio",
- "text": "Configure la replicación geográfica pasiva para instancias de Azure Cache for Redis Premium. La replicación geográfica es un mecanismo para vincular dos o más instancias de Azure Cache for Redis, que normalmente abarcan dos regiones de Azure. La replicación geográfica está diseñada principalmente para la recuperación ante desastres entre regiones. Dos instancias de caché de nivel Premium se conectan a través de la replicación geográfica de una manera que proporciona lecturas y escrituras en la caché principal, y esos datos se replican en la caché secundaria.",
+ "text": "En el modelo de varias regiones, use directivas para enrutar las solicitudes a los back-ends regionales en función de la disponibilidad o la latencia.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Aplicación de las instrucciones de la prueba comparativa de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Tenga en cuenta la \"línea base de seguridad de Azure para el almacenamiento\"",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Tenga en cuenta los límites de APIM",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de proceso de Azure que necesitan acceso, lo que elimina la exposición a la Internet pública",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"severity": "Alto",
- "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
- "waf": "Seguridad"
+ "text": "Asegúrese de que las implementaciones de puerta de enlace autohospedadas sean resistentes.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, auditoría, etc. están habilitados. Asegúrese de que no hay cuentas de almacenamiento antiguas con el modelo de implementación clásica en una suscripción",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
"severity": "Medio",
- "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usan el \"modelo de implementación clásica\"",
- "waf": "Seguridad"
+ "text": "Uso de Azure Front Door delante de APIM para la implementación en varias regiones",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Aproveche Microsoft Defender para obtener información sobre la actividad sospechosa y los errores de configuración.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Implementación del servicio dentro de una red virtual (VNet)",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
"severity": "Medio",
- "text": "Habilitación de la \"eliminación temporal\" para blobs",
+ "text": "Implemente grupos de seguridad de red (NSG) en las subredes para restringir o supervisar el tráfico hacia/desde APIM.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"severity": "Medio",
- "text": "Deshabilitación de la \"eliminación temporal\" de blobs",
+ "text": "Implemente puntos de conexión privados para filtrar el tráfico entrante cuando APIM no se implemente en una red virtual.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"severity": "Alto",
- "text": "Habilitación de la \"eliminación temporal\" para los contenedores",
+ "text": "Deshabilitar el acceso a la red pública",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
"severity": "Medio",
- "text": "Deshabilitación de la \"eliminación temporal\" para contenedores",
- "waf": "Seguridad"
+ "text": "Simplifique la administración con scripts de automatización de PowerShell",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Configure APIM a través de la infraestructura como código. Revise las prácticas recomendadas de DevOps desde el acelerador de zonas de aterrizaje de API de Cloud Adaption Framework",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en el tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere la posibilidad de blobs inmutables",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Promover el uso de la extensión APIM de Visual Studio Code para un desarrollo de API más rápido",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 sin protección a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas por integridad y el servidor esté autenticado. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Implemente DevOps y CI/CD en su flujo de trabajo",
+ "waf": "Operaciones"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "API seguras mediante la autenticación de certificados de cliente",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blobs ayuda a minimizar el riesgo de pérdida de credenciales.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"severity": "Medio",
- "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
+ "text": "Servicios de back-end seguros mediante la autenticación de certificados de cliente",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Los tokens de AAD deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Uso de tokens de Azure Active Directory (Azure AD) para el acceso a blobs",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Revise el artículo \"Recomendaciones para mitigar las 10 principales amenazas de seguridad de la API de OWASP\" y compruebe qué se aplica a sus API",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"severity": "Medio",
- "text": "Privilegios mínimos en los permisos de IaM",
+ "text": "Utilice la función Autorizaciones para simplificar la administración del token de OAuth 2.0 para las API de back-end",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Utilice la versión más reciente de TLS al cifrar la información en tránsito. Deshabilite los protocolos y cifrados obsoletos e innecesarios cuando sea posible.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad sobre la SAS de servicio. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"severity": "Alto",
- "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en claves de cuenta de almacenamiento.",
+ "text": "Asegúrese de que los secretos (valores con nombre) se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Las claves de la cuenta de almacenamiento (\"claves compartidas\") tienen muy pocas funcionalidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de AAD facilita la vinculación del acceso al almacenamiento a un usuario. ",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a AAD (y la SAS de delegación de usuarios).",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
+ "severity": "Medio",
+ "text": "Uso de identidades administradas para autenticarse en otros recursos de Azure siempre que sea posible",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Use los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"severity": "Alto",
- "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "text": "Uso del firewall de aplicaciones web (WAF) mediante la implementación de Application Gateway delante de APIM",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Una directiva de expiración de claves le permite establecer un recordatorio para la rotación de las claves de acceso a la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"severity": "Medio",
- "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
- "waf": "Seguridad"
+ "text": "Aproveche el servidor flexible",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de expiración de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
+ "severity": "Alto",
+ "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"severity": "Medio",
- "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
- "waf": "Seguridad"
+ "text": "Aproveche la replicación de entrada de datos para escenarios de recuperación ante desastres entre regiones",
+ "waf": "Fiabilidad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "description": "Aplicación de las instrucciones de la prueba comparativa de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
"service": "Azure Storage",
"severity": "Medio",
- "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
+ "text": "Tenga en cuenta la \"línea base de seguridad de Azure para el almacenamiento\"",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si esto no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de proceso de Azure que necesitan acceso, lo que elimina la exposición a la Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
+ "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Use los tiempos de expiración a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, es válida solo por un corto tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una directiva de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlo.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, auditoría, etc. están habilitados. Asegúrese de que no hay cuentas de almacenamiento antiguas con el modelo de implementación clásica en una suscripción",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Esfuércese por obtener períodos de validez cortos para SAS ad-hoc",
+ "severity": "Medio",
+ "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usan el \"modelo de implementación clásica\"",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "description": "Aproveche Microsoft Defender para obtener información sobre la actividad sospechosa y los errores de configuración.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
"service": "Azure Storage",
- "severity": "Medio",
- "text": "Aplicación de un ámbito limitado a una SAS",
+ "severity": "Alto",
+ "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Una SAS puede incluir parámetros en los que las direcciones IP de cliente o los intervalos de direcciones están autorizados a solicitar un recurso mediante la SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
"service": "Azure Storage",
"severity": "Medio",
- "text": "Considere la posibilidad de definir el ámbito de SAS en una dirección IP de cliente específica, siempre que sea posible",
+ "text": "Habilitación de la \"eliminación temporal\" para blobs",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenido de gran tamaño malintencionado.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
"service": "Azure Storage",
- "severity": "Bajo",
- "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan usado una SAS para cargar un archivo. ",
+ "severity": "Medio",
+ "text": "Deshabilitación de la \"eliminación temporal\" de blobs",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Al acceder a Blob Storage a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente se admite para el punto de conexión SFTP",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
"service": "Azure Storage",
"severity": "Alto",
- "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "text": "Habilitación de la \"eliminación temporal\" para los contenedores",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
"service": "Azure Storage",
"severity": "Medio",
- "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
+ "text": "Deshabilitación de la \"eliminación temporal\" para contenedores",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente relajar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Evite las políticas de CORS demasiado amplias",
+ "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Los datos en reposo siempre están cifrados en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede realizarse mediante una clave administrada por la plataforma (predeterminada) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob a Azure Storage o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en el tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Determine qué cifrado de plataforma se debe usar o si se debe usar.",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
- "severity": "Medio",
- "text": "Determine qué cifrado del lado del cliente se debe usar o si.",
+ "text": "Considere la posibilidad de blobs inmutables",
"waf": "Seguridad"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Blob Storage Review",
- "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 sin protección a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas por integridad y el servidor esté autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Considere si se necesita acceso público a blobs o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
+ "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario para las cargas de trabajo de Windows de AKS, se pueden usar contenedores HostProcess",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Utilice KEDA si ejecuta cargas de trabajo controladas por eventos",
- "waf": "Rendimiento"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Uso de Dapr para facilitar el desarrollo de microservicios",
- "waf": "Operaciones"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
- "severity": "Alto",
- "text": "Uso de la oferta de AKS respaldada por SLA",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Uso de presupuestos de interrupción en el pod y las definiciones de implementación",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Si usa un registro privado, configure la replicación de regiones para almacenar imágenes en varias regiones",
- "waf": "Fiabilidad"
+ "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Usar una aplicación externa como kubecost para asignar costos a diferentes usuarios",
- "waf": "Costar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blobs ayuda a minimizar el riesgo de pérdida de credenciales.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Usar el modo de reducción vertical para eliminar/desasignar nodos",
- "waf": "Costar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Los tokens de AAD deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Uso de tokens de Azure Active Directory (Azure AD) para el acceso a blobs",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Cuando sea necesario, use la GPU de partición de varias instancias en clústeres de AKS",
- "waf": "Costar"
+ "text": "Privilegios mínimos en los permisos de IaM",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si se ejecuta un clúster de desarrollo y pruebas, use NodePool Start/Stop",
- "waf": "Costar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad sobre la SAS de servicio. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en claves de cuenta de almacenamiento.",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
- "severity": "Medio",
- "text": "Uso de Azure Policy para Kubernetes para garantizar el cumplimiento de clústeres",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Las claves de la cuenta de almacenamiento (\"claves compartidas\") tienen muy pocas funcionalidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de AAD facilita la vinculación del acceso al almacenamiento a un usuario. ",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a AAD (y la SAS de delegación de usuarios).",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Use los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Una directiva de expiración de claves le permite establecer un recordatorio para la rotación de las claves de acceso a la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Separe las aplicaciones del plano de control con grupos de nodos de usuario/sistema",
+ "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Agregue taint a su grupo de nodos del sistema para que sea dedicado",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de expiración de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Utilice un registro privado para sus imágenes, como ACR",
+ "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Escanea tus imágenes en busca de vulnerabilidades",
+ "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si esto no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Definición de los requisitos de separación de aplicaciones (espacio de nombres/grupo de nodos/clúster)",
+ "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
- "severity": "Medio",
- "text": "Almacenamiento de los secretos en Azure Key Vault con el controlador del almacén de secretos de CSI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Use los tiempos de expiración a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, es válida solo por un corto tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una directiva de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlo.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Esfuércese por obtener períodos de validez cortos para SAS ad-hoc",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
- "severity": "Alto",
- "text": "Si usa entidades de servicio para el clúster, actualice las credenciales periódicamente (por ejemplo, trimestralmente)",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Aplicación de un ámbito limitado a una SAS",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Una SAS puede incluir parámetros en los que las direcciones IP de cliente o los intervalos de direcciones están autorizados a solicitar un recurso mediante la SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Si es necesario, agregue el servicio de administración de claves, etcd, cifrado",
+ "text": "Considere la posibilidad de definir el ámbito de SAS en una dirección IP de cliente específica, siempre que sea posible",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenido de gran tamaño malintencionado.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"severity": "Bajo",
- "text": "Si es necesario, considere la posibilidad de usar Proceso confidencial para AKS",
+ "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan usado una SAS para cargar un archivo. ",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Al acceder a Blob Storage a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente se admite para el punto de conexión SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Considere la posibilidad de usar Defender para contenedores",
+ "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente relajar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Uso de identidades administradas en lugar de entidades de servicio",
+ "text": "Evite las políticas de CORS demasiado amplias",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
- "severity": "Medio",
- "text": "Integración de la autenticación con AAD (mediante la integración administrada)",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Los datos en reposo siempre están cifrados en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede realizarse mediante una clave administrada por la plataforma (predeterminada) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob a Azure Storage o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Limitar el acceso a admin kubeconfig (get-credentials --admin)",
+ "text": "Determine qué cifrado de plataforma se debe usar o si se debe usar.",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Integración de la autorización con RBAC de AAD",
+ "text": "Determine qué cifrado del lado del cliente se debe usar o si.",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Uso de espacios de nombres para restringir el privilegio RBAC en Kubernetes",
+ "text": "Considere si se necesita acceso público a blobs o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
"waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
- "severity": "Medio",
- "text": "Para la administración de acceso a identidades de pods, use Azure AD Workload Identity (versión preliminar)",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "text": "Reglas de recopilación de datos en Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
- "severity": "Medio",
- "text": "En el caso de los inicios de sesión no interactivos de AKS, use kubelogin (versión preliminar)",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
+ "text": "Comprobar las instancias de copia de seguridad con la fuente de datos subyacente no encontrada",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
- "severity": "Medio",
- "text": "Deshabilitación de cuentas locales de AKS",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
+ "text": "Eliminar o archivar servicios no asociados (discos, NIC, direcciones IP, etc.)",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Configure, si es necesario, el acceso al clúster Just-In-Time",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
+ "text": "Considere un buen equilibrio entre el almacenamiento de recuperación del sitio y la copia de seguridad para aplicaciones que no son críticas",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Configure si es necesario el acceso condicional de AAD para AKS",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
+ "text": "Compruebe las oportunidades de gasto y ahorro entre las 40 áreas de trabajo de Log Analytics diferentes: use diferentes retenciones y recopilación de datos para áreas de trabajo que no sean de producción: cree un límite diario para el reconocimiento y el tamaño de los niveles: si establece un límite diario, además de crear una alerta cuando se alcance el límite, asegúrese de crear también una regla de alerta para que se le notifique cuando se alcance algún porcentaje (90 %, por ejemplo). - Considere la posibilidad de transformar el espacio de trabajo si es posible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario para las cargas de trabajo de Windows AKS, configure gMSA ",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
+ "text": "Aplique una política de purga de registros y automatización (si es necesario, los registros se pueden mover al almacenamiento en frío)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
- "severity": "Medio",
- "text": "Para un control más preciso, considere la posibilidad de utilizar una identidad de Kubelet administrada",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
+ "text": "Compruebe que los discos son realmente necesarios, si no: eliminar. Si son necesarios, busque niveles de almacenamiento más bajos o use una copia de seguridad:",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
- "severity": "Medio",
- "text": "Si utiliza AGIC, no comparta un AppGW entre clústeres",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "text": "Considere la posibilidad de mover el almacenamiento no utilizado al nivel inferior, con reglas personalizadas: https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
- "severity": "Alto",
- "text": "No use el complemento de enrutamiento HTTP de AKS, use en su lugar la entrada NGINX administrada con el complemento de enrutamiento de aplicaciones.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "text": "Asegúrese de que el asesor está configurado para el tamaño correcto de la máquina virtual ",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "comprobando la búsqueda de las licencias de categoría de contador en el análisis de costes",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "text": "ejecutar el script en todas las máquinas virtuales de Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server: considere la posibilidad de implementar una directiva si las máquinas virtuales de Windows se crean con frecuencia",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "text": " esto también se puede poner bajo AHUB si ya tiene licencias https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
+ "text": "Consolide familias de máquinas virtuales reservadas con la opción de flexibilidad (no más de 4-5 familias)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "text": "Uso de Azure Reserved Instances: esta característica le permite reservar máquinas virtuales durante un período de 1 o 3 años, lo que proporciona un importante ahorro de costos en comparación con los precios de pago por uso.",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "text": "Solo se pueden reservar discos más grandes => 1 TiB -",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
+ "text": "Después de la optimización del tamaño correcto",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
- "severity": "Medio",
- "text": "En el caso de las cargas de trabajo de Windows, use las redes aceleradas",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "text": "Compruebe si corresponde y aplique la política/cambio https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
- "severity": "Alto",
- "text": "Utilice el ALB estándar (en lugar del básico)",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
+ "text": "El descuento de la parte de la licencia VM + (ahub + 3YRI) es de alrededor del 70% de descuento",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
- "severity": "Medio",
- "text": "Si usa Azure CNI, considere la posibilidad de usar diferentes subredes para NodePools",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
+ "text": "Considere la posibilidad de utilizar un VMSS para satisfacer la demanda en lugar de un tamaño fijo",
+ "waf": "Costar"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
"service": "AKS",
- "severity": "Medio",
- "text": "Use puntos de conexión privados (preferidos) o puntos de conexión de servicio de red virtual para acceder a los servicios PaaS desde el clúster",
- "waf": "Seguridad"
+ "text": "Use el escalador automático de AKS para que coincida con el uso de los clústeres (asegúrese de que los requisitos de los pods coincidan con el escalador)",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "Alto",
- "text": "Elija el mejor complemento de red de CNI para sus necesidades (se recomienda Azure CNI)",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "text": "Mover los puntos de recuperación al archivo de almacén cuando corresponda (Validar)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "Alto",
- "text": "Si usa CNI de Azure, ajuste el tamaño de la subred en consecuencia teniendo en cuenta el número máximo de pods por nodo",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "text": "Considere la posibilidad de usar máquinas virtuales de acceso puntual con reserva siempre que sea posible. Considere la posibilidad de la terminación automática de clústeres.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "Alto",
- "text": "Si usa Azure CNI, compruebe el número máximo de pods o nodo (valor predeterminado 30)",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
+ "text": "Funciones - Reutilizar conexiones",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "En el caso de las aplicaciones internas, las organizaciones suelen abrir toda la subred de AKS en sus firewalls. Esto también abre el acceso de red a los nodos y, potencialmente, también a los pods (si se usa Azure CNI). Si las direcciones IP de LoadBalancer están en una subred diferente, solo esta debe estar disponible para los clientes de la aplicación. Otra razón es que si las direcciones IP de la subred de AKS son un recurso escaso, el consumo de sus direcciones IP para los servicios reducirá la escalabilidad máxima del clúster.",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si usa servicios de LoadBalancer de dirección IP privada, use una subred dedicada (no la subred de AKS)",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
+ "text": "Funciones: almacenar datos en caché localmente",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "Alto",
- "text": "Dimensione el rango de direcciones IP del servicio en consecuencia (limitará la escalabilidad del clúster)",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
+ "text": "Funciones - Arranques en frío: utilice la funcionalidad 'Ejecutar desde el paquete'. De esta manera, el código se descarga como un único archivo zip. Esto puede, por ejemplo, resultar en mejoras significativas con las funciones de Javascript, que tienen muchos módulos de nodos. Utilice herramientas específicas del lenguaje para reducir el tamaño del paquete, por ejemplo, aplicaciones Javascript que sacuden el árbol.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario, agregue su propio complemento CNI",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "text": "Funciones - Mantén tus funciones calientes",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario, configure la dirección IP pública por nodo en AKS",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
+ "text": "Al usar el escalado automático con diferentes funciones, es posible que haya uno que controle todo el escalado automático para todos los recursos: considere la posibilidad de moverlo a un plan de consumo independiente (y considere un plan superior para la CPU)",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
- "severity": "Medio",
- "text": "Use un controlador de entrada para exponer aplicaciones basadas en web en lugar de exponerlas con servicios de tipo LoadBalancer",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
+ "text": "Las aplicaciones de funciones de un plan determinado se escalan juntas, por lo que cualquier problema con el escalado puede afectar a todas las aplicaciones del plan.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Uso de Azure NAT Gateway como outboundType para escalar el tráfico de salida",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
+ "text": "¿Se me factura por el \"tiempo de espera\"? Esta pregunta se suele formular en el contexto de una función de C# que realiza una operación asincrónica y espera el resultado, por ejemplo, await Task.Delay(1000) o await client. GetAsync('http://google.com'). La respuesta es sí: el segundo cálculo de GB se basa en la hora de inicio y finalización de la función y el uso de memoria durante ese período. Lo que realmente sucede durante ese tiempo en términos de actividad de la CPU no se tiene en cuenta en el cálculo. Una excepción a esta regla es si está utilizando funciones duraderas. No se le facturará por el tiempo empleado en las esperas en las funciones de orquestador.aplique técnicas de modelado de la demanda siempre que sea posible (¿entornos de desarrollo?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
- "severity": "Medio",
- "text": "Uso de asignaciones dinámicas de direcciones IP para evitar el agotamiento de direcciones IP de Azure CNI",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "text": "Frontdoor: desactivar la página principal predeterminadaEn la configuración de la aplicación de la aplicación, establezca AzureWebJobsDisableHomepage en true. Esto devolverá un 204 (sin contenido) al PoP para que solo se devuelvan los datos del encabezado.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
- "severity": "Alto",
- "text": "Filtre el tráfico de salida con AzFW/NVA si sus requisitos de seguridad lo exigen",
- "waf": "Seguridad"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "text": "Frontdoor: ruta a algo que no devuelve nada. Configure una función, un proxy de función o agregue una ruta en la aplicación web que devuelva 200 (correctamente) y envíe contenido mínimo o nulo. La ventaja de esto es que podrá cerrar la sesión cuando se llame.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
- "severity": "Medio",
- "text": "Si utiliza un punto de conexión de API público, restrinja las direcciones IP que pueden acceder a él",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "text": "Considere la posibilidad de archivar niveles para los datos menos utilizados",
+ "waf": "Costar"
},
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
- "severity": "Alto",
- "text": "Utilice clústeres privados si sus requisitos lo exigen",
- "waf": "Seguridad"
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "text": "Compruebe los tamaños de disco en los que el tamaño no coincida con el nivel (es decir, un disco de 513 GiB pagará un P30 (1 TiB) y considere la posibilidad de cambiar el tamaño",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "Medio",
- "text": "Para los nodos de AKS de Windows 2019 y 2022, se pueden usar directivas de red de Calico ",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "text": "Considere la posibilidad de utilizar un SSD estándar en lugar de Premium o Ultra siempre que sea posible",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "Alto",
- "text": "Habilitación de una opción de directiva de red de Kubernetes (Calico/Azure)",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "text": "En el caso de las cuentas de almacenamiento, asegúrese de que el nivel elegido no suma cargos por transacción (puede ser más barato pasar al siguiente nivel)",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "Alto",
- "text": "Uso de directivas de red de Kubernetes para aumentar la seguridad dentro del clúster",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "text": "Para ASR, considere la posibilidad de usar discos SSD estándar si el RPO/RTO y el rendimiento de replicación lo permiten",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "Alto",
- "text": "Uso de un WAF para cargas de trabajo web (interfaces de usuario o API)",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "text": "Cuentas de almacenamiento: compruebe el nivel de acceso frecuente o GRS necesario",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
- "severity": "Medio",
- "text": "Uso de DDoS Standard en la red virtual de AKS",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "text": "Discos: valide el uso de discos SSD Premium en todas partes: por ejemplo, los que no son de producción podrían cambiar a SSD estándar o SSD Premium bajo demanda ",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario, agregue el proxy HTTP de la empresa",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "text": "Cree presupuestos para administrar los costos y cree alertas que notifiquen automáticamente a las partes interesadas sobre anomalías en el gasto y riesgos de gasto excesivo.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
- "severity": "Medio",
- "text": "Considere la posibilidad de usar una malla de servicios para la administración avanzada de comunicaciones de microservicios",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "text": "Exporte los datos de costos a una cuenta de almacenamiento para realizar análisis de datos adicionales.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
- "severity": "Alto",
- "text": "Configurar alertas sobre las métricas más críticas (consulte Container Insights para obtener recomendaciones)",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "text": "Controle los costos de un grupo de SQL dedicado pausando el recurso cuando no esté en uso.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Consulte periódicamente Azure Advisor para obtener recomendaciones sobre el clúster",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "text": "Habilite la función de pausa automática de Apache Spark sin servidor y establezca el valor de tiempo de espera en consecuencia.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Habilitación de la rotación automática de certificados de AKS",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "text": "Cree varias definiciones de grupo de Apache Spark de varios tamaños.",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
- "severity": "Alto",
- "text": "Tenga un proceso regular para actualizar la versión de Kubernetes periódicamente (trimestralmente, por ejemplo) o use la característica de actualización automática de AKS",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "text": "Compre unidades de confirmación (SCU) de Azure Synapse durante un año con un plan de compra anticipada para ahorrar en los costos de Azure Synapse Analytics.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
- "severity": "Alto",
- "text": "Utilice kured para las actualizaciones de nodos de Linux en caso de que no esté utilizando la actualización de imagen de nodo",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
+ "text": "Uso de máquinas virtuales de acceso puntual para trabajos interrumpibles: se trata de máquinas virtuales por las que se puede pujar y comprar a un precio reducido, lo que proporciona una solución rentable para cargas de trabajo no críticas.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
- "severity": "Alto",
- "text": "Disponer de un proceso regular para actualizar las imágenes de los nodos del clúster periódicamente (semanalmente, por ejemplo)",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "text": "Ajustar el tamaño de todas las máquinas virtuales",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Considere la posibilidad de implementar aplicaciones o configuraciones de clústeres en varios clústeres",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "text": "Intercambiar el tamaño de la máquina virtual con los tamaños normalizados y más recientes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Considere la posibilidad de usar la invocación de comandos de AKS en clústeres privados",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "Ajustar el tamaño de las máquinas virtuales: comience con la supervisión del uso por debajo del 5 % y, a continuación, trabaje hasta el 40 %",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "Bajo",
- "text": "En el caso de los eventos planeados, considere la posibilidad de utilizar el drenaje automático de nodos",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "La inclusión de una aplicación en contenedores puede mejorar la densidad de la máquina virtual y ahorrar dinero en su escalado",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Costar"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Desarrollar sus propias prácticas de gobernanza para asegurarse de que los operadores no realicen cambios en el nodo RG (también conocido como 'infra RG')",
- "waf": "Operaciones"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Usar el nombre personalizado de Node RG (también conocido como 'Infra RG')",
- "waf": "Operaciones"
+ "text": "Siga las barreras de seguridad de Metaprompting para una IA responsable",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
- "severity": "Medio",
- "text": "No use API de Kubernetes obsoletas en los manifiestos de YAML",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de crear patrones de puerta de enlace con APIM o soluciones como AI Central para mejorar la limitación de velocidad, el equilibrio de carga, la autenticación y el registro",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Nodos de Windows de Taint",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Habilitación de la supervisión para las instancias de AOAI",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Mantener el nivel de revisión de los contenedores de Windows sincronizado con el nivel de revisión del host",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Cree alertas para notificar a los equipos de eventos, como una entrada en el registro de actividad creada por una acción realizada en el recurso, como la regeneración de sus claves de suscripción, o un umbral de métrica, como el número de errores que superan los 10 en una hora",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "A través de la configuración de diagnóstico en el nivel de clúster",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Envío de registros maestros (también conocidos como registros de API) a Azure Monitor o a la solución de administración de registros que prefiera",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Supervise el uso de tokens para evitar interrupciones del servicio debido a la capacidad",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si es necesario, utilice instantáneas de nodePool",
- "waf": "Costar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Observe métricas como tokens de inferencia procesados, tokens de finalización generados, monitoree el límite de velocidad",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
"severity": "Bajo",
- "text": "Considere la posibilidad de crear grupos de nodos de acceso puntual para cargas de trabajo no urgentes",
- "waf": "Operaciones"
+ "text": "Si los diagnósticos no son suficientes para usted, considere la posibilidad de usar una puerta de enlace como Azure API Managements frente a Azure OpenAI para registrar tanto los mensajes entrantes como las respuestas salientes, cuando esté permitido",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Considere la posibilidad de utilizar el nodo virtual de AKS para una ráfaga rápida",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Use la infraestructura como código para implementar el servicio Azure OpenAI, las implementaciones de modelos y todos los recursos relacionados",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Supervise las métricas de clúster con Container Insights (u otras herramientas como Prometheus)",
- "waf": "Operaciones"
+ "text": "Uso de la autenticación de Microsoft Entra con identidad administrada en lugar de clave de API",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Almacene y analice los registros del clúster con Container Insights (u otras herramientas como Telegraf/ElasticSearch)",
- "waf": "Operaciones"
+ "text": "Evalúe el rendimiento/precisión del sistema con un conjunto de datos dorado conocido que tenga las entradas y las respuestas correctas. Aproveche las capacidades de PromptFlow para la evaluación.",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
- "severity": "Medio",
- "text": "Supervisar el uso de la CPU y la memoria de los nodos",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Evaluación del uso del modelo de rendimiento aprovisionado ",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "Medio",
- "text": "Si usa Azure CNI, supervise el porcentaje de direcciones IP de pod consumidas por nodo",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Revisión e implementación de la seguridad del contenido de Azure AI",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "La E/S en el disco del sistema operativo es un recurso crítico. Si el sistema operativo de los nodos se limita en la E/S, esto podría dar lugar a un comportamiento impredecible, que normalmente terminaría en que el nodo se declarara NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
- "severity": "Medio",
- "text": "Supervisión de la profundidad de la cola de disco del sistema operativo en los nodos",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Defina y evalúe el rendimiento del sistema en función de los tokens y la respuesta por minuto y alinee con los requisitos",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Si no usa el filtrado de salida con AzFW/NVA, supervise los puertos SNAT asignados por ALB estándar",
- "waf": "Operaciones"
+ "text": "Mejore la latencia del sistema limitando el tamaño de los tokens, las opciones de transmisión",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Suscríbase a las notificaciones de estado de los recursos para el clúster de AKS",
- "waf": "Operaciones"
+ "text": "Calcule las demandas de elasticidad para determinar la segregación de solicitudes sincrónicas y por lotes en función de la prioridad. Para la prioridad alta, utilice el enfoque sincrónico y para la prioridad baja, se prefiere el procesamiento por lotes asincrónico con cola",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Configurar solicitudes y límites en las especificaciones del pod",
- "waf": "Operaciones"
+ "text": "Compare los requisitos de consumo de tokens en función de las demandas estimadas de los consumidores. Considere la posibilidad de usar la herramienta de pruebas comparativas de Azure OpenAI para ayudarle a validar el rendimiento si usa implementaciones de unidades de rendimiento aprovisionadas",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Aplicación de cuotas de recursos para espacios de nombres",
- "waf": "Operaciones"
+ "text": "Si usa unidades de rendimiento aprovisionadas (PTU), considere la posibilidad de implementar una implementación de token por minuto (TPM) para las solicitudes de desbordamiento. Use una puerta de enlace para enrutar las solicitudes a la implementación de TPM cuando se alcancen los límites de PTU.",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Asegúrese de que la suscripción tiene suficiente cuota para escalar horizontalmente los grupos de nodos",
- "waf": "Operaciones"
+ "text": "Elija el modelo adecuado para la tarea correcta. Elija modelos con el equilibrio adecuado entre velocidad, calidad de respuesta y complejidad de salida",
+ "waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Uso del escalador automático de clústeres",
+ "text": "Tener una línea de base para el rendimiento sin ajuste fino para saber si el ajuste fino ha mejorado o no el rendimiento del modelo",
"waf": "Rendimiento"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"severity": "Bajo",
- "text": "Personalización de la configuración de nodos para grupos de nodos de AKS",
- "waf": "Rendimiento"
+ "text": "Implementación de varias instancias de OAI en todas las regiones",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Implemente reintentos y comprobaciones de estado con el patrón de puerta de enlace como APIM",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Usar el escalador automático horizontal de pods cuando sea necesario",
- "waf": "Rendimiento"
+ "text": "Asegúrese de tener cuotas adecuadas de TPM y RPM para la carga de trabajo",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "Los nodos más grandes aportarán un mayor rendimiento y características como discos efímeros y redes aceleradas, pero aumentarán el radio de explosión y disminuirán la granularidad de escalado",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
- "severity": "Alto",
- "text": "Considere un tamaño de nodo adecuado, ni demasiado grande ni demasiado pequeño",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Revise las consideraciones de la guía del kit de herramientas de HAI y aplique esas prácticas de interacción para el slution",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Si se requieren más de 5000 nodos para la escalabilidad, considere la posibilidad de usar un clúster de AKS adicional",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Implemente modelos de ajuste de precisión independientes en todas las regiones si se emplea el ajuste de precisión",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Considere la posibilidad de suscribirse a eventos de EventGrid para la automatización de AKS",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Realice copias de seguridad y replique regularmente los datos críticos para garantizar la disponibilidad y la capacidad de recuperación de los datos en caso de pérdida de datos o fallos del sistema. Aproveche los servicios de copia de seguridad y recuperación ante desastres de Azure para proteger sus datos.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Para una operación de ejecución prolongada en un clúster de AKS, considere la finalización de eventos",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Los niveles de servicio de búsqueda de Azure AI deben elegirse para tener un Acuerdo de Nivel de Servicio ",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
"severity": "Bajo",
- "text": "Si es necesario, considere la posibilidad de usar Azure Dedicated Hosts para nodos de AKS",
- "waf": "Rendimiento"
+ "text": "Clasifique los datos y la confidencialidad, etiquetando con Microsoft Purview antes de generar las incrustaciones y asegúrese de tratar las incrustaciones generadas con la misma confidencialidad y clasificación",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Usar discos de sistema operativo efímeros",
- "waf": "Rendimiento"
+ "text": "Cifre los datos utilizados para RAG con cifrado SSE/Disk con BYOK opcional",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "En el caso de los discos no efímeros, use IOPS altas y discos de sistema operativo más grandes para los nodos cuando ejecute muchos pods o nodos, ya que requiere un alto rendimiento para ejecutar varios pods y generará registros enormes con umbrales de rotación de registros de AKS predeterminados",
- "waf": "Rendimiento"
+ "text": "Asegúrese de que TLS se aplica a los datos en tránsito a través de fuentes de datos, la búsqueda de IA utilizada para la generación aumentada de recuperación (RAG) y la comunicación de LLM",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "Bajo",
- "text": "Para la opción de almacenamiento de hiperrendimiento, use discos Ultra en AKS",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Use RBAC para administrar el acceso a los servicios de Azure OpenAI. Asigne los permisos adecuados a los usuarios y restrinja el acceso en función de sus funciones y responsabilidades",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Evite mantener el estado en el clúster y almacene los datos fuera (AzStorage, AzSQL, Cosmos, etc.)",
- "waf": "Rendimiento"
+ "text": "Implemente técnicas de cifrado, enmascaramiento o redacción de datos para ocultar datos confidenciales o reemplazarlos con valores ofuscados en entornos que no sean de producción o al compartir datos con fines de prueba o solución de problemas",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
- "severity": "Medio",
- "text": "Si usa AzFiles Standard, considere AzFiles Premium o ANF por motivos de rendimiento",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Use Azure Defender para detectar y responder a las amenazas de seguridad y configurar mecanismos de supervisión y alerta para identificar actividades sospechosas o infracciones. Aproveche Azure Sentinel para la detección y respuesta a amenazas avanzadas",
+ "waf": "Seguridad"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Si usa Azure Disks y AZ, considere la posibilidad de tener grupos de nodos dentro de una zona para el disco LRS con VolumeBindingMode:WaitForFirstConsumer para aprovisionar el almacenamiento en la zona correcta o use el disco ZRS para los grupos de nodos que abarquen varias zonas",
- "waf": "Rendimiento"
+ "text": "Establezca políticas de retención y eliminación de datos para cumplir con las regulaciones de cumplimiento. Implemente métodos de eliminación seguros para los datos que ya no son necesarios y mantenga un registro de auditoría de las actividades de retención y eliminación de datos",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Implemente los escudos de aviso y la detección de conexión a tierra mediante Content Safety ",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Familiarícese con los procedimientos recomendados de Key Vault, como las recomendaciones de aislamiento, el control de acceso, la protección de datos, la copia de seguridad y el registro.",
- "waf": "Fiabilidad"
+ "text": "Garantice el cumplimiento de las normativas de protección de datos pertinentes, como el RGPD o la HIPAA, mediante la implementación de controles de privacidad y la obtención de los consentimientos o permisos necesarios para las actividades de tratamiento de datos.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Key Vault es un servicio administrado y Microsoft se encargará de la conmutación por error dentro de la región y entre ellas. Familiarícese con la disponibilidad y la redundancia de Key Vault.",
- "waf": "Fiabilidad"
+ "text": "Eduque a sus empleados sobre las mejores prácticas de seguridad de datos, la importancia de manejar los datos de forma segura y los riesgos potenciales asociados con las violaciones de datos. Anímelos a seguir diligentemente los protocolos de seguridad de datos.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
- "severity": "Medio",
- "text": "El contenido del almacén de claves se replica dentro de la región y en una región secundaria a una distancia mínima de 150 millas, pero dentro de la misma geografía para mantener una alta durabilidad de las claves y los secretos. Familiarícese con la replicación de datos de Key Vault.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Mantenga los datos de producción separados de los datos de desarrollo y pruebas. Utilice únicamente datos confidenciales reales en producción y utilice datos anónimos o sintéticos en entornos de desarrollo y prueba.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Durante la conmutación por error, no se pueden cambiar las configuraciones y valores de la directiva de acceso o del firewall. El almacén de claves estará en modo de solo lectura durante la conmutación por error. Familiarícese con las instrucciones de conmutación por error de Key Vault.",
- "waf": "Fiabilidad"
+ "text": "Si tiene distintos niveles de confidencialidad de datos, considere la posibilidad de crear índices independientes para cada nivel. Por ejemplo, podría tener un índice para los datos generales y otro para los datos confidenciales, cada uno gobernado por diferentes protocolos de acceso",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Al realizar una copia de seguridad de un objeto de almacén de claves, como un secreto, una clave o un certificado, la operación de copia de seguridad descargará el objeto como un blob cifrado. Este blob no se puede descifrar fuera de Azure. Para obtener datos utilizables de este blob, debe restaurar el blob en un almacén de claves dentro de la misma suscripción de Azure y la misma geografía de Azure. Familiarícese con las instrucciones de copia de seguridad y restauración de Key Vault.",
- "waf": "Fiabilidad"
+ "text": "Lleve la segregación un paso más allá colocando conjuntos de datos confidenciales en diferentes instancias del servicio. Cada instancia se puede controlar con su propio conjunto específico de políticas RBAC",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Si desea protegerse contra la eliminación accidental o malintencionada de los secretos, configure las características de protección contra eliminación temporal y purga en el almacén de claves.",
- "waf": "Fiabilidad"
+ "text": "Reconozca que las incrustaciones y los vectores generados a partir de información confidencial son en sí mismos confidenciales. Estos datos deben recibir las mismas medidas de protección que el material de origen",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "Bajo",
- "text": "Los recursos eliminados temporalmente de Key Vault se conservan durante un período establecido de 90 días naturales. Familiarícese con las instrucciones de eliminación temporal de Key Vault.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Aplique RBAC a los almacenes de datos que tienen incrustaciones y vectores y alcance el acceso en función de los requisitos de acceso del rol",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Bajo",
- "text": "Descripción de las limitaciones de la copia de seguridad de Key Vault. Key Vault no admite la capacidad de realizar copias de seguridad de más de 500 versiones anteriores de un objeto de clave, secreto o certificado. Al intentar hacer una copia de seguridad de una clave, un secreto o un objeto de certificado, es posible que se produzca un error. No es posible eliminar versiones anteriores de una clave, un secreto o un certificado.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Configure un punto de conexión privado para que los servicios de IA restrinjan el acceso al servicio dentro de su red",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Bajo",
- "text": "Actualmente, Key Vault no proporciona una manera de realizar una copia de seguridad de un almacén de claves completo en una sola operación y las claves, los secretos y los certificados deben respaldarse de forma individual. Familiarícese con las instrucciones de copia de seguridad y restauración de Key Vault.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Aplique un estricto control del tráfico entrante y saliente con Azure Firewall y UDR, y limite los puntos de integración externos",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
- "severity": "Medio",
- "text": "Se recomienda la protección de purga cuando se utilizan claves para el cifrado para evitar la pérdida de datos. La protección de purga es un comportamiento opcional de Key Vault y no está habilitada de forma predeterminada. La protección de purga solo se puede habilitar una vez que se habilita la eliminación temporal. Se puede activar a través de CLI, PowerShell o Portal.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Implemente la segmentación de la red y los controles de acceso para restringir el acceso a la aplicación LLM solo a los usuarios y sistemas autorizados y evitar el movimiento lateral",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Se recomienda RBAC para controlar el acceso al almacén de claves. Familiarícese con las instrucciones de control de acceso de Key Vault.",
- "waf": "Seguridad"
+ "text": "Utilice herramientas de compresión rápida como LLMLingua o gprtrim",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
- "severity": "Medio",
- "text": "Implementar una política de control de errores a nivel global",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Asegúrese de que las API y los puntos finales utilizados por la aplicación LLM estén correctamente protegidos con mecanismos de autenticación y autorización, como identidades administradas, claves de API u OAuth, para evitar el acceso no autorizado.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Asegúrese de que todas las políticas de API incluyan un elemento.",
- "waf": "Operaciones"
+ "text": "Aplique mecanismos sólidos de autenticación de usuario final, como la autenticación multifactor, para evitar el acceso no autorizado a la aplicación LLM y a los recursos de red asociados",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Uso de fragmentos de políticas para evitar repetir las mismas definiciones de políticas en varias API",
- "waf": "Operaciones"
+ "text": "Implemente herramientas de monitoreo de red para detectar y analizar el tráfico de red en busca de actividades sospechosas o maliciosas. Habilite el registro para capturar eventos de red y facilitar el análisis forense en caso de incidentes de seguridad",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Si planeas monetizar tus API, revisa el artículo \"Soporte de monetización\" para conocer las prácticas recomendadas",
- "waf": "Operaciones"
+ "text": "Realizar auditorías de seguridad y pruebas de penetración para identificar y abordar cualquier debilidad o vulnerabilidad de seguridad de red en la infraestructura de red de la aplicación LLM",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
- "severity": "Alto",
- "text": "Habilitación de la configuración de diagnóstico para exportar registros a Azure Monitor",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "severity": "Bajo",
+ "text": "Los servicios de Azure AI están etiquetados correctamente para una mejor administración",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
- "severity": "Medio",
- "text": "Habilitación de Application Insights para obtener telemetría más detallada",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "Bajo",
+ "text": "Las cuentas de Azure AI Service siguen las convenciones de nomenclatura de la organización",
+ "waf": "Excelencia Operacional"
},
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Configurar alertas sobre las métricas más críticas",
- "waf": "Operaciones"
+ "text": "Los registros de diagnóstico en los recursos de servicios de Azure AI deben estar habilitados",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Asegúrese de que los certificados SSL personalizados se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura",
+ "text": "Se recomienda deshabilitar el acceso a claves (autenticación local) por seguridad. Después de deshabilitar el acceso basado en claves, el identificador de Microsoft Entra se convierte en el único método de acceso, lo que permite mantener el principio de privilegio mínimo y el control granular. ",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Protección de las solicitudes entrantes a las API (plano de datos) con Azure AD",
+ "text": "Almacene y administre claves de forma segura con Azure Key Vault. Evite codificar de forma rígida o incrustar claves confidenciales en el código de la aplicación de LLM y recupérelas de forma segura de Azure Key Vault mediante identidades administradas",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
- "severity": "Medio",
- "text": "Usar el identificador de Microsoft Entra para autenticar a los usuarios en el Portal para desarrolladores",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Rotar y expirar periódicamente las claves almacenadas en Azure Key Vault para minimizar el riesgo de acceso no autorizado.",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
- "severity": "Medio",
- "text": "Crear grupos adecuados para controlar la visibilidad de los productos",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Use tiktoken para comprender los tamaños de los tokens para las optimizaciones de tokens en el modo conversacional",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
- "severity": "Medio",
- "text": "Utilice la función Backends para eliminar las configuraciones redundantes de back-end de la API",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Siga prácticas de codificación seguras para evitar vulnerabilidades comunes, como ataques de inyección, secuencias de comandos entre sitios (XSS) o errores de configuración de seguridad.",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
- "severity": "Medio",
- "text": "Usar valores con nombre para almacenar valores comunes que se pueden usar en directivas",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Configurar un proceso para actualizar y parchear regularmente las bibliotecas de LLM y otros componentes del sistema",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
- "severity": "Medio",
- "text": "En el caso de la recuperación ante desastres, aproveche el nivel premium con implementaciones escaladas en dos o más regiones para un acuerdo de nivel de servicio del 99,99 %",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Cumplir con los términos de uso, las directivas y las directrices de Azure OpenAI u otros LLM, así como con los casos de uso permitidos.",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Implemente al menos una unidad en dos o más zonas de disponibilidad para obtener un SLA aumentado del 99,99 %",
- "waf": "Fiabilidad"
+ "text": "Comprenda la diferencia en el costo de los modelos base y los modelos ajustados y los tamaños de paso de token",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Asegúrese de que haya una rutina de copia de seguridad automatizada",
- "waf": "Fiabilidad"
+ "text": "Solicitudes por lotes, siempre que sea posible, para minimizar la sobrecarga por llamada, lo que puede reducir los costos generales. Asegúrese de optimizar el tamaño del lote",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Use directivas para agregar una dirección URL de back-end de conmutación por error y el almacenamiento en caché para reducir las llamadas con errores.",
- "waf": "Fiabilidad"
+ "text": "Configure un sistema de seguimiento de costos que supervise el uso del modelo y use esa información para ayudar a informar las opciones de modelos y los tamaños indicados",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "Bajo",
- "text": "Si necesita iniciar sesión en niveles de alto rendimiento, tenga en cuenta la directiva de Event Hubs",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Establezca un límite máximo en el número de tokens por respuesta de modelo. Optimice el tamaño para asegurarse de que sea lo suficientemente grande para una respuesta válida",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Aplicación de directivas de limitación para controlar el número de solicitudes por segundo",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "Rendimiento"
+ "text": "Revise las instrucciones proporcionadas sobre la configuración de la búsqueda de IA para la confiabilidad",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Configurar el escalado automático para escalar horizontalmente el número de instancias cuando aumenta la carga",
- "waf": "Rendimiento"
+ "text": "Planifique y administre el almacenamiento de vectores de búsqueda de IA",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Implemente puertas de enlace autohospedadas en las que Azure no tenga una región cercana a las API de back-end.",
- "waf": "Rendimiento"
+ "text": "Aplique prácticas de LLMOps para automatizar la gestión del ciclo de vida de sus aplicaciones GenAI",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
- "severity": "Medio",
- "text": "Use el nivel premium para las cargas de trabajo de producción.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Evalúe el uso de los modelos de facturación: PAYG frente a PTU",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "En el modelo de varias regiones, use directivas para enrutar las solicitudes a los back-ends regionales en función de la disponibilidad o la latencia.",
- "waf": "Fiabilidad"
+ "text": "Evalúe la calidad de los mensajes y las aplicaciones al cambiar entre versiones de modelo",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
- "severity": "Alto",
- "text": "Tenga en cuenta los límites de APIM",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Evalúe, supervise y perfeccione sus aplicaciones GenAI para características como la fundamentación, la relevancia, la precisión, la coherencia, la fluidez,",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
- "severity": "Alto",
- "text": "Asegúrese de que las implementaciones de puerta de enlace autohospedadas sean resistentes.",
- "waf": "Fiabilidad"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
+ "severity": "Medio",
+ "text": "Evalúe los resultados de búsqueda de Azure AI en función de diferentes parámetros de búsqueda",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Uso de Azure Front Door delante de APIM para la implementación en varias regiones",
- "waf": "Rendimiento"
+ "text": "Considere los modelos de ajuste fino como una forma de aumentar la precisión solo cuando haya probado otros enfoques básicos como la ingeniería de avisos y RAG con sus datos",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Implementación del servicio dentro de una red virtual (VNet)",
- "waf": "Seguridad"
+ "text": "Utilice técnicas de ingeniería rápida para mejorar la precisión de las respuestas de LLM",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Implemente grupos de seguridad de red (NSG) en las subredes para restringir o supervisar el tráfico hacia/desde APIM.",
+ "text": "Equipo rojo con sus aplicaciones GenAI",
"waf": "Seguridad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Implemente puntos de conexión privados para filtrar el tráfico entrante cuando APIM no se implemente en una red virtual.",
- "waf": "Seguridad"
+ "text": "Proporcione a los usuarios finales opciones de puntuación para las respuestas de LLM y realice un seguimiento de estas puntuaciones. ",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Deshabilitar el acceso a la red pública",
- "waf": "Seguridad"
+ "text": "Considere las prácticas de administración de cuotas",
+ "waf": "Optimización de costes"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
"severity": "Medio",
- "text": "Simplifique la administración con scripts de automatización de PowerShell",
- "waf": "Operaciones"
+ "text": "Utilice soluciones de equilibrador de carga, como la puerta de enlace basada en APIM, para equilibrar la carga y la capacidad entre servicios y regiones",
+ "waf": "Excelencia Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
"severity": "Medio",
- "text": "Configure APIM a través de la infraestructura como código. Revise las prácticas recomendadas de DevOps desde el acelerador de zonas de aterrizaje de API de Cloud Adaption Framework",
- "waf": "Operaciones"
+ "text": "Aproveche el cuaderno de estrategias de resistencia de FTA para Azure Data Factory",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "Alto",
+ "text": "Uso de canalizaciones con redundancia de zona en regiones que admiten zonas de disponibilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
"severity": "Medio",
- "text": "Promover el uso de la extensión APIM de Visual Studio Code para un desarrollo de API más rápido",
- "waf": "Operaciones"
+ "text": "Uso de DevOps para realizar copias de seguridad de las plantillas de ARM con la integración de Github/Azure DevOps ",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "Medio",
- "text": "Implemente DevOps y CI/CD en su flujo de trabajo",
- "waf": "Operaciones"
+ "text": "Asegúrese de replicar las máquinas virtuales de Integration Runtime autohospedadas en otra región ",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "Medio",
- "text": "API seguras mediante la autenticación de certificados de cliente",
- "waf": "Seguridad"
+ "text": "Asegúrese de replicar o duplicar la red en la región hermana. Tiene que hacer una copia de la red virtual en otra región",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "Si las canalizaciones de ADF usan Key Vault, no tiene que hacer nada para replicar Key Vault. Key Vault es un servicio administrado y Microsoft se encarga de ello por ti",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
+ "severity": "Bajo",
+ "text": "Si utiliza la integración de Keyvault, utilice el Acuerdo de Nivel de Servicio de Keyvault para comprender su disponibilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"severity": "Medio",
- "text": "Servicios de back-end seguros mediante la autenticación de certificados de cliente",
- "waf": "Seguridad"
+ "text": "Azure Spring Apps permite dos implementaciones para cada aplicación, de las cuales solo una recibe tráfico de producción. Puede lograr cero tiempo de inactividad con estrategias de implementación azul verde. La implementación azul verde solo está disponible en los niveles Estándar y Enterprise. Puede automatizar la implementación mediante CI/CD con acciones de ADO/GitHub",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"severity": "Medio",
- "text": "Revise el artículo \"Recomendaciones para mitigar las 10 principales amenazas de seguridad de la API de OWASP\" y compruebe qué se aplica a sus API",
- "waf": "Seguridad"
+ "text": "Las instancias de Azure Spring Apps se pueden crear en varias regiones para las aplicaciones y el tráfico se puede enrutar mediante Traffic Manager o Front Door.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"severity": "Medio",
- "text": "Utilice la función Autorizaciones para simplificar la administración del token de OAuth 2.0 para las API de back-end",
- "waf": "Seguridad"
+ "text": "En la región admitida, Azure Spring Apps se puede implementar como zona redundante, lo que significa que las instancias se distribuyen automáticamente entre las zonas de disponibilidad. Esta función solo está disponible en los niveles Standard y Enterprise.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
- "severity": "Alto",
- "text": "Utilice la versión más reciente de TLS al cifrar la información en tránsito. Deshabilite los protocolos y cifrados obsoletos e innecesarios cuando sea posible.",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
+ "severity": "Medio",
+ "text": "Usar más de 1 instancia de aplicación para las aplicaciones",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
- "severity": "Alto",
- "text": "Asegúrese de que los secretos (valores con nombre) se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
+ "severity": "Medio",
+ "text": "Supervise Azure Spring Apps con registros, métricas y seguimiento. Integre ASA con la información de las aplicaciones, realice un seguimiento de los errores y cree libros de trabajo.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
+ "severity": "Medio",
+ "text": "Configuración del escalado automático en Spring Cloud Gateway",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "Bajo",
+ "text": "Habilite el escalado automático para las aplicaciones con el consumo estándar y el plan dedicado.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"severity": "Medio",
- "text": "Uso de identidades administradas para autenticarse en otros recursos de Azure siempre que sea posible",
- "waf": "Seguridad"
+ "text": "Use el plan Enterprise para obtener soporte comercial de Spring Boot para aplicaciones de misión crítica. Con otros niveles, obtienes soporte OSS.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Uso del firewall de aplicaciones web (WAF) mediante la implementación de Application Gateway delante de APIM",
- "waf": "Seguridad"
+ "text": "Familiarícese con los procedimientos recomendados de Key Vault, como las recomendaciones de aislamiento, el control de acceso, la protección de datos, la copia de seguridad y el registro.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus Premium proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
- "severity": "Bajo",
- "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
+ "severity": "Medio",
+ "text": "Key Vault es un servicio administrado y Microsoft se encargará de la conmutación por error dentro de la región y entre ellas. Familiarícese con la disponibilidad y la redundancia de Key Vault.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "La comunicación entre una aplicación cliente y un espacio de nombres de Azure Service Bus se cifra mediante la seguridad de la capa de transporte (TLS). Los espacios de nombres de Azure Service Bus permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Service Bus para que requiera que los clientes envíen y reciban datos con una versión más reciente de TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
"severity": "Medio",
- "text": "Aplicar una versión mínima requerida de la seguridad de la capa de transporte (TLS) para las solicitudes ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Seguridad"
+ "text": "El contenido del almacén de claves se replica dentro de la región y en una región secundaria a una distancia mínima de 150 millas, pero dentro de la misma geografía para mantener una alta durabilidad de las claves y los secretos. Familiarícese con la replicación de datos de Key Vault.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Al crear un espacio de nombres de Service Bus, se crea automáticamente una regla de SAS denominada RootManageSharedAccessKey para el espacio de nombres. Esta política tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
"severity": "Medio",
- "text": "Evite usar la cuenta root cuando no sea necesario",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Seguridad"
+ "text": "Durante la conmutación por error, no se pueden cambiar las configuraciones y valores de la directiva de acceso o del firewall. El almacén de claves estará en modo de solo lectura durante la conmutación por error. Familiarícese con las instrucciones de conmutación por error de Key Vault.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Una aplicación cliente de Service Bus que se ejecuta dentro de una aplicación de Azure App Service o en una máquina virtual con entidades administradas habilitadas para la compatibilidad con recursos de Azure no necesita controlar reglas y claves de SAS, ni ningún otro token de acceso. La aplicación cliente solo necesita la dirección del punto de conexión del espacio de nombres de mensajería de Service Bus. ",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
"severity": "Medio",
- "text": "Cuando sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Service Bus. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Seguridad"
+ "text": "Al realizar una copia de seguridad de un objeto de almacén de claves, como un secreto, una clave o un certificado, la operación de copia de seguridad descargará el objeto como un blob cifrado. Este blob no se puede descifrar fuera de Azure. Para obtener datos utilizables de este blob, debe restaurar el blob en un almacén de claves dentro de la misma suscripción de Azure y la misma geografía de Azure. Familiarícese con las instrucciones de copia de seguridad y restauración de Key Vault.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Al crear permisos, proporcione un control detallado sobre el acceso de un cliente a Azure Service Bus. Los permisos de Azure Service Bus pueden y deben limitarse al nivel de recurso individual, por ejemplo, cola, tema o suscripción. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Usar RBAC del plano de datos con privilegios mínimos",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Seguridad"
+ "text": "Si desea protegerse contra la eliminación accidental o malintencionada de los secretos, configure las características de protección contra eliminación temporal y purga en el almacén de claves.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Los registros de recursos de Azure Service Bus incluyen registros operativos, redes virtuales y registros de filtrado de IP. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para varias operaciones de acceso al plano de datos (como enviar o recibir mensajes) en Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
- "severity": "Medio",
- "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para realizar un seguimiento de los registros de recursos y los registros de auditoría en tiempo de ejecución (actualmente solo disponible en el nivel Premium)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "Bajo",
+ "text": "Los recursos eliminados temporalmente de Key Vault se conservan durante un período establecido de 90 días naturales. Familiarícese con las instrucciones de eliminación temporal de Key Vault.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "De forma predeterminada, Azure Service Bus tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y los recorridos de Azure Service Bus a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se utilizan. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Bajo",
+ "text": "Descripción de las limitaciones de la copia de seguridad de Key Vault. Key Vault no admite la capacidad de realizar copias de seguridad de más de 500 versiones anteriores de un objeto de clave, secreto o certificado. Al intentar hacer una copia de seguridad de una clave, un secreto o un objeto de certificado, es posible que se produzca un error. No es posible eliminar versiones anteriores de una clave, un secreto o un certificado.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Bajo",
+ "text": "Actualmente, Key Vault no proporciona una manera de realizar una copia de seguridad de un almacén de claves completo en una sola operación y las claves, los secretos y los certificados deben respaldarse de forma individual. Familiarícese con las instrucciones de copia de seguridad y restauración de Key Vault.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"severity": "Medio",
- "text": "Considere la posibilidad de usar puntos de conexión privados para acceder a Azure Service Bus y deshabilitar el acceso a la red pública cuando corresponda.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Seguridad"
+ "text": "Se recomienda la protección de purga cuando se utilizan claves para el cifrado para evitar la pérdida de datos. La protección de purga es un comportamiento opcional de Key Vault y no está habilitada de forma predeterminada. La protección de purga solo se puede habilitar una vez que se habilita la eliminación temporal. Se puede activar a través de CLI, PowerShell o Portal.",
+ "waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Con el firewall de IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"severity": "Medio",
- "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres de Azure Service Bus desde direcciones IP o intervalos específicos",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Se recomienda RBAC para controlar el acceso al almacén de claves. Familiarícese con las instrucciones de control de acceso de Key Vault.",
"waf": "Seguridad"
},
{
@@ -7903,102 +7651,41 @@
"arm-service": "microsoft.network/applicationGateways",
"checklist": "Azure Application Delivery Networking",
"guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
- "severity": "Medio",
- "text": "Usar el equilibrio de carga de la capa de transporte",
- "waf": "Rendimiento"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
- "severity": "Medio",
- "text": "Configure el enrutamiento basado en el host o el nombre de dominio para varias aplicaciones web en una sola puerta de enlace",
- "waf": "Seguridad"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
- "severity": "Medio",
- "text": "Centralice la administración de certificados SSL para reducir la sobrecarga de cifrado y descifrado de una granja de servidores back-end",
- "waf": "Seguridad"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "Bajo",
- "text": "Use Application Gateway para obtener compatibilidad nativa con los protocolos WebSocket y HTTP/2",
- "waf": "Seguridad"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
- "severity": "Medio",
- "text": "Aproveche el cuaderno de estrategias de resistencia de FTA para Azure Data Factory",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "Alto",
- "text": "Uso de canalizaciones con redundancia de zona en regiones que admiten zonas de disponibilidad",
- "waf": "Fiabilidad"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"severity": "Medio",
- "text": "Uso de DevOps para realizar copias de seguridad de las plantillas de ARM con la integración de Github/Azure DevOps ",
- "waf": "Fiabilidad"
+ "text": "Usar el equilibrio de carga de la capa de transporte",
+ "waf": "Rendimiento"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"severity": "Medio",
- "text": "Asegúrese de replicar las máquinas virtuales de Integration Runtime autohospedadas en otra región ",
- "waf": "Fiabilidad"
+ "text": "Configure el enrutamiento basado en el host o el nombre de dominio para varias aplicaciones web en una sola puerta de enlace",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"severity": "Medio",
- "text": "Asegúrese de replicar o duplicar la red en la región hermana. Tiene que hacer una copia de la red virtual en otra región",
- "waf": "Fiabilidad"
+ "text": "Centralice la administración de certificados SSL para reducir la sobrecarga de cifrado y descifrado de una granja de servidores back-end",
+ "waf": "Seguridad"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "Si las canalizaciones de ADF usan Key Vault, no tiene que hacer nada para replicar Key Vault. Key Vault es un servicio administrado y Microsoft se encarga de ello por ti",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"severity": "Bajo",
- "text": "Si utiliza la integración de Keyvault, utilice el Acuerdo de Nivel de Servicio de Keyvault para comprender su disponibilidad",
- "waf": "Fiabilidad"
+ "text": "Use Application Gateway para obtener compatibilidad nativa con los protocolos WebSocket y HTTP/2",
+ "waf": "Seguridad"
},
{
"arm-service": "microsoft.network/frontdoors",
@@ -8405,6 +8092,76 @@
"text": "Al usar Front Door con origen como servicios de aplicación, considere la posibilidad de bloquear el tráfico a los servicios de aplicaciones solo a través de Azure Front Door mediante restricciones de acceso. ",
"waf": "Seguridad"
},
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "Alto",
+ "text": "Habilitación de 2 réplicas para que tengan una disponibilidad del 99,9 % para las operaciones de lectura",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "Medio",
+ "text": "Habilitación de 3 réplicas para que tengan una disponibilidad del 99,9 % para las operaciones de lectura y escritura",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "severity": "Alto",
+ "text": "Aproveche las zonas de disponibilidad habilitando réplicas de lectura o escritura",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
+ "severity": "Medio",
+ "text": "En el caso de la reincidencia regional, cree manualmente servicios en 2 o más regiones para la búsqueda, ya que no proporciona un método automatizado para replicar índices de búsqueda en regiones geográficas",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
+ "severity": "Medio",
+ "text": "Para sincronizar datos entre varios servicios, use indexadores para actualizar contenido en varios servicios o use las API de REST para insertar actualizaciones de contenido en varios servicios",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
+ "severity": "Medio",
+ "text": "Uso de Azure Traffic Manager para coordinar solicitudes",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
+ "severity": "Alto",
+ "text": "Realice una copia de seguridad y restaure un índice de Azure Cognitive Search. Use este código de ejemplo para realizar una copia de seguridad de la definición del índice y la instantánea en una serie de archivos JSON",
+ "waf": "Fiabilidad"
+ },
{
"arm-service": "Microsoft.BotService/botServices",
"checklist": "Azure Bot Service",
@@ -8436,1551 +8193,1794 @@
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
"severity": "Alto",
- "text": "Seleccione el plan de hospedaje de funciones adecuado en función de los requisitos de su empresa y SLO",
+ "text": "Aproveche las zonas de disponibilidad si corresponden regionalmente (esto se habilita automáticamente)",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "Alto",
- "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (no disponible para el nivel de consumo)",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "severity": "Medio",
+ "text": "Tenga en cuenta las conmutaciones por error iniciadas por Microsoft. Microsoft los ejerce en situaciones excepcionales para conmutar por error todos los centros de IoT de una región afectada a la región emparejada geográficamente correspondiente.",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
- "severity": "Medio",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
+ "severity": "Alto",
"text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "Alto",
- "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
+ "text": "Obtenga información sobre cómo desencadenar una conmutación por error manual.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
+ "severity": "Alto",
+ "text": "Obtenga información sobre cómo conmutar por recuperación después de una conmutación por error.",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario para las cargas de trabajo de Windows de AKS, se pueden usar contenedores HostProcess",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Utilice KEDA si ejecuta cargas de trabajo controladas por eventos",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Uso de Dapr para facilitar el desarrollo de microservicios",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Uso de la oferta de AKS respaldada por SLA",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Uso de presupuestos de interrupción en el pod y las definiciones de implementación",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
+ "severity": "Alto",
+ "text": "Si usa un registro privado, configure la replicación de regiones para almacenar imágenes en varias regiones",
"waf": "Fiabilidad"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
- "severity": "Alto",
- "text": "Asegúrese de que \"Siempre activado\" esté habilitado para todas las aplicaciones de funciones que se ejecutan en el plan de App Service",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Usar una aplicación externa como kubecost para asignar costos a diferentes usuarios",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Usar el modo de reducción vertical para eliminar/desasignar nodos",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Cuando sea necesario, use la GPU de partición de varias instancias en clústeres de AKS",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
- "severity": "Medio",
- "text": "Empareje una aplicación de funciones con su propia cuenta de almacenamiento. Intente no volver a usar las cuentas de almacenamiento para las aplicaciones de funciones a menos que estén estrechamente acopladas",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si se ejecuta un clúster de desarrollo y pruebas, use NodePool Start/Stop",
+ "waf": "Costar"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"severity": "Medio",
- "text": "Aproveche Azure DevOps o GitHub para optimizar la CI/CD y proteger el código de la aplicación de funciones",
- "waf": "Operaciones"
+ "text": "Uso de Azure Policy para Kubernetes para garantizar el cumplimiento de clústeres",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"severity": "Medio",
- "text": "Azure Center for SAP solutions (ACSS) es una oferta de Azure que convierte a SAP en una carga de trabajo de nivel superior en Azure. ACSS es una solución integral que permite crear y ejecutar sistemas SAP como una carga de trabajo unificada en Azure y proporciona una base más fluida para la innovación. Puede aprovechar las capacidades de administración de los sistemas SAP basados en Azure nuevos y existentes.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "Operaciones"
+ "text": "Separe las aplicaciones del plano de control con grupos de nodos de usuario/sistema",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
- "severity": "Medio",
- "text": "Azure admite la automatización de implementaciones de SAP en Linux y Windows. SAP Deployment Automation Framework es una herramienta de orquestación de código abierto que puede implementar, instalar y mantener entornos SAP.",
- "training": "https://github.com/Azure/sap-automation",
- "waf": "Operaciones"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Agregue taint a su grupo de nodos del sistema para que sea dedicado",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"severity": "Medio",
- "text": "Realice una recuperación a un momento dado para sus bases de datos de producción en cualquier momento y en un período de tiempo que cumpla con su RTO; La recuperación a un momento dado suele incluir errores del operador que eliminan datos en la capa DBMS o a través de SAP, por cierto",
- "waf": "Fiabilidad"
+ "text": "Utilice un registro privado para sus imágenes, como ACR",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"severity": "Medio",
- "text": "Pruebe los tiempos de copia de seguridad y recuperación para verificar que cumplan con los requisitos de RTO para restaurar todos los sistemas simultáneamente después de un desastre.",
- "waf": "Fiabilidad"
+ "text": "Escanea tus imágenes en busca de vulnerabilidades",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"severity": "Alto",
- "text": "Puede replicar el almacenamiento estándar entre regiones emparejadas, pero no puede usar el almacenamiento estándar para almacenar sus bases de datos o discos duros virtuales. Solo puede replicar copias de seguridad entre las regiones emparejadas que utilice. Para todos los demás datos, ejecute la replicación mediante características nativas de DBMS, como SQL Server Always On o SAP HANA System Replication. Utilice una combinación de Site Recovery, rsync o robocopy y otro software de terceros para la capa de aplicación de SAP.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Fiabilidad"
+ "text": "Definición de los requisitos de separación de aplicaciones (espacio de nombres/grupo de nodos/clúster)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"severity": "Medio",
- "text": "Al usar Azure Availability Zones para lograr una alta disponibilidad, debe tener en cuenta la latencia entre los servidores de aplicaciones SAP y los servidores de bases de datos. En el caso de las zonas con latencias altas, es necesario implementar procedimientos operativos para garantizar que los servidores de aplicaciones SAP y los servidores de bases de datos se ejecuten en la misma zona en todo momento.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Fiabilidad"
+ "text": "Almacenamiento de los secretos en Azure Key Vault con el controlador del almacén de secretos de CSI",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"severity": "Alto",
- "text": "Configure las conexiones de ExpressRoute desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria. Además, como alternativa al uso de ExpressRoute, considere la posibilidad de configurar conexiones VPN desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Fiabilidad"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Replique el contenido del almacén de claves, como certificados, secretos o claves, en todas las regiones para poder descifrar los datos de la región de recuperación ante desastres.",
- "waf": "Fiabilidad"
+ "text": "Si usa entidades de servicio para el clúster, actualice las credenciales periódicamente (por ejemplo, trimestralmente)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"severity": "Medio",
- "text": "Empareje las redes virtuales principal y de recuperación ante desastres. Por ejemplo, para la replicación del sistema HANA, una red virtual de base de datos de SAP HANA debe estar emparejada con la red virtual de base de datos de SAP HANA del sitio de recuperación ante desastres.",
- "waf": "Fiabilidad"
+ "text": "Si es necesario, agregue el servicio de administración de claves, etcd, cifrado",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
"severity": "Bajo",
- "text": "Si usa el almacenamiento de Azure NetApp Files para las implementaciones de SAP, como mínimo, cree dos cuentas de Azure NetApp Files en el nivel Premium, en dos regiones.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Fiabilidad"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "Alto",
- "text": "Se debe usar la tecnología de replicación de base de datos nativa para sincronizar la base de datos en un par de alta disponibilidad.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Fiabilidad"
+ "text": "Si es necesario, considere la posibilidad de usar Proceso confidencial para AKS",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "Alto",
- "text": "El CIDR de la red virtual (VNet) principal no debe entrar en conflicto ni superponerse con el CIDR de la red virtual del sitio de recuperación ante desastres",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de usar Defender para contenedores",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"severity": "Alto",
- "text": "Use Site Recovery para replicar un servidor de aplicaciones en un sitio de recuperación ante desastres. Site Recovery también puede ayudar a replicar máquinas virtuales de clúster de servicios centrales en el sitio de recuperación ante desastres. Al invocar la recuperación ante desastres, deberá volver a configurar el clúster de Linux Pacemaker en el sitio de recuperación ante desastres (por ejemplo, reemplazar el VIP o el SBD, ejecutar corosync.conf, etc.).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Fiabilidad"
+ "text": "Uso de identidades administradas en lugar de entidades de servicio",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "Alto",
- "text": "Considere la disponibilidad del software de SAP frente a puntos únicos de fallo. Esto incluye puntos únicos de falla dentro de aplicaciones como DBMS utilizados en las arquitecturas SAP NetWeaver y SAP S/4HANA, SAP ABAP y ASCS + SCS. También, otras herramientas como SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Integración de la autenticación con AAD (mediante la integración administrada)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
- "severity": "Alto",
- "text": "En el caso de SAP y bases de datos de SAP, considere la posibilidad de implementar clústeres de conmutación por error automática. En Windows, los clústeres de conmutación por error de Windows Server admiten la conmutación por error. En Linux, Linux Pacemaker o herramientas de terceros, como SIOS Protection Suite y Veritas InfoScale, admiten la conmutación por error.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Limitar el acceso a admin kubeconfig (get-credentials --admin)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "Alto",
- "text": "Azure no admite arquitecturas en las que las máquinas virtuales principal y secundaria compartan almacenamiento para los datos de DBMS. Para la capa DBMS, el patrón de arquitectura común es replicar bases de datos al mismo tiempo y con pilas de almacenamiento diferentes a las que usan las máquinas virtuales principales y secundarias.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Integración de la autorización con RBAC de AAD",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"severity": "Alto",
- "text": "Los datos de DBMS y los archivos de registro de transacciones/puesta al día se almacenan en el almacenamiento en bloque compatible con Azure o en Azure NetApp Files. Azure Files o Azure Premium Files no se admiten como almacenamiento para datos de DBMS ni archivos de registro de puesta al día con la carga de trabajo de SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "Fiabilidad"
+ "text": "Uso de espacios de nombres para restringir el privilegio RBAC en Kubernetes",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
- "severity": "Alto",
- "text": "Puede usar discos compartidos de Azure en Windows para componentes ASCS + SCS y escenarios específicos de alta disponibilidad. Configure los clústeres de conmutación por error por separado para los componentes de la capa de aplicación de SAP y la capa de DBMS. Actualmente, Azure no admite arquitecturas de alta disponibilidad que combinen los componentes de la capa de aplicación de SAP y la capa de DBMS en un clúster de conmutación por error.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Para la administración de acceso a identidades de pods, use Azure AD Workload Identity (versión preliminar)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
- "severity": "Alto",
- "text": "La mayoría de los clústeres de conmutación por error para los componentes de la capa de aplicación (ASCS) de SAP y la capa de DBMS requieren una dirección IP virtual para un clúster de conmutación por error. Azure Load Balancer debe controlar la dirección IP virtual para todos los demás casos. Un principio de diseño es usar un equilibrador de carga por configuración de clúster. Te recomendamos que utilices la versión estándar del equilibrador de carga (SKU de Standard Load Balancer).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "En el caso de los inicios de sesión no interactivos de AKS, use kubelogin (versión preliminar)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
- "severity": "Alto",
- "text": "Asegúrese de que la IP flotante esté habilitada en el equilibrador de carga",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Deshabilitación de cuentas locales de AKS",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
- "severity": "Alto",
- "text": "Antes de implementar la infraestructura de alta disponibilidad, y en función de la región que elija, determine si desea implementar con un conjunto de disponibilidad de Azure o con una zona de disponibilidad.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Configure, si es necesario, el acceso al clúster Just-In-Time",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
- "severity": "Alto",
- "text": "Si desea cumplir los acuerdos de nivel de servicio de infraestructura para sus aplicaciones para componentes de SAP (servicios centrales, servidores de aplicaciones y bases de datos), debe elegir las mismas opciones de alta disponibilidad (máquinas virtuales, conjuntos de disponibilidad, zonas de disponibilidad) para todos los componentes.",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Configure si es necesario el acceso condicional de AAD para AKS",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "No mezcle servidores de diferentes roles en el mismo conjunto de disponibilidad. Mantenga las máquinas virtuales de servicios centrales, las máquinas virtuales de bases de datos y las máquinas virtuales de aplicaciones en sus propios conjuntos de disponibilidad",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario para las cargas de trabajo de Windows AKS, configure gMSA ",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"severity": "Medio",
- "text": "No se pueden implementar conjuntos de disponibilidad de Azure en una zona de disponibilidad de Azure a menos que se usen grupos de selección de ubicación por proximidad.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Fiabilidad"
+ "text": "Para un control más preciso, considere la posibilidad de utilizar una identidad de Kubelet administrada",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Al crear conjuntos de disponibilidad, use el número máximo de dominios de error y dominios de actualización disponibles. Por ejemplo, si implementa más de dos máquinas virtuales en un conjunto de disponibilidad, use el número máximo de dominios de error (tres) y suficientes dominios de actualización para limitar el efecto de posibles errores de hardware físico, interrupciones de red o interrupciones de energía, además del mantenimiento planeado de Azure. El número predeterminado de dominios de error es dos y no se puede cambiar en línea más adelante.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Si utiliza AGIC, no comparta un AppGW entre clústeres",
"waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"severity": "Alto",
- "text": "Cuando se usan grupos de selección de ubicación de proximidad de Azure en una implementación de conjunto de disponibilidad, los tres componentes de SAP (servicios centrales, servidor de aplicaciones y base de datos) deben estar en el mismo grupo de selección de ubicación por proximidad.",
+ "text": "No use el complemento de enrutamiento HTTP de AKS, use en su lugar la entrada NGINX administrada con el complemento de enrutamiento de aplicaciones.",
"waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "Alto",
- "text": "Utilice un grupo de ubicación de proximidad por SID de SAP. Los grupos no se extienden entre zonas de disponibilidad ni regiones de Azure",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "En el caso de las cargas de trabajo de Windows, use las redes aceleradas",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "Alto",
- "text": "Utilice uno de los siguientes servicios para ejecutar clústeres de servicios centrales de SAP, en función del sistema operativo.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Utilice el ALB estándar (en lugar del básico)",
"waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"severity": "Medio",
- "text": "Actualmente, Azure no admite la combinación de ASCS y DB HA en el mismo clúster de Linux Pacemaker; sepárelos en grupos individuales. Sin embargo, puede combinar hasta cinco clústeres de servicios centrales en un par de máquinas virtuales.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidad"
+ "text": "Si usa Azure CNI, considere la posibilidad de usar diferentes subredes para NodePools",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"severity": "Medio",
- "text": "Implemente ambas máquinas virtuales en el par de alta disponibilidad en un conjunto de disponibilidad o en zonas de disponibilidad. Estas máquinas virtuales deben tener el mismo tamaño y la misma configuración de almacenamiento.",
- "waf": "Fiabilidad"
+ "text": "Use puntos de conexión privados (preferidos) o puntos de conexión de servicio de red virtual para acceder a los servicios PaaS desde el clúster",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
- "severity": "Medio",
- "text": "Azure admite la instalación y configuración de SAP HANA, ASCS/SCS e instancias de ERS en el mismo clúster de alta disponibilidad que se ejecuta en Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Elija el mejor complemento de red de CNI para sus necesidades (se recomienda Azure CNI)",
"waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "Alto",
- "text": "Ejecute todos los sistemas de producción en SSD administradas Premium y use Azure NetApp Files o Ultra Disk Storage. Al menos el disco del sistema operativo debe estar en el nivel Premium para que pueda lograr un mejor rendimiento y el mejor Acuerdo de Nivel de Servicio.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Si usa CNI de Azure, ajuste el tamaño de la subred en consecuencia teniendo en cuenta el número máximo de pods por nodo",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Si usa Azure CNI, compruebe el número máximo de pods o nodo (valor predeterminado 30)",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "En el caso de las aplicaciones internas, las organizaciones suelen abrir toda la subred de AKS en sus firewalls. Esto también abre el acceso de red a los nodos y, potencialmente, también a los pods (si se usa Azure CNI). Si las direcciones IP de LoadBalancer están en una subred diferente, solo esta debe estar disponible para los clientes de la aplicación. Otra razón es que si las direcciones IP de la subred de AKS son un recurso escaso, el consumo de sus direcciones IP para los servicios reducirá la escalabilidad máxima del clúster.",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si usa servicios de LoadBalancer de dirección IP privada, use una subred dedicada (no la subred de AKS)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "Alto",
- "text": "Debe ejecutar SAP HANA en Azure solo en los tipos de almacenamiento certificados por SAP. Tenga en cuenta que ciertos volúmenes deben ejecutarse en ciertas configuraciones de disco, cuando corresponda. Estas configuraciones incluyen la habilitación del Acelerador de escritura y el uso del almacenamiento Premium. También debe asegurarse de que el sistema de archivos que se ejecuta en el almacenamiento sea compatible con el DBMS que se ejecuta en la máquina.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "text": "Dimensione el rango de direcciones IP del servicio en consecuencia (limitará la escalabilidad del clúster)",
"waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
- "severity": "Alto",
- "text": "Considere la posibilidad de configurar la alta disponibilidad en función del tipo de almacenamiento que utilice para las cargas de trabajo de SAP. Algunos servicios de almacenamiento disponibles en Azure no son compatibles con Azure Site Recovery, por lo que la configuración de alta disponibilidad puede diferir.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario, agregue su propio complemento CNI",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "Alto",
- "text": "Es posible que los diferentes servicios de almacenamiento nativo de Azure (como Azure Files, Azure NetApp Files, Azure Shared Disk) no estén disponibles en todas las regiones. Por lo tanto, para tener una configuración de SAP similar en la región de recuperación ante desastres después de la conmutación por error, asegúrese de que el servicio de almacenamiento correspondiente se ofrezca en el sitio de recuperación ante desastres.",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario, configure la dirección IP pública por nodo en AKS",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"severity": "Medio",
- "text": "Automatice SAP System Start-Stop para gestionar los costes.",
- "waf": "Costar"
+ "text": "Use un controlador de entrada para exponer aplicaciones basadas en web en lugar de exponerlas con servicios de tipo LoadBalancer",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
"severity": "Bajo",
- "text": "En el caso de usar Azure Premium Storage con SAP HANA, el almacenamiento SSD estándar de Azure se puede usar para seleccionar una solución de almacenamiento económica en cuanto a costos. Sin embargo, tenga en cuenta que la elección del almacenamiento SSD estándar o HDD estándar de Azure afectará al Acuerdo de Nivel de Servicio de las máquinas virtuales individuales. Además, para sistemas con menor rendimiento de E/S y baja latencia, como entornos que no son de producción, se pueden usar máquinas virtuales de series inferiores.",
- "waf": "Costar"
+ "text": "Uso de Azure NAT Gateway como outboundType para escalar el tráfico de salida",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Como configuración alternativa de menor costo (multipropósito), puede elegir una SKU de bajo rendimiento para las máquinas virtuales de servidor de base de datos HANA que no son de producción. Sin embargo, es importante tener en cuenta que algunos tipos de máquinas virtuales, como la serie E, no están certificadas por HANA (directorio de hardware de SAP HANA) o no pueden alcanzar una latencia de almacenamiento inferior a 1 ms.",
- "waf": "Costar"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Uso de asignaciones dinámicas de direcciones IP para evitar el agotamiento de direcciones IP de Azure CNI",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"severity": "Alto",
- "text": "Aplicación de un modelo RBAC para grupos de administración, suscripciones, grupos de recursos y recursos",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Filtre el tráfico de salida con AzFW/NVA si sus requisitos de seguridad lo exigen",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"severity": "Medio",
- "text": "Aplicación de la propagación de la entidad de seguridad para reenviar la identidad de la aplicación en la nube de SAP a SAP local (incluida la IaaS) a través del conector en la nube",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "Si utiliza un punto de conexión de API público, restrinja las direcciones IP que pueden acceder a él",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "Medio",
- "text": "Implemente SSO en aplicaciones SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics y SAP C4C con Azure AD mediante SAML.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Utilice clústeres privados si sus requisitos lo exigen",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "Medio",
- "text": "Implemente SSO en aplicaciones web basadas en SAP NetWeaver, como SAP Fiori y SAP Web GUI, mediante SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "Para los nodos de AKS de Windows 2019 y 2022, se pueden usar directivas de red de Calico ",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
- "severity": "Medio",
- "text": "Implemente SSO en aplicaciones web basadas en SAP NetWeaver, como SAP Fiori y SAP Web GUI, mediante SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Habilitación de una opción de directiva de red de Kubernetes (Calico/Azure)",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": "Medio",
- "text": "Puede implementar el inicio de sesión único en la interfaz gráfica de usuario de SAP mediante el inicio de sesión único de SAP NetWeaver o una solución de socio.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Uso de directivas de red de Kubernetes para aumentar la seguridad dentro del clúster",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
- "severity": "Medio",
- "text": "Para SSO para SAP GUI y acceso al navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociación GSSAPI simple y protegido) debido a su facilidad de configuración y mantenimiento. Para SSO con certificados de cliente X.509, considere la posibilidad de utilizar SAP Secure Login Server, que es un componente de la solución SAP SSO.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Uso de un WAF para cargas de trabajo web (interfaces de usuario o API)",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"severity": "Medio",
- "text": "Para SSO para SAP GUI y acceso al navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociación GSSAPI simple y protegido) debido a su facilidad de configuración y mantenimiento. Para SSO con certificados de cliente X.509, considere la posibilidad de utilizar SAP Secure Login Server, que es un componente de la solución SAP SSO.",
+ "text": "Uso de DDoS Standard en la red virtual de AKS",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario, agregue el proxy HTTP de la empresa",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"severity": "Medio",
- "text": "Implemente el inicio de sesión único mediante OAuth para SAP NetWeaver a fin de permitir que aplicaciones personalizadas o de terceros accedan a los servicios OData de SAP NetWeaver.",
+ "text": "Considere la posibilidad de usar una malla de servicios para la administración avanzada de comunicaciones de microservicios",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
- "severity": "Medio",
- "text": "Implementación de SSO en SAP HANA",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Configurar alertas sobre las métricas más críticas (consulte Container Insights para obtener recomendaciones)",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Consulte periódicamente Azure Advisor para obtener recomendaciones sobre el clúster",
+ "waf": "Operaciones"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Habilitación de la rotación automática de certificados de AKS",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
- "severity": "Medio",
- "text": "Considere Azure AD como un proveedor de identidades para sistemas SAP hospedados en RISE. Para obtener más información, consulte Integración del servicio con Azure AD.",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Tenga un proceso regular para actualizar la versión de Kubernetes periódicamente (trimestralmente, por ejemplo) o use la característica de actualización automática de AKS",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
- "severity": "Medio",
- "text": "En el caso de las aplicaciones que acceden a SAP, es posible que desee utilizar la propagación de entidades de seguridad para establecer el inicio de sesión único.",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Utilice kured para las actualizaciones de nodos de Linux en caso de que no esté utilizando la actualización de imagen de nodo",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
- "severity": "Medio",
- "text": "Si usa servicios BTP de SAP o soluciones SaaS que requieren SAP Identity Authentication Service (IAS), considere la posibilidad de implementar SSO entre SAP Cloud Identity Authentication Services y Azure AD para acceder a esos servicios de SAP. Esta integración permite a SAP IAS actuar como proveedor de identidades de proxy y reenvía las solicitudes de autenticación a Azure AD como almacén de usuarios central y proveedor de identidades.",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Disponer de un proceso regular para actualizar las imágenes de los nodos del clúster periódicamente (semanalmente, por ejemplo)",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
- "severity": "Medio",
- "text": "Implementación de SSO en SAP BTP",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de implementar aplicaciones o configuraciones de clústeres en varios clústeres",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
- "severity": "Medio",
- "text": "Si usa SAP SuccessFactors, considere la posibilidad de usar el aprovisionamiento automatizado de usuarios de Azure AD. Con esta integración, a medida que agregue nuevos empleados a SAP SuccessFactors, puede crear automáticamente sus cuentas de usuario en Azure AD. Opcionalmente, puede crear cuentas de usuario en Microsoft 365 u otras aplicaciones SaaS compatibles con Azure AD. Utilice la reescritura de la dirección de correo electrónico en SAP SuccessFactors.",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de usar la invocación de comandos de AKS en clústeres privados",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "description": "Mantenga la jerarquía del grupo de administración razonablemente plana, no más de cuatro.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
- "severity": "Medio",
- "text": "aplicar las directivas de grupo de administración existentes a las suscripciones de SAP",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "En el caso de los eventos planeados, considere la posibilidad de utilizar el drenaje automático de nodos",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"severity": "Alto",
- "text": "Integre aplicaciones estrechamente acopladas en la misma suscripción de SAP para evitar la complejidad adicional del enrutamiento y la administración",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "text": "Desarrollar sus propias prácticas de gobernanza para asegurarse de que los operadores no realicen cambios en el nodo RG (también conocido como 'infra RG')",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "Alto",
- "text": "Aprovechar la suscripción como unidad de escala y escalar nuestros recursos, considere implementar la suscripción por entorno, por ejemplo. Sandbox, no prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Usar el nombre personalizado de Node RG (también conocido como 'Infra RG')",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Garantizar el aumento de la cuota como parte del aprovisionamiento de suscripciones (por ejemplo, el total de núcleos de máquina virtual disponibles dentro de una suscripción)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "No use API de Kubernetes obsoletas en los manifiestos de YAML",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
"severity": "Bajo",
- "text": "La API de cuota es una API de REST que puede usar para ver y administrar las cuotas de los servicios de Azure. Considere usarlo si es necesario.",
+ "text": "Nodos de Windows de Taint",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
- "severity": "Alto",
- "text": "Si se implementa en una zona de disponibilidad, asegúrese de que la implementación de zona de la máquina virtual esté disponible una vez que se haya aprobado la cuota. Envíe una solicitud de soporte técnico con la suscripción, la serie de máquinas virtuales, el número de CPU y la zona de disponibilidad necesarias.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Mantener el nivel de revisión de los contenedores de Windows sincronizado con el nivel de revisión del host",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "Alto",
- "text": "Asegúrese de que los servicios y funciones necesarios estén disponibles dentro de las regiones de implementación elegidas, por ejemplo. ANF, Zona, etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "A través de la configuración de diagnóstico en el nivel de clúster",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Envío de registros maestros (también conocidos como registros de API) a Azure Monitor o a la solución de administración de registros que prefiera",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
- "severity": "Medio",
- "text": "Aproveche la etiqueta de recurso de Azure para la categorización de costos y la agrupación de recursos (: BillTo, Departamento (o unidad de negocio), Medio ambiente (producción, Fase, Desarrollo), Nivel (nivel web, nivel de aplicación), Propietario de la aplicación, Nombre del proyecto)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario, utilice instantáneas de nodePool",
+ "waf": "Costar"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de crear grupos de nodos de acceso puntual para cargas de trabajo no urgentes",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "Alto",
- "text": "Ayude a proteger la base de datos de HANA mediante el servicio Azure Backup.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de utilizar el nodo virtual de AKS para una ráfaga rápida",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
- "severity": "Medio",
- "text": "Si implementa Azure NetApp Files para la base de datos HANA, Oracle o DB2, use la herramienta Azure Application Consistent Snapshot (AzAcSnap) para tomar instantáneas coherentes con la aplicación. AzAcSnap también es compatible con bases de datos de Oracle. Considere la posibilidad de usar AzAcSnap en una máquina virtual central en lugar de en máquinas virtuales individuales.",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Supervise las métricas de clúster con Container Insights (u otras herramientas como Prometheus)",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "Alto",
- "text": "Asegúrese de que las zonas horarias coincidan entre el sistema operativo y el sistema SAP.",
+ "text": "Almacene y analice los registros del clúster con Container Insights (u otras herramientas como Telegraf/ElasticSearch)",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"severity": "Medio",
- "text": "No agrupe diferentes servicios de aplicaciones en el mismo clúster. Por ejemplo, no combine DRBD y clústeres de servicios centrales en el mismo clúster. Sin embargo, puede usar el mismo clúster de Pacemaker para administrar aproximadamente cinco servicios centrales diferentes (clúster de varios SID).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidad"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Considere la posibilidad de ejecutar sistemas de desarrollo y pruebas en un modelo de repetición para ahorrar y optimizar los costos de ejecución de Azure.",
- "waf": "Costar"
+ "text": "Supervisar el uso de la CPU y la memoria de los nodos",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "Medio",
- "text": "Si se asocia con los clientes mediante la administración de sus propiedades de SAP, considere la posibilidad de Azure Lighthouse. Azure Lighthouse permite a los proveedores de servicios administrados usar los servicios de identidad nativos de Azure para autenticarse en el entorno de los clientes. Pone el control en manos de los clientes, ya que pueden revocar el acceso en cualquier momento y auditar las acciones de los proveedores de servicios.",
+ "text": "Si usa Azure CNI, supervise el porcentaje de direcciones IP de pod consumidas por nodo",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "La E/S en el disco del sistema operativo es un recurso crítico. Si el sistema operativo de los nodos se limita en la E/S, esto podría dar lugar a un comportamiento impredecible, que normalmente terminaría en que el nodo se declarara NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
"severity": "Medio",
- "text": "Use Azure Update Manager para comprobar el estado de las actualizaciones disponibles para una sola máquina virtual o varias máquinas virtuales y considere la posibilidad de programar la aplicación periódica de revisiones.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "text": "Supervisión de la profundidad de la cola de disco del sistema operativo en los nodos",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Optimice y gestione las operaciones de SAP Basis mediante SAP Landscape Management (LaMa). Use el conector de SAP LaMa para Azure para reubicar, copiar, clonar y actualizar sistemas SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
+ "severity": "Medio",
+ "text": "Si no usa el filtrado de salida con AzFW/NVA, supervise los puertos SNAT asignados por ALB estándar",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
"severity": "Medio",
- "text": "Use las soluciones de Azure Monitor para SAP para supervisar las cargas de trabajo de SAP (SAP HANA, clústeres de SUSE de alta disponibilidad y sistemas SQL) en Azure. Considere la posibilidad de complementar las soluciones de Azure Monitor para SAP con SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Suscríbase a las notificaciones de estado de los recursos para el clúster de AKS",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "Alto",
- "text": "Ejecute una extensión de máquina virtual para la comprobación de SAP. VM Extension for SAP usa la identidad administrada asignada de una máquina virtual (VM) para acceder a los datos de configuración y supervisión de VM. La comprobación garantiza que todas las métricas de rendimiento de la aplicación SAP procedan de la extensión de Azure para SAP subyacente.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "text": "Configurar solicitudes y límites en las especificaciones del pod",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "Medio",
- "text": "Use Azure Policy para el control de acceso y los informes de cumplimiento. Azure Policy proporciona la capacidad de aplicar la configuración de toda la organización para garantizar el cumplimiento coherente de las directivas y la detección rápida de infracciones. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "text": "Aplicación de cuotas de recursos para espacios de nombres",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
- "severity": "Medio",
- "text": "Use el Monitor de conexión en Azure Network Watcher para supervisar las métricas de latencia de las bases de datos y los servidores de aplicaciones de SAP. O bien, recopile y muestre medidas de latencia de red mediante Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Asegúrese de que la suscripción tiene suficiente cuota para escalar horizontalmente los grupos de nodos",
"waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medio",
- "text": "Realice una comprobación de calidad de SAP HANA en la infraestructura de Azure aprovisionada para comprobar que las máquinas virtuales aprovisionadas cumplen con los procedimientos recomendados de SAP HANA en Azure.",
- "waf": "Operaciones"
+ "text": "Uso del escalador automático de clústeres",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "Alto",
- "text": "Para cada suscripción de Azure, ejecute una prueba de latencia en las zonas de disponibilidad de Azure antes de la implementación zonal para elegir zonas de baja latencia para la implementación de SAP en Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Personalización de la configuración de nodos para grupos de nodos de AKS",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "Medio",
- "text": "Ejecute el informe de resistencia para asegurarse de que la configuración de toda la infraestructura de Azure aprovisionada (proceso, base de datos, redes, almacenamiento, Site Recovery) cumpla con la configuración definida por Cloud Adaption Framework para Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Fiabilidad"
+ "text": "Usar el escalador automático horizontal de pods cuando sea necesario",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
- "severity": "Medio",
- "text": "Implemente la protección contra amenazas mediante la solución Microsoft Sentinel para SAP. Utilice esta solución para supervisar sus sistemas SAP y detectar amenazas sofisticadas en toda la lógica empresarial y las capas de aplicación.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
- "waf": "Seguridad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "Los nodos más grandes aportarán un mayor rendimiento y características como discos efímeros y redes aceleradas, pero aumentarán el radio de explosión y disminuirán la granularidad de escalado",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Considere un tamaño de nodo adecuado, ni demasiado grande ni demasiado pequeño",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
- "severity": "Medio",
- "text": "El etiquetado de Azure se puede aprovechar para agrupar y realizar un seguimiento lógicos de los recursos, automatizar sus implementaciones y, lo que es más importante, proporcionar visibilidad de los costos incurridos.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
- "waf": "Operaciones"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si se requieren más de 5000 nodos para la escalabilidad, considere la posibilidad de usar un clúster de AKS adicional",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
"severity": "Bajo",
- "text": "Utilice la supervisión de latencia entre máquinas virtuales para aplicaciones sensibles a la latencia.",
+ "text": "Considere la posibilidad de suscribirse a eventos de EventGrid para la automatización de AKS",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "Medio",
- "text": "Use la supervisión de Azure Site Recovery para mantener el estado del servicio de recuperación ante desastres para los servidores de aplicaciones de SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Fiabilidad"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Para una operación de ejecución prolongada en un clúster de AKS, considere la finalización de eventos",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
- "severity": "Medio",
- "text": "Excluya todos los sistemas de archivos de bases de datos y programas ejecutables de los análisis antivirus. Incluirlos podría provocar problemas de rendimiento. Consulte con los proveedores de bases de datos para obtener detalles prescriptivos sobre la lista de exclusión. Por ejemplo, Oracle recomienda excluir /oracle//sapdata de los análisis antivirus.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "Bajo",
+ "text": "Si es necesario, considere la posibilidad de usar Azure Dedicated Hosts para nodos de AKS",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "Usar discos de sistema operativo efímeros",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
+ "severity": "Alto",
+ "text": "En el caso de los discos no efímeros, use IOPS altas y discos de sistema operativo más grandes para los nodos cuando ejecute muchos pods o nodos, ya que requiere un alto rendimiento para ejecutar varios pods y generará registros enormes con umbrales de rotación de registros de AKS predeterminados",
+ "waf": "Rendimiento"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
"severity": "Bajo",
- "text": "Considere la posibilidad de recopilar estadísticas completas de bases de datos que no sean de HANA después de la migración. Por ejemplo, implemente la nota de SAP 1020260 - Entrega de estadísticas de Oracle.",
+ "text": "Para la opción de almacenamiento de hiperrendimiento, use discos Ultra en AKS",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"severity": "Medio",
- "text": "Considere la posibilidad de usar Oracle Automatic Storage Management (ASM) para todas las implementaciones de Oracle que utilicen SAP en Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "text": "Evite mantener el estado en el clúster y almacene los datos fuera (AzStorage, AzSQL, Cosmos, etc.)",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
"severity": "Medio",
- "text": "En el caso de SAP en Azure que ejecuta Oracle, una colección de scripts SQL puede ayudarle a diagnosticar problemas de rendimiento. Los informes de Automatic Workload Repository (AWR) contienen información valiosa para diagnosticar problemas en el sistema Oracle. Le recomendamos que ejecute un informe de AWR durante varias sesiones y elija las horas punta para él, a fin de garantizar una amplia cobertura del análisis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "text": "Si usa AzFiles Standard, considere AzFiles Premium o ANF por motivos de rendimiento",
"waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "severity": "Alto",
- "text": "Use la supervisión de Azure Site Recovery para mantener el estado del servicio de recuperación ante desastres para los servidores de aplicaciones de SAP.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "Operaciones"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"severity": "Medio",
- "text": "Para la entrega segura de aplicaciones HTTP/S, use Application Gateway v2 y asegúrese de que la protección y las directivas de WAF estén habilitadas.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
- "waf": "Seguridad"
+ "text": "Si usa Azure Disks y AZ, considere la posibilidad de tener grupos de nodos dentro de una zona para el disco LRS con VolumeBindingMode:WaitForFirstConsumer para aprovisionar el almacenamiento en la zona correcta o use el disco ZRS para los grupos de nodos que abarquen varias zonas",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aplicación de las instrucciones del banco de pruebas de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Si el DNS o el nombre virtual de la máquina virtual no se cambia durante la migración a Azure, el DNS en segundo plano y los nombres virtuales conectan muchas interfaces del sistema en el entorno de SAP, y los clientes solo a veces son conscientes de las interfaces que los desarrolladores definen a lo largo del tiempo. Surgen desafíos de conexión entre varios sistemas cuando los nombres virtuales o de DNS cambian después de las migraciones, y se recomienda conservar los alias de DNS para evitar este tipo de dificultades.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operaciones"
+ "text": "Tenga en cuenta la \"Línea base de seguridad de Azure para el almacenamiento\"",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "Medio",
- "text": "Utilice diferentes zonas DNS para distinguir cada entorno (espacio aislado, desarrollo, preproducción y producción) entre sí. La excepción es para las implementaciones de SAP con su propia red virtual; aquí, es posible que las zonas DNS privadas no sean necesarias.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de Azure Compute que necesitan acceso, lo que elimina la exposición a la Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "description": "Al configurar el emparejamiento de red virtual, use la opción Permitir tráfico a redes virtuales remotas.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, etcétera de auditoría, estén habilitados. Asegúrese de que no haya cuentas de almacenamiento antiguas con el modelo de implementación clásico en una suscripción",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "El emparejamiento de red virtual local y global proporciona conectividad y son los enfoques preferidos para garantizar la conectividad entre las zonas de aterrizaje para las implementaciones de SAP en varias regiones de Azure",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "Fiabilidad"
+ "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usen el \"modelo de implementación clásica\"",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveche Microsoft Defender para obtener información sobre actividades sospechosas y configuraciones incorrectas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "No se admite la implementación de ninguna NVA entre la aplicación SAP y el servidor de base de datos SAP",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "Rendimiento"
+ "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Use Virtual WAN para implementaciones de Azure en redes nuevas, grandes o globales en las que necesite conectividad de tránsito global entre regiones de Azure y ubicaciones locales. Con este enfoque, no tendrá que configurar manualmente el enrutamiento transitivo para las redes de Azure y puede seguir un estándar para las implementaciones de SAP en Azure.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "Operaciones"
+ "text": "Habilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Considere la posibilidad de implementar aplicaciones virtuales de red (NVA) entre regiones solo si se usan NVA de asociados. Las aplicaciones virtuales de red entre regiones o redes virtuales no son necesarias si hay aplicaciones virtuales de red nativas. Al implementar tecnologías de redes de asociados y NVA, siga las instrucciones del proveedor para comprobar las configuraciones conflictivas con las redes de Azure.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operaciones"
+ "text": "Deshabilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
- "severity": "Medio",
- "text": "Virtual WAN administra la conectividad entre redes virtuales de radio para topologías basadas en WAN virtuales (sin necesidad de configurar el enrutamiento definido por el usuario [UDR] o NVA) y el rendimiento máximo de red para el tráfico de red virtual a red virtual en el mismo centro virtual es de 50 gigabits por segundo. Si es necesario, las zonas de aterrizaje de SAP pueden usar el emparejamiento de red virtual para conectarse a otras zonas de aterrizaje y superar esta limitación de ancho de banda.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitación de la \"eliminación temporal\" para contenedores",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "Alto",
- "text": "No se recomienda la asignación de direcciones IP públicas a la máquina virtual que ejecuta SAP Workload.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Deshabilitar la \"eliminación temporal\" para contenedores",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Considere la posibilidad de reservar la dirección IP en el lado de la recuperación ante desastres al configurar ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operaciones"
+ "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Evite el uso de intervalos de direcciones IP superpuestos para los sitios de producción y recuperación ante desastres.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Operaciones"
+ "text": "Considere la posibilidad de blobs inmutables",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
- "severity": "Medio",
- "text": "Aunque Azure le ayuda a crear varias subredes delegadas en una red virtual, solo puede existir una subred delegada en una red virtual para Azure NetApp Files. Se producirá un error al intentar crear un nuevo volumen si se utiliza más de una subred delegada para Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 no protegido a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas contra la integridad y el servidor esté autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "severity": "Medio",
- "text": "Use Azure Firewall para controlar el tráfico de salida de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado de tráfico este/oeste (si la organización lo requiere)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blob ayuda a minimizar el riesgo de pérdida de credenciales.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Application Gateway y Web Application Firewall tienen limitaciones cuando Application Gateway actúa como proxy inverso para aplicaciones web de SAP, como se muestra en la comparación entre Application Gateway, SAP Web Dispatcher y otros servicios de terceros.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
- "severity": "Medio",
- "text": "Use las directivas de Azure Front Door y WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". Al aplicar la versión más reciente de TLS, se rechazarán las solicitudes de los clientes que utilicen la versión anterior. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aplicación de la versión más reciente de TLS para una cuenta de almacenamiento",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
- "severity": "Medio",
- "text": "Aproveche las directivas de firewall de aplicaciones web de Azure Front Door cuando use Azure Front Door y Application Gateway para proteger las aplicaciones HTTP/S. Bloquee Application Gateway para recibir tráfico solo desde Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Los tokens de identificador de Microsoft Entra deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Uso de tokens de identificador de Microsoft Entra para el acceso a blobs",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Utilice un firewall de aplicaciones web para analizar su tráfico cuando esté expuesto a Internet. Otra opción es usarlo con el equilibrador de carga o con recursos que tengan funcionalidades de firewall integradas, como Application Gateway o soluciones de terceros.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "text": "Privilegio mínimo en los permisos de IaM",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
- "severity": "Medio",
- "text": "Use Virtual WAN para implementaciones de Azure en redes nuevas, grandes o globales en las que necesite conectividad de tránsito global entre regiones de Azure y ubicaciones locales. Con este enfoque, no tendrá que configurar manualmente el enrutamiento transitivo para las redes de Azure y puede seguir un estándar para las implementaciones de SAP en Azure.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad con respecto a la SAS de servicio. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en clave de cuenta de almacenamiento.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
- "severity": "Medio",
- "text": "Para evitar la pérdida de datos, use Azure Private Link para acceder de forma segura a los recursos de la plataforma como servicio, como Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, etc. Azure Private Endpoint también puede ayudar a proteger el tráfico entre redes virtuales y servicios como Azure Storage, Azure Backup, etc. El tráfico entre la red virtual y el servicio habilitado para el punto de conexión privado viaja a través de la red global de Microsoft, lo que impide su exposición a la red pública de Internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las claves de la cuenta de almacenamiento ('claves compartidas') tienen muy pocas capacidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de ID de Entra facilita la vinculación del acceso al almacenamiento de un usuario. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a Microsoft Entra ID (y SAS de delegación de usuarios).",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Utilice los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etcétera).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Asegúrese de que las redes aceleradas de Azure estén habilitadas en las máquinas virtuales usadas en las capas de aplicación SAP y DBMS.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Rendimiento"
+ "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una política de caducidad de claves le permite establecer un recordatorio para la rotación de las claves de acceso de la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Asegúrese de que las implementaciones internas de Azure Load Balancer están configuradas para usar Direct Server Return (DSR). Esta configuración (Habilitación de IP flotante) reducirá la latencia cuando se utilicen configuraciones de equilibrador de carga internas para configuraciones de alta disponibilidad en la capa DBMS.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de caducidad de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Puede usar el grupo de seguridad de aplicaciones (ASG) y las reglas de NSG para definir listas de control de acceso de seguridad de red entre la aplicación SAP y las capas de DBMS. Los ASG agrupan las máquinas virtuales para ayudar a administrar su seguridad.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "Alto",
- "text": "No se admite la colocación de la capa de aplicación de SAP y DBMS de SAP en diferentes redes virtuales de Azure que no están emparejadas.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Para obtener una latencia de red óptima con aplicaciones SAP, considere la posibilidad de usar grupos de selección de ubicación por proximidad de Azure.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "Rendimiento"
+ "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si eso no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "NO se admite en absoluto la ejecución de una capa de servidor de aplicaciones SAP y una capa de DBMS dividida entre local y Azure. Ambas capas deben residir completamente en el entorno local o en Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Rendimiento"
+ "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Utilice los tiempos de caducidad a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, solo es válida durante un corto período de tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una política de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlos en él.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "No se recomienda hospedar el sistema de administración de bases de datos (DBMS) y las capas de aplicación de los sistemas SAP en diferentes redes virtuales y conectarlas con el emparejamiento de redes virtuales debido a los costos sustanciales que puede producir un tráfico de red excesivo entre las capas. Se recomienda usar subredes dentro de la red virtual de Azure para separar la capa de aplicación de SAP y la capa de DBMS.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Costar"
+ "text": "Esfuércese por períodos de validez cortos para SAS ad-hoc",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
- "severity": "Alto",
- "text": "Si utiliza Load Balancer con sistemas operativos invitados Linux, compruebe que el parámetro de red de Linux net.ipv4.tcp_timestamps esté establecido en 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Aplicación de un ámbito limitado a una SAS",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS puede incluir parámetros sobre las direcciones IP de cliente o los intervalos de direcciones que están autorizados a solicitar un recurso mediante la SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "En el caso de las implementaciones de SAP RISE/ECS, el emparejamiento virtual es la forma preferida de establecer la conectividad con el entorno de Azure existente del cliente. Tanto la red virtual de SAP como las redes virtuales del cliente están protegidas con grupos de seguridad de red (NSG), lo que permite la comunicación en SAP y los puertos de base de datos a través del emparejamiento de redes virtuales",
+ "text": "Considere la posibilidad de definir el ámbito de SAS a una dirección IP de cliente específica, siempre que sea posible",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenidos malintencionados de gran tamaño.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan utilizado una SAS para cargar un archivo. ",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al acceder al almacenamiento de blobs a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente es compatible con el punto de conexión SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Revise las copias de seguridad de bases de datos de SAP HANA para máquinas virtuales de Azure.",
- "waf": "Costar"
+ "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Revise la supervisión integrada de Site Recovery, donde se use para SAP.",
- "waf": "Costar"
+ "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente aflojar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Evite las políticas de CORS demasiado amplias",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Los datos en reposo siempre se cifran en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede producirse mediante una clave administrada por la plataforma (valor predeterminado) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob al almacenamiento de Azure o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Revise la guía Supervisión del panorama del sistema SAP HANA.",
- "waf": "Operaciones"
+ "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Revise las estrategias de copia de seguridad de Oracle Database en máquinas virtuales Linux de Azure.",
- "waf": "Operaciones"
+ "text": "Determine cuál o si se debe utilizar el cifrado de la plataforma.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Revise el uso de Azure Blob Storage con SQL Server 2016.",
- "waf": "Operaciones"
+ "text": "Determine qué cifrado del lado del cliente se debe usar, si se debe usar.",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
- "severity": "Medio",
- "text": "Revise el uso de Copia de seguridad automatizada v2 para máquinas virtuales de Azure.",
- "waf": "Operaciones"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere si es necesario el acceso anónimo de blob público o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
+ "waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Habilitación del acelerador de escritura para la serie M cuando se utilizan discos premium (V1)",
- "waf": "Operaciones"
+ "text": "Aproveche un tipo de cuenta storagev2 para mejorar el rendimiento y la confiabilidad",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
- "severity": "Medio",
- "text": "Pruebe la latencia de la zona de disponibilidad.",
- "waf": "Rendimiento"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveche el almacenamiento GRS, ZRS o GZRS para obtener la máxima disponibilidad",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Active SAP EarlyWatch Alert para todos los componentes de SAP.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Rendimiento"
+ "text": "Para la operación de escritura después de la conmutación por error, use la conmutación por error administrada por el cliente ",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Revise la latencia del servidor de aplicaciones SAP al servidor de bases de datos mediante el informe ABAPMeter de SAP /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "Rendimiento"
+ "text": "Descripción de los detalles de la conmutación por error administrada por Microsoft",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"severity": "Medio",
- "text": "Revise la supervisión del rendimiento de SQL Server mediante CCMS.",
- "waf": "Rendimiento"
+ "text": "Habilitar eliminación temporal",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
- "severity": "Medio",
- "text": "Pruebe la latencia de red entre las máquinas virtuales de la capa de aplicación de SAP y las máquinas virtuales de DBMS (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "Rendimiento"
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
+ "severity": "Alto",
+ "text": "Habilite la redundancia de zona para Azure Cache for Redis. Azure Cache for Redis admite configuraciones con redundancia de zona en los niveles Premium y Enterprise. Una caché con redundancia de zona puede colocar sus nodos en diferentes zonas de disponibilidad de Azure en la misma región. Elimina la interrupción del centro de datos o de la zona de disponibilidad como único punto de error y aumenta la disponibilidad general de la memoria caché.",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"severity": "Medio",
- "text": "Revise las alertas de SAP HANA Studio.",
- "waf": "Rendimiento"
+ "text": "Configure la persistencia de datos para una instancia de Azure Cache for Redis. Dado que los datos de caché se almacenan en la memoria, un error poco frecuente y no planeado de varios nodos puede hacer que se eliminen todos los datos. Para evitar la pérdida completa de datos, la persistencia de Redis permite tomar instantáneas periódicas de los datos en memoria y almacenarlas en la cuenta de almacenamiento.",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"severity": "Medio",
- "text": "Realice comprobaciones de estado de SAP HANA mediante HANA_Configuration_Minichecks.",
- "waf": "Rendimiento"
+ "text": "Use una cuenta de almacenamiento con redundancia geográfica para conservar los datos de Azure Cache for Redis o con redundancia zonal donde la redundancia geográfica no esté disponible",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "Medio",
- "text": "Si ejecuta máquinas virtuales Windows y Linux en Azure, en el entorno local o en otros entornos en la nube, puede usar el Centro de administración de actualizaciones de Azure Automation para administrar las actualizaciones del sistema operativo, incluidas las revisiones de seguridad.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "waf": "Seguridad"
+ "text": "Configure la replicación geográfica pasiva para instancias de Azure Cache for Redis Premium. La replicación geográfica es un mecanismo para vincular dos o más instancias de Azure Cache for Redis, que normalmente abarcan dos regiones de Azure. La replicación geográfica está diseñada principalmente para la recuperación ante desastres entre regiones. Dos instancias de caché de nivel Premium se conectan a través de la replicación geográfica de una manera que proporciona lecturas y escrituras en la caché principal, y esos datos se replican en la caché secundaria.",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "Medio",
- "text": "Revise de forma rutinaria las notas del OSS de seguridad de SAP, ya que SAP publica parches de seguridad muy críticos, o correcciones en caliente, que requieren una acción inmediata para proteger sus sistemas SAP.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "severity": "Alto",
+ "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "Bajo",
- "text": "En el caso de SAP en SQL Server, puede deshabilitar la cuenta de administrador del sistema de SQL Server porque los sistemas SAP en SQL Server no usan la cuenta. Asegúrese de que otro usuario con derechos de administrador del sistema pueda acceder al servidor antes de deshabilitar la cuenta de administrador del sistema original.",
- "waf": "Seguridad"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
+ "severity": "Alto",
+ "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
"severity": "Alto",
- "text": "Deshabilite xp_cmdshell. La característica SQL Server xp_cmdshell habilita un shell de comandos del sistema operativo interno de SQL Server. Es un riesgo potencial en las auditorías de seguridad.",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "Seguridad"
+ "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
"severity": "Alto",
- "text": "El cifrado de servidores de base de datos de SAP HANA en Azure usa la tecnología de cifrado nativa de SAP HANA. Además, si usa SQL Server en Azure, use el cifrado de datos transparente (TDE) para proteger los datos y los archivos de registro y asegurarse de que las copias de seguridad también estén cifradas.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "waf": "Seguridad"
+ "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
"severity": "Medio",
- "text": "El cifrado de Azure Storage está habilitado para todas las cuentas de Azure Resource Manager y de almacenamiento clásico, y no se puede deshabilitar. Dado que los datos están cifrados de forma predeterminada, no es necesario modificar el código ni las aplicaciones para usar el cifrado de Azure Storage.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
- "waf": "Seguridad"
+ "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica",
+ "waf": "Operaciones"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Uso de Azure Key Vault para almacenar los secretos y las credenciales",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus Premium proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "Bajo",
+ "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "La comunicación entre una aplicación cliente y un espacio de nombres de Azure Service Bus se cifra mediante la seguridad de la capa de transporte (TLS). Los espacios de nombres de Azure Service Bus permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Service Bus para que requiera que los clientes envíen y reciban datos con una versión más reciente de TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"severity": "Medio",
- "text": "Se recomienda bloquear los recursos de Azure después de la implementación correcta para protegerse contra cambios no autorizados. También puede aplicar restricciones y reglas de LOCK por suscripción mediante directivas de Azure personalizadas (rol Custome).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "text": "Aplicar una versión mínima requerida de la seguridad de la capa de transporte (TLS) para las solicitudes ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Al crear un espacio de nombres de Service Bus, se crea automáticamente una regla de SAS denominada RootManageSharedAccessKey para el espacio de nombres. Esta política tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"severity": "Medio",
- "text": "Aprovisione Azure Key Vault con las directivas de eliminación temporal y purga habilitadas para permitir la protección de retención para los objetos eliminados.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Evite usar la cuenta root cuando no sea necesario",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
- "severity": "Alto",
- "text": "En función de los requisitos existentes, controles normativos y de cumplimiento (internos y externos): determine qué rol de Azure Policies y Azure RBAC son necesarios",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Una aplicación cliente de Service Bus que se ejecuta dentro de una aplicación de Azure App Service o en una máquina virtual con entidades administradas habilitadas para la compatibilidad con recursos de Azure no necesita controlar reglas y claves de SAS, ni ningún otro token de acceso. La aplicación cliente solo necesita la dirección del punto de conexión del espacio de nombres de mensajería de Service Bus. ",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
+ "severity": "Medio",
+ "text": "Cuando sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Service Bus. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Al crear permisos, proporcione un control detallado sobre el acceso de un cliente a Azure Service Bus. Los permisos de Azure Service Bus pueden y deben limitarse al nivel de recurso individual, por ejemplo, cola, tema o suscripción. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
"severity": "Alto",
- "text": "Al habilitar Microsoft Defender para punto de conexión en el entorno de SAP, se recomienda excluir los archivos de datos y registros en servidores DBMS en lugar de dirigirse a todos los servidores. Siga las recomendaciones de su proveedor de DBMS al excluir archivos de destino.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "text": "Usar RBAC del plano de datos con privilegios mínimos",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
- "severity": "Alto",
- "text": "Delegue un rol personalizado de administrador de SAP con acceso Just-In-Time de Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Los registros de recursos de Azure Service Bus incluyen registros operativos, redes virtuales y registros de filtrado de IP. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para varias operaciones de acceso al plano de datos (como enviar o recibir mensajes) en Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
+ "severity": "Medio",
+ "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para realizar un seguimiento de los registros de recursos y los registros de auditoría en tiempo de ejecución (actualmente solo disponible en el nivel Premium)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Bajo",
- "text": "cifre los datos en tránsito integrando el producto de seguridad de terceros con comunicaciones de red seguras (SNC) para DIAG (SAP GUI), RFC y SPNEGO para HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "De forma predeterminada, Azure Service Bus tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y los recorridos de Azure Service Bus a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se utilizan. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de usar puntos de conexión privados para acceder a Azure Service Bus y deshabilitar el acceso a la red pública cuando corresponda.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Con el firewall de IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"severity": "Medio",
- "text": "De forma predeterminada, use claves administradas por Microsoft para la funcionalidad de cifrado principal y use claves administradas por el cliente cuando sea necesario.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres de Azure Service Bus desde direcciones IP o intervalos específicos",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Seguridad"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "Alto",
- "text": "Use una instancia de Azure Key Vault por aplicación, por entorno, por región.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
+ "severity": "Medio",
+ "text": "Use el token revocable de larga duración, almacene en caché el token y adquiera el token de forma silenciosa mediante la biblioteca de identidades de Microsoft",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "severity": "Alto",
- "text": "Para controlar y administrar las claves y los secretos de cifrado de disco para sistemas operativos Windows y Windows que no son de HANA, use Azure Key Vault. SAP HANA no es compatible con Azure Key Vault, por lo que debe usar métodos alternativos como SAP ABAP o claves SSH.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
+ "severity": "Medio",
+ "text": "Asegúrese de que los flujos de usuario de inicio de sesión estén respaldados y sean resistentes. Asegúrese de que se ha realizado una copia de seguridad del código que usa para iniciar sesión en los usuarios y se puede recuperar. Interfaces resilientes con procesos externos",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
- "severity": "Alto",
- "text": "Personalice los roles de control de acceso basado en roles (RBAC) para las suscripciones de SAP en Azure spoke para evitar cambios accidentales relacionados con la red",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
+ "severity": "Medio",
+ "text": "Los activos de marca personalizados deben estar alojados en una CDN",
+ "waf": "Rendimiento"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
- "severity": "Alto",
- "text": "Aísle las DMZ y las NVA del resto del patrimonio de SAP, configure Azure Private Link y administre y controle de forma segura los recursos de SAP en Azure",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "Bajo",
+ "text": "Tener varios proveedores de identidad (es decir, iniciar sesión con sus cuentas de Microsoft, Google, Facebook)",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Considere la posibilidad de usar el software antimalware de Microsoft en Azure para proteger sus máquinas virtuales de archivos malintencionados, adware y otras amenazas.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "Medio",
+ "text": "Siga las reglas de la máquina virtual para la alta disponibilidad en el nivel de máquina virtual (discos premium, dos o más en una región, en diferentes zonas de disponibilidad)",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "Bajo",
- "text": "Para una protección aún más eficaz, considere la posibilidad de usar Microsoft Defender para punto de conexión.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "Medio",
+ "text": "¡No repliques! La replicación puede crear problemas con la sincronización de directorios",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "Alto",
- "text": "Aísle los servidores de bases de datos y aplicaciones de SAP de Internet o de la red local pasando todo el tráfico a través de la red virtual del concentrador, que está conectada a la red radial mediante el emparejamiento de red virtual. Las redes virtuales emparejadas garantizan que la solución de SAP en Azure esté aislada de la red pública de Internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "Medio",
+ "text": "Tener activo-activo para varias regiones",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Bajo",
- "text": "En el caso de las aplicaciones orientadas a Internet, como SAP Fiori, asegúrese de distribuir la carga según los requisitos de la aplicación mientras se mantienen los niveles de seguridad. Para la seguridad de nivel 7, puede usar un firewall de aplicaciones web (WAF) de terceros disponible en Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
- "waf": "Seguridad"
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
+ "severity": "Medio",
+ "text": "Adición de stamps de servicio de dominio de Azure AD a regiones y ubicaciones adicionales",
+ "waf": "Fiabilidad"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Medio",
- "text": "Para habilitar la comunicación segura en las soluciones de Azure Monitor para SAP, puede optar por usar un certificado raíz o un certificado de servidor. Le recomendamos encarecidamente que utilice certificados raíz.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Seguridad"
+ "text": "Uso de conjuntos de réplicas para recuperación ante desastres",
+ "waf": "Fiabilidad"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
@@ -10007,7 +10007,7 @@
"name": "Cumplido"
},
{
- "description": "Recomendación comprendida, pero no necesaria por los requisitos actuales",
+ "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
"name": "No es necesario"
},
{
diff --git a/checklists/waf_checklist.ja.json b/checklists/waf_checklist.ja.json
index feba01088..5ced8b488 100644
--- a/checklists/waf_checklist.ja.json
+++ b/checklists/waf_checklist.ja.json
@@ -1,6024 +1,5255 @@
{
"items": [
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "低い",
- "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hubs 名前空間を使用すると、クライアントは TLS 1.0 以降でデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信するように Event Hubs 名前空間を構成できます。Event Hubs 名前空間で TLS の最小バージョンが必要な場合、古いバージョンで行われた要求はすべて失敗します。",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
- "severity": "中程度",
- "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Event Hubs 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前のポリシー規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは、管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。RBAC で認証プロバイダーとして AAD を使用することをお勧めします。",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "中程度",
- "text": "必要のない場合はrootアカウントの使用を避けてください",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure リソースのマネージド ID は、Azure Virtual Machines (VM)、関数アプリ、Virtual Machine Scale Sets、その他のサービスで実行されているアプリケーションから Azure AD 資格情報を使用して、Event Hubs リソースへのアクセスを承認できます。Azure リソースのマネージド ID を Azure AD 認証と共に使用することで、クラウドで実行されるアプリケーションに資格情報を格納することを回避できます。",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"severity": "中程度",
- "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Event Hub に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに用意することを検討してください",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "アクセス許可を作成するときは、Azure Event Hub へのクライアントのアクセスをきめ細かく制御します。Azure Event Hub のアクセス許可は、個々のリソース レベル (コンシューマー グループ、イベント ハブ エンティティ、イベント ハブ名前空間など) にスコープを設定する必要があり、またそうする必要があります。",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
- "severity": "高い",
- "text": "最小特権データ プレーン RBAC を使用する",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "安全"
+ "text": "有効期間の長い取り消し可能なトークンを使用し、トークンをキャッシュし、Microsoft ID ライブラリを使用してサイレントに取得します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub リソース ログには、操作ログ、仮想ネットワーク、Kafka ログが含まれます。ランタイム監査ログは、Event Hubs のすべてのデータ プレーン アクセス操作 (イベントの送受信など) に関する集計された診断情報をキャプチャします。",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "中程度",
- "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用して、リソース ログ、ランタイム監査ログ、Kafka ログなどのメトリックとログをキャプチャします",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "安全"
+ "text": "サインイン ユーザー フローがバックアップされ、回復性があることを確認します。ユーザーのサインインに使用するコードがバックアップされ、回復可能であることを確認します。外部プロセスとの回復力のあるインターフェース",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "既定では、Azure Event Hub にはパブリック IP アドレスがあり、インターネットに到達できます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Event Hub の間のトラフィックが Microsoft のバックボーン ネットワークを経由するようになります。それに加えて、パブリックエンドポイントを使用しない場合は無効にする必要があります。",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"severity": "中程度",
- "text": "プライベート エンドポイントを使用して Azure Event Hub にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "text": "カスタムブランドアセットはCDNでホストする必要がある",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを、CIDR (Classless Inter-Domain Routing) 表記の一連の IPv4 アドレスまたは IPv4 アドレス範囲のみに制限できます。",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
- "severity": "中程度",
- "text": "特定の IP アドレスまたは範囲からの Azure Event Hub 名前空間へのアクセスのみを許可することを検討してください",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "低い",
+ "text": "複数のIDプロバイダーを持っている(つまり、Microsoft、Google、Facebookアカウントでログインする)",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "中程度",
- "text": "FTAレジリエンシーハンドブックの活用",
+ "text": "VM レベルでの高可用性に関する VM ルールに従う (Premium ディスク、リージョン内の 2 つ以上、異なる可用性ゾーン内)",
"waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "これは、ゾーン対応リージョンの Premium、Dedicated、または Standard SKU を使用してポータルから作成された新しい EH 名前空間に対して自動的にオンになります。EH メタデータとイベント データ自体の両方がゾーン間でレプリケートされます",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
- "severity": "高い",
- "text": "Availability Zones の活用 (地域的に適用可能な場合)",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "中程度",
+ "text": "複製しないでください!レプリケーションにより、ディレクトリ同期に関する問題が発生する可能性があります",
"waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "中程度",
- "text": "予測可能なパフォーマンスのために Premium または Dedicated SKU を使用する",
+ "text": "マルチリージョンのアクティブ/アクティブを持つ",
"waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "組み込みの geo ディザスター リカバリー機能を有効にすると、名前空間の構成全体 (Event Hubs、コンシューマー グループ、設定) がプライマリ名前空間からセカンダリ名前空間に継続的にレプリケートされ、プライマリからセカンダリへのフェールオーバーをいつでも 1 回だけ行うことができます。アクティブ/パッシブ機能は、アプリケーション構成を変更することなく、障害が発生した Azure リージョンからの復旧と破棄を容易にするように設計されています",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
- "severity": "高い",
- "text": "アクティブ パッシブ構成を使用した Geo ディザスター リカバリーの計画",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
+ "severity": "中程度",
+ "text": "Azure AD Domain Service スタンプを追加のリージョンと場所に追加する",
"waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "ダウンしたリージョンでのイベントデータの停止または損失を許容できない DR 構成に使用する必要があります。このような場合は、レプリケーションのガイダンスに従い、組み込みの geo ディザスター リカバリー機能 (アクティブ/パッシブ) を使用しないでください。アクティブ/アクティブでは、異なるリージョンと名前空間で複数の Event Hubs を保持し、イベントはハブ間でレプリケートされます",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "中程度",
- "text": "ビジネス クリティカルなアプリケーションの場合は、アクティブ アクティブ構成を使用します",
+ "text": "DR にレプリカ セットを使用する",
"waf": "確実"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
- "severity": "中程度",
- "text": "回復力のある Event Hubs の設計",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "AKS Windows ワークロードで必要な場合は、HostProcess コンテナーを使用できます",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Center for SAP solutions (ACSS) は、SAP を Azure 上の最上位のワークロードにする Azure オファリングです。ACSS は、Azure 上の統合ワークロードとして SAP システムを作成および実行し、イノベーションのためのよりシームレスな基盤を提供するエンドツーエンドのソリューションです。新しい Azure ベースの SAP システムと既存の SAP システムの両方の管理機能を利用できます。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "イベント ドリブン ワークロードを実行する場合は KEDA を使用します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure では、Linux と Windows での SAP デプロイの自動化がサポートされています。SAP Deployment Automation Framework は、SAP 環境をデプロイ、インストール、保守できるオープンソースのオーケストレーションツールです。",
- "training": "https://github.com/Azure/sap-automation",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "Dapr を使用してマイクロサービス開発を容易にする",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
- "severity": "中程度",
- "text": "運用データベースのポイントインタイムリカバリを、RTOを満たす任意の時点と時間枠で実行します。ポイントインタイムリカバリには、通常、DBMSレイヤーまたはSAPを介してデータを削除するオペレーターのエラーが含まれます",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "SLA でサポートされる AKS オファリングを使用する",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
- "severity": "中程度",
- "text": "バックアップ時間とリカバリ時間をテストして、災害後にすべてのシステムを同時にリストアするための RTO 要件を満たしていることを確認します。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "ポッドとデプロイ定義でのディスラプション バジェットの使用",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"severity": "高い",
- "text": "ペアになっているリージョン間で標準ストレージをレプリケートすることはできますが、データベースや仮想ハード ディスクの保存に標準ストレージを使用することはできません。バックアップをレプリケートできるのは、使用するペアのリージョン間でのみです。他のすべてのデータについては、SQL Server Always On や SAP HANA システム レプリケーションなどのネイティブ DBMS 機能を使用してレプリケーションを実行します。SAP アプリケーション層には、Site Recovery、rsync または robocopy、およびその他のサードパーティ ソフトウェアを組み合わせて使用します。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "text": "プライベート レジストリを使用する場合は、複数のリージョンにイメージを格納するようにリージョン レプリケーションを構成します",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Availability Zones を使用して高可用性を実現する場合は、SAP アプリケーション サーバーとデータベース サーバー間の待機時間を考慮する必要があります。レイテンシーの高いゾーンでは、SAP アプリケーション・サーバーとデータベース・サーバーが常に同じゾーンで実行されていることを確認するための運用手順を整備する必要があります。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "確実"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
- "severity": "高い",
- "text": "オンプレミスからプライマリおよびセカンダリの Azure ディザスター リカバリー リージョンへの ExpressRoute 接続を設定します。また、ExpressRoute を使用する代わりに、オンプレミスからプライマリおよびセカンダリの Azure ディザスター リカバリー リージョンへの VPN 接続を設定することを検討してください。",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "kubecost などの外部アプリケーションを使用して、さまざまなユーザーにコストを割り当てます",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
"severity": "低い",
- "text": "証明書、シークレット、キーなどのキー コンテナーの内容をリージョン間でレプリケートして、DR リージョンのデータを復号化できるようにします。",
- "waf": "確実"
+ "text": "スケールダウンモードを使用してノードを削除/割り当て解除する",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"severity": "中程度",
- "text": "プライマリ仮想ネットワークとディザスター リカバリー仮想ネットワークをピアリングします。たとえば、HANA システム レプリケーションの場合、SAP HANA DB 仮想ネットワークをディザスター リカバリー サイトの SAP HANA DB 仮想ネットワークにピアリングする必要があります。",
- "waf": "確実"
+ "text": "必要に応じて、AKS クラスターで複数インスタンスの分割 GPU を使用する",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
"severity": "低い",
- "text": "SAP デプロイに Azure NetApp Files ストレージを使用する場合は、少なくとも Premium レベルの 2 つのリージョンに 2 つの Azure NetApp Files アカウントを作成します。",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "確実"
+ "text": "Dev/Test クラスターを実行している場合は、NodePool Start/Stop を使用します。",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "高い",
- "text": "ネイティブ・データベース・レプリケーション・テクノロジーを使用して、HAペアのデータベースを同期する必要があります。",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "Azure Policy for Kubernetes を使用してクラスターのコンプライアンスを確保する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "高い",
- "text": "プライマリ仮想ネットワーク (VNet) の CIDR は、DR サイトの VNet の CIDR と競合したり、重複したりしないようにする必要があります",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "ユーザー/システムノードプールを使用してコントロールプレーンからアプリケーションを分離する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
- "severity": "高い",
- "text": "Site Recovery を使用して、アプリケーション サーバーを DR サイトにレプリケートします。Site Recovery は、セントラル サービス クラスター VM を DR サイトにレプリケートするのにも役立ちます。DR を呼び出すときは、DR サイトで Linux Pacemaker クラスターを再構成する必要があります (たとえば、VIP または SBD の置き換え、corosync.conf の実行など)。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "システム ノードプールにテイントを追加して専用にする",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "高い",
- "text": "単一障害点に対する SAP ソフトウェアの可用性を検討します。これには、SAP NetWeaver や SAP S/4HANA アーキテクチャ、SAP ABAP や ASCS + SCS で使用される DBMS などのアプリケーション内の単一障害点が含まれます。また、SAP Web Dispatcher などの他のツールも含みます。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "イメージにはプライベート レジストリ (ACR など) を使用する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP および SAP データベースの場合は、自動フェールオーバー クラスターの実装を検討してください。Windows では、Windows Server フェールオーバー クラスタリングはフェールオーバーをサポートします。Linux では、Linux Pacemaker や SIOS Protection Suite や Veritas InfoScale などのサードパーティツールがフェイルオーバーをサポートしています。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
+ "severity": "中程度",
+ "text": "イメージをスキャンして脆弱性を検出する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"severity": "高い",
- "text": "Azure では、プライマリ VM とセカンダリ VM が DBMS データのストレージを共有するアーキテクチャはサポートされていません。DBMS レイヤーの一般的なアーキテクチャ パターンは、プライマリ VM とセカンダリ VM が使用するものとは異なるストレージ スタックを使用して、データベースを同時にレプリケートすることです。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "確実"
+ "text": "アプリの分離要件を定義する (名前空間/ノードプール/クラスター)",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
- "severity": "高い",
- "text": "DBMS データとトランザクション/再実行ログ ファイルは、Azure でサポートされているブロック ストレージまたは Azure NetApp Files に格納されます。Azure Files または Azure Premium Files は、SAP ワークロードでの DBMS データや再実行ログ ファイルのストレージとしてサポートされていません。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "CSI シークレット ストア ドライバーを使用して Azure Key Vault にシークレットを格納する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"severity": "高い",
- "text": "Windows の Azure 共有ディスクは、ASCS + SCS コンポーネントと特定の高可用性シナリオに使用できます。フェールオーバー クラスターは、SAP アプリケーション レイヤー コンポーネントと DBMS レイヤー用に別々に設定します。Azure では現在、SAP アプリケーション レイヤー コンポーネントと DBMS レイヤーを 1 つのフェールオーバー クラスターに結合する高可用性アーキテクチャはサポートされていません。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "text": "クラスターにサービス プリンシパルを使用する場合は、資格情報を定期的に (四半期ごとなど) 更新します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP アプリケーション レイヤー コンポーネント (ASCS) と DBMS レイヤーのほとんどのフェールオーバー クラスターには、フェールオーバー クラスターの仮想 IP アドレスが必要です。 Azure Load Balancer は、他のすべてのケースで仮想 IP アドレスを処理する必要があります。設計原則の 1 つは、クラスター構成ごとに 1 つのロード バランサーを使用することです。ロード バランサーの Standard バージョン (Standard Load Balancer SKU) を使用することをお勧めします。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "必要に応じて、キー管理サービスの etcd 暗号化を追加します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
- "severity": "高い",
- "text": "フローティング IP がロードバランサーで有効になっていることを確認します",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて、Confidential Compute for AKS の使用を検討してください",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
- "severity": "高い",
- "text": "高可用性インフラストラクチャをデプロイする前に、選択したリージョンに応じて、Azure 可用性セットと可用性ゾーンのどちらを使用してデプロイするかを決定します。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "Defender for Containers の使用を検討する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"severity": "高い",
- "text": "SAP コンポーネント (セントラル サービス、アプリケーション サーバー、データベース) のアプリケーションのインフラストラクチャ SLA を満たす場合は、すべてのコンポーネントに対して同じ高可用性オプション (VM、可用性セット、可用性ゾーン) を選択する必要があります。",
- "waf": "確実"
+ "text": "サービス プリンシパルの代わりにマネージド ID を使用するUse managed identities instead of Service Principals",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "高い",
- "text": "同じ可用性セットに異なる役割のサーバーを混在させないでください。中央サービス VM、データベース VM、アプリケーション VM を独自の可用性セットに保持します",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "認証と AAD の統合 (マネージド統合を使用)",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"severity": "中程度",
- "text": "近接配置グループを使用しない限り、Azure 可用性ゾーン内に Azure 可用性セットをデプロイすることはできません。",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "確実"
+ "text": "管理者 kubeconfig へのアクセスを制限する (get-credentials --admin)",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "高い",
- "text": "可用性セットを作成するときは、使用可能な障害ドメインと更新ドメインの最大数を使用します。たとえば、1 つの可用性セットに 2 つ以上の VM をデプロイする場合は、Azure の計画メンテナンスに加えて、潜在的な物理ハードウェア障害、ネットワーク停止、または電源中断の影響を制限するために、最大数の障害ドメイン (3) と十分な更新ドメインを使用します。障害ドメインのデフォルトの数は 2 で、後でオンラインで変更することはできません。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "承認と AAD RBAC の統合",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"severity": "高い",
- "text": "可用性セットのデプロイで Azure 近接配置グループを使用する場合、3 つの SAP コンポーネント (中央サービス、アプリケーション サーバー、データベース) すべてが同じ近接配置グループに存在する必要があります。",
- "waf": "確実"
+ "text": "Kubernetes で RBAC 特権を制限するために名前空間を使用する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP SID ごとに 1 つの近接配置グループを使用します。グループは Availability Zones または Azure リージョンにまたがっていません",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "ポッド ID アクセス管理の場合は、Azure AD ワークロード ID (プレビュー) を使用します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "高い",
- "text": "次のいずれかのサービスを使用して、オペレーティング システムに応じて SAP セントラル サービス クラスターを実行します。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "AKS 非対話型ログインの場合は、kubelogin (プレビュー) を使用します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"severity": "中程度",
- "text": "現在、Azure では、同じ Linux Pacemaker クラスターでの ASCS と DB HA の組み合わせはサポートされていません。それらを個々のクラスターに分割します。ただし、最大 5 つの複数の中央サービス クラスターを 1 つの VM のペアに結合できます。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "text": "AKS ローカル アカウントを無効にする",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "中程度",
- "text": "両方の VM を高可用性ペア、可用性セット、または可用性ゾーンにデプロイします。これらの VM は、同じサイズで、同じストレージ構成である必要があります。",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて Just-In-Time クラスター アクセスを構成する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure では、Red Hat Enterprise Linux (RHEL) で実行されている同じ高可用性クラスター上での SAP HANA インスタンスと ASCS/SCS インスタンスと ERS インスタンスのインストールと構成がサポートされています。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて AKS の AAD 条件付きアクセスを構成する",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "高い",
- "text": "すべての運用システムを Premium マネージド SSD で実行し、Azure NetApp Files または Ultra Disk Storage を使用します。少なくとも、OS ディスクは Premium レベルにある必要があるため、パフォーマンスの向上と最高の SLA を実現できます。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "Windows AKS ワークロードで必要な場合は、gMSA を構成します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
- "severity": "高い",
- "text": "Azure で SAP HANA を実行するのは、SAP によって認定されたストレージの種類のみにしてください。特定のボリュームは、該当する場合、特定のディスク構成で実行する必要があることに注意してください。これらの構成には、書き込みアクセラレータの有効化と Premium ストレージの使用が含まれます。また、ストレージ上で実行されるファイルシステムが、マシン上で実行される DBMS と互換性があることを確認する必要があります。",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "より細かく制御するには、マネージドKubelet Identityの使用を検討してください",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP ワークロードに使用するストレージのタイプに応じて、高可用性を構成することを検討してください。Azure で使用できる一部のストレージ サービスは Azure Site Recovery でサポートされていないため、高可用性の構成が異なる場合があります。",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "AGIC を使用している場合は、クラスター間で AppGW を共有しないでください",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"severity": "高い",
- "text": "さまざまなネイティブ Azure ストレージ サービス (Azure Files、Azure NetApp Files、Azure Shared Disk など) は、すべてのリージョンで使用できるとは限りません。そのため、フェールオーバー後に DR リージョンで同様の SAP を設定するには、それぞれのストレージ サービスが DR サイトで提供されていることを確認します。",
+ "text": "AKS HTTP ルーティング アドオンを使用せず、代わりにアプリケーション ルーティング アドオンでマネージド NGINX イングレスを使用します。",
"waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"severity": "中程度",
- "text": "SAPシステムのStart-Stopを自動化してコストを管理します。",
- "waf": "費用"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "低い",
- "text": "Azure Premium Storage を SAP HANA と共に使用する場合、Azure Standard SSD ストレージを使用して、コストを意識したストレージ ソリューションを選択できます。ただし、Standard SSD または Standard HDD Azure ストレージを選択すると、個々の VM の SLA に影響することに注意してください。また、非本番環境など、I/O スループットが低く、レイテンシが低いシステムでは、下位シリーズの VM を使用できます。",
- "waf": "費用"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "低い",
- "text": "低コストの代替構成 (多目的) として、非運用 HANA データベース サーバー VM に低パフォーマンスの SKU を選択できます。ただし、E シリーズなどの一部の VM タイプは、HANA 認定 (SAP HANA ハードウェア ディレクトリ) されていないか、1 ミリ秒未満のストレージ待機時間を実現できないことに注意してください。",
- "waf": "費用"
+ "text": "Windows ワークロードの場合は、高速ネットワークを使用します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "高い",
- "text": "管理グループ、サブスクリプション、リソース グループ、リソースに RBAC モデルを適用する",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "text": "標準のALBを使用する(基本的なALBとは対照的)",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"severity": "中程度",
- "text": "クラウド コネクタを介して SAP クラウド アプリケーションから SAP オンプレミス (IaaS を含む) に ID を転送するためのプリンシパル伝達の強制",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "Azure CNI を使用する場合は、NodePool に異なるサブネットを使用することを検討してください",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"severity": "中程度",
- "text": "SAML を使用して、SAP Analytics Cloud、SAP Cloud Platform、Business by Design、SAP Qualtrics、SAP C4C with Azure AD などの SAP SaaS アプリケーションに SSO を実装します。",
+ "text": "プライベート エンドポイント (推奨) または Virtual Network サービス エンドポイントを使用して、クラスターから PaaS サービスにアクセスする",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAML を使用して、SAP Fiori や SAP Web GUI などの SAP NetWeaver ベースの Web アプリケーションに SSO を実装します。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "要件に最適な CNI ネットワーク プラグインを選択する (Azure CNI を推奨)",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAML を使用して、SAP Fiori や SAP Web GUI などの SAP NetWeaver ベースの Web アプリケーションに SSO を実装します。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "Azure CNI を使用する場合は、ノードあたりのポッドの最大数を考慮して、サブネットのサイズを適切に設定します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP NetWeaver SSO またはパートナソリューションを使用して、SAP GUI への SSO を実装することができます。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "Azure CNI を使用している場合は、最大ポッド数/ノード (既定値は 30) を確認します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP GUIおよびWebブラウザアクセスのSSOには、構成と保守が容易なSNC / Kerberos / SPNEGO(シンプルで保護されたGSSAPIネゴシエーションメカニズム)を実装します。X.509 クライアント証明書を使用した SSO の場合は、SAP SSO ソリューションのコンポーネントである SAP Secure Login Server を検討してください。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "内部アプリの場合、組織は多くの場合、ファイアウォールで AKS サブネット全体を開きます。これにより、ノードへのネットワーク アクセスも開かれ、場合によってはポッドへのネットワーク アクセスも開かれます (Azure CNI を使用している場合)。LoadBalancer の IP が別のサブネットにある場合は、この IP のみをアプリ クライアントで使用できる必要があります。もう 1 つの理由は、AKS サブネット内の IP アドレスが希少なリソースである場合、その IP アドレスをサービスに使用すると、クラスターの最大スケーラビリティが低下することです。",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "プライベート IP LoadBalancer サービスを使用する場合は、(AKS サブネットではなく) 専用サブネットを使用します",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP GUIおよびWebブラウザアクセスのSSOには、構成と保守が容易なSNC / Kerberos / SPNEGO(シンプルで保護されたGSSAPIネゴシエーションメカニズム)を実装します。X.509 クライアント証明書を使用した SSO の場合は、SAP SSO ソリューションのコンポーネントである SAP Secure Login Server を検討してください。",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "それに応じて、サービスの IP アドレス範囲のサイズを設定します (クラスターのスケーラビリティが制限されます)。",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP NetWeaver の OAuth を使用して SSO を実装し、サードパーティまたはカスタムアプリケーションが SAP NetWeaver OData サービスにアクセスできるようにします。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて、独自のCNIプラグインを追加します",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP HANA への SSO の実装",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて、AKS でノードごとにパブリック IP を構成する",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure AD は、RISE でホストされている SAP システムの ID プロバイダーと考えてください。詳細については、「サービスと Azure AD の統合」を参照してください。",
- "waf": "安全"
+ "text": "イングレス コントローラーを使用して、LoadBalancer タイプのサービスで公開する代わりに、Web ベースのアプリを公開します",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP にアクセスするアプリケーションの場合は、プリンシパル伝搬を使用して SSO を確立することができます。",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "エグレス トラフィックをスケーリングするために Azure NAT Gateway を outboundType として使用する",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
"severity": "中程度",
- "text": "SAP Identity Authentication Service (IAS) を必要とする SAP BTP サービスまたは SaaS ソリューションを使用している場合は、SAP Cloud Identity Authentication サービスと Azure AD の間に SSO を実装して、それらの SAP サービスにアクセスすることを検討してください。この統合により、SAP IAS はプロキシ ID プロバイダーとして機能し、認証要求を中央ユーザー ストアおよび ID プロバイダーとして Azure AD に転送できます。",
+ "text": "Azure CNI IP の枯渇を回避するために IP の動的割り当てを使用する",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "セキュリティ要件で義務付けられている場合は、AzFW/NVA を使用してエグレス トラフィックをフィルター処理します",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"severity": "中程度",
- "text": "SAP BTP への SSO の実装",
+ "text": "パブリック API エンドポイントを使用している場合は、アクセスできる IP アドレスを制限します",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP SuccessFactors を使用している場合は、Azure AD 自動ユーザー プロビジョニングの使用を検討してください。この統合により、新しい従業員を SAP SuccessFactors に追加すると、Azure AD でそのユーザー アカウントを自動的に作成できます。必要に応じて、Microsoft 365 または Azure AD でサポートされている他の SaaS アプリケーションでユーザー アカウントを作成できます。メール アドレスを SAP SuccessFactors に書き戻します。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "要件で必要な場合は、プライベート クラスターを使用します",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "description": "管理グループの階層を適度にフラットに保ちます (4 つ以下)。",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "中程度",
- "text": "既存の管理グループポリシーをSAPサブスクリプションに適用",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "オペレーションズ"
+ "text": "Windows 2019 および 2022 AKS ノードでは、Calico ネットワーク ポリシーを使用できます",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "高い",
- "text": "緊密に結合されたアプリケーションを同じSAPサブスクリプションに統合して、ルーティングと管理の複雑さを回避",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "オペレーションズ"
+ "text": "Kubernetes ネットワーク ポリシー オプションを有効にする (Calico/Azure)",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "高い",
- "text": "サブスクリプションをスケールユニットとして活用し、リソースをスケーリングし、環境ごとにサブスクリプションをデプロイすることを検討してください。サンドボックス、非製品、製品",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "オペレーションズ"
+ "text": "Kubernetesネットワークポリシーを使用してクラスタ内のセキュリティを強化",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "高い",
- "text": "サブスクリプションのプロビジョニングの一部としてクォータの増加を確認する (例: サブスクリプション内の使用可能な VM コアの合計)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "オペレーションズ"
+ "text": "Web ワークロード (UI または API) に WAF を使用するUse a WAF for a web workloads (UI or API)",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "AKS Virtual Network で DDoS Standard を使用するUse DDoS Standard in the AKS Virtual Network",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
"severity": "低い",
- "text": "Quota API は、Azure サービスのクォータを表示および管理するために使用できる REST API です。必要に応じて使用を検討してください。",
- "waf": "オペレーションズ"
+ "text": "必要に応じて、会社の HTTP プロキシを追加します",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "高度なマイクロサービス通信管理にサービスメッシュの使用を検討する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"severity": "高い",
- "text": "可用性ゾーンにデプロイする場合は、クォータが承認されたら、VM のゾーン デプロイが使用可能であることを確認してください。サブスクリプション、VM シリーズ、CPU の数、必要な可用性ゾーンを含むサポート リクエストを送信します。",
+ "text": "最も重要なメトリックに関するアラートを構成します (推奨事項については、「Container Insights」を参照してください)",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "高い",
- "text": "必要なサービスと機能が、選択したデプロイ リージョン内で使用できることを確認します。ANF、ゾーンなど",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "Azure Advisor でクラスターの推奨事項を定期的に確認する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
- "severity": "中程度",
- "text": "コストの分類とリソースのグループ化に Azure リソース タグを活用します (: BillTo、部門 (または部署)、環境 (運用、ステージ、開発)、階層 (Web 層、アプリケーション層)、アプリケーション所有者、ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "AKS 自動証明書のローテーションを有効にする",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"severity": "高い",
- "text": "Azure Backup サービスを使用して HANA データベースを保護します。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "確実"
+ "text": "kubernetes のバージョンを定期的に (四半期ごとなど) アップグレードする定期的なプロセスを行うか、AKS 自動アップグレード機能を使用します",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
- "severity": "中程度",
- "text": "HANA 、 Oracle 、または DB2 データベースに Azure NetApp Files をデプロイする場合は、 Azure アプリケーション整合性スナップショット ツール (AzAcSnap) を使用して、アプリケーション整合性スナップショットを作成します。AzAcSnap は Oracle データベースもサポートしています。AzAcSnap は、個々の VM ではなく、中央の VM で使用することを検討してください。",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "ノードイメージのアップグレードを使用していない場合は、Linuxノードのアップグレードにkuredを使用します",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"severity": "高い",
- "text": "オペレーティングシステムと SAP システムの間でタイムゾーンが一致していることを確認します。",
+ "text": "クラスタノードイメージを定期的に(毎週など)アップグレードする定期的なプロセスを用意します",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
- "severity": "中程度",
- "text": "同じクラスター内で異なるアプリケーション サービスをグループ化しないでください。たとえば、DRBDと中央サービスクラスタを同じクラスタに組み合わせないでください。ただし、同じ Pacemaker クラスターを使用して、約 5 つの異なる中央サービス (マルチ SID クラスター) を管理できます。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "アプリケーションまたはクラスター構成を複数のクラスターにデプロイするために gitop を検討してください",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
"severity": "低い",
- "text": "Azure の実行コストを節約して最適化するために、スヌーズ モデルで開発/テスト システムを実行することを検討してください。",
- "waf": "費用"
+ "text": "プライベート クラスターで AKS コマンド呼び出しを使用することを検討する",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "お客様の SAP 資産を管理することでお客様と提携する場合は、Azure Lighthouse をご検討ください。Azure Lighthouse を使用すると、マネージド サービス プロバイダーは Azure ネイティブ ID サービスを使用して、顧客の環境に対して認証を行うことができます。これにより、顧客はいつでもアクセスを取り消し、サービスプロバイダーの行動を監査できるため、制御が顧客の手に委ねられます。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "計画されたイベントの場合は、ノードの自動ドレインの使用を検討してください",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Update Manager を使用して、1 つまたは複数の VM で利用可能な更新プログラムの状態を確認し、定期的な修正プログラムの適用をスケジュールすることを検討してください。",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "独自のガバナンスプラクティスを開発して、ノードRG(別名「インフラRG」)のオペレーターによって変更が実行されないようにします",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"severity": "低い",
- "text": "SAP Landscape Management (LaMa) を使用して、SAP Basis の運用を最適化および管理します。Azure 用の SAP LaMa コネクタを使用して、SAP システムの再配置、コピー、複製、更新を行います。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "text": "カスタムノードRG(別名「インフラRG」)名を使用",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure Monitor for SAP solutions を使用して、Azure 上の SAP ワークロード (SAP HANA、高可用性 SUSE クラスター、SQL システム) を監視します。SAP Solution Manager を使用して Azure Monitor for SAP solutions を補完することを検討してください。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "非推奨の Kubernetes API を YAML マニフェストで使用しないでください",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP の VM 拡張機能チェックを実行します。VM Extension for SAP は、仮想マシン (VM) の割り当てられたマネージド ID を使用して、VM の監視データと構成データにアクセスします。このチェックにより、SAP アプリケーションのすべてのパフォーマンス メトリックが、基になる Azure Extension for SAP からのものであることが保証されます。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "Windows ノードのテイント",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Policy を使用して、アクセス制御とコンプライアンス レポートを作成します。Azure Policy には、組織全体の設定を適用して、一貫したポリシーの遵守と迅速な違反検出を確保する機能があります。",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "Windows コンテナーのパッチ レベルをホストのパッチ レベルと同期させる",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Network Watcher の接続モニターを使用して、SAP データベースとアプリケーション サーバーの待機時間メトリックを監視します。または、Azure Monitor を使用してネットワーク待機時間の測定値を収集して表示します。",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "クラスタレベルでの診断設定経由",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "マスター ログ (API ログ) を Azure Monitor または任意のログ管理ソリューションに送信する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
- "severity": "中程度",
- "text": "プロビジョニングされた Azure インフラストラクチャで SAP HANA の品質チェックを実行し、プロビジョニングされた VM が SAP HANA on Azure のベスト プラクティスに準拠していることを確認します。",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて、nodePool スナップショットを使用します",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "高い",
- "text": "Azure サブスクリプションごとに、ゾーン デプロイの前に Azure 可用性ゾーンで待機時間テストを実行して、Azure 上の SAP のデプロイに待機時間の短いゾーンを選択します。",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "パフォーマンス"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
- "severity": "中程度",
- "text": "回復性レポートを実行して、プロビジョニングされた Azure インフラストラクチャ全体 (コンピューティング、データベース、ネットワーク、ストレージ、Site Recovery) の構成が、Cloud Adaption Framework for Azure で定義された構成に準拠していることを確認します。",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "確実"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "時間的制約のないワークロードのスポット ノード プールを検討する",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP 用の Microsoft Sentinel ソリューションを使用して脅威保護を実装します。このソリューションを使用して、SAPシステムを監視し、ビジネスロジックとアプリケーションレイヤー全体で高度な脅威を検出します。",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "クイック バーストのために AKS 仮想ノードを検討する",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure のタグ付けを活用すると、リソースを論理的にグループ化して追跡し、デプロイを自動化し、最も重要なこととして、発生したコストを可視化できます。",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "Container Insights (または Prometheus などの他のツール) を使用してクラスター メトリックを監視する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "severity": "低い",
- "text": "レイテンシの影響を受けやすいアプリケーションには、VM 間のレイテンシ監視を使用します。",
- "waf": "パフォーマンス"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "Container Insights(またはTelegraf/ElasticSearchなどの他のツール)を使用してクラスターログを保存および分析します",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure Site Recovery の監視を使用して、SAP アプリケーション サーバーのディザスター リカバリー サービスの正常性を維持します。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "確実"
+ "text": "ノードの CPU とメモリの使用率を監視する",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "中程度",
- "text": "すべてのデータベース・ファイル・システムと実行可能プログラムをアンチウィルス・スキャンから除外します。それらを含めると、パフォーマンスの問題が発生する可能性があります。除外リストに関する規定の詳細については、データベースベンダーに確認してください。たとえば、Oracle では、ウイルス対策スキャンから /oracle//sapdata を除外することをお薦めします。",
- "waf": "パフォーマンス"
+ "text": "Azure CNI を使用している場合は、ノードごとに消費されるポッド IP の割合を監視します",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "severity": "低い",
- "text": "移行後に、HANA 以外のデータベースの完全なデータベース統計を収集することを検討してください。たとえば、SAP ノート 1020260 - Oracle 統計の配信を実装します。",
- "waf": "パフォーマンス"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "OS ディスクの I/O は重要なリソースです。ノード内の OS が I/O で調整されると、予期しない動作が発生し、通常はノードが NotReady と宣言される可能性があります",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
+ "severity": "中程度",
+ "text": "ノード内の OS ディスク キューの深さを監視する",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "中程度",
- "text": "SAP on Azure を使用するすべての Oracle デプロイに Oracle Automatic Storage Management (ASM) を使用することを検討してください。",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "パフォーマンス"
+ "text": "AzFW/NVA でエグレス フィルター処理を使用しない場合は、標準の ALB によって割り当てられた SNAT ポートを監視します",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
"severity": "中程度",
- "text": "Oracle を実行している SAP on Azure の場合、SQL スクリプトのコレクションはパフォーマンスの問題の診断に役立ちます。 自動ワークロード・リポジトリ(AWR)レポートには、Oracleシステムの問題を診断するための貴重な情報が含まれています。AWR レポートは、複数のセッションで実行し、ピーク時間を選択して、分析の範囲を広く設定することをお勧めします。",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "パフォーマンス"
+ "text": "AKS クラスターのリソース正常性通知をサブスクライブするSubscribe to resource health notifications for your AKS cluster",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "高い",
- "text": "Azure Site Recovery の監視を使用して、SAP アプリケーション サーバーのディザスター リカバリー サービスの正常性を維持します。",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "text": "ポッド仕様で要求と制限を構成する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "HTTP/S アプリを安全に配信するには、Application Gateway v2 を使用し、WAF の保護とポリシーが有効になっていることを確認します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure への移行中に仮想マシンの DNS または仮想名が変更されない場合、バックグラウンド DNS と仮想名は SAP ランドスケープ内の多くのシステム インターフェイスに接続され、開発者は時間の経過と共に定義するインターフェイスをお客様が認識することがよくあります。移行後に仮想名やDNS名が変更されると、さまざまなシステム間で接続の問題が発生するため、この種の問題を防ぐためにDNSエイリアスを保持することをお勧めします。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "text": "名前空間のリソースクォータを適用する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "中程度",
- "text": "異なるDNSゾーンを使用して、各環境(サンドボックス、開発、プリプロダクション、およびプロダクション)を相互に区別します。例外は、独自の VNet を持つ SAP デプロイです。ここでは、プライベート DNS ゾーンは必要ないかもしれません。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "サブスクリプションにノードプールをスケールアウトするのに十分なクォータがあることを確認する",
"waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "description": "VNet ピアリングを構成する場合は、 [リモート仮想ネットワークへのトラフィックを許可する] 設定を使用します。",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "中程度",
- "text": "ローカルおよびグローバル VNet ピアリングは接続を提供し、複数の Azure リージョンにまたがる SAP デプロイのランディング ゾーン間の接続を確保するための推奨されるアプローチです",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "確実"
+ "text": "Cluster Autoscaler を使用する",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP アプリケーションと SAP データベース サーバー間の NVA のデプロイはサポートされていません",
- "training": "https://me.sap.com/notes/2731110",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "AKS ノード プールのノード構成をカスタマイズする",
"waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "中程度",
- "text": "Virtual WAN は、Azure リージョンとオンプレミスの場所間でグローバルなトランジット接続が必要な新しいネットワーク、大規模ネットワーク、またはグローバル ネットワークでの Azure デプロイに使用します。このアプローチでは、Azure ネットワークの推移的なルーティングを手動で設定する必要がなく、SAP on Azure デプロイの標準に従うことができます。",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "オペレーションズ"
+ "text": "必要に応じてHorizontal Pod Autoscalerを使用します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
- "severity": "中程度",
- "text": "リージョン間でネットワーク仮想アプライアンス (NVA) をデプロイするのは、パートナーの NVA が使用されている場合にのみ検討してください。ネイティブ NVA が存在する場合、リージョン間または VNet 間の NVA は必要ありません。パートナー ネットワーク テクノロジと NVA をデプロイする場合は、ベンダーのガイダンスに従って、Azure ネットワークと競合する構成を確認します。",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "ノードが大きくなると、パフォーマンスが向上し、エフェメラル ディスクや高速ネットワークなどの機能が提供されますが、爆発半径が大きくなり、スケーリングの粒度が低下します",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "大きすぎず小さすぎない適切なノードサイズを検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
- "severity": "中程度",
- "text": "Virtual WAN は、Virtual WAN ベースのトポロジのスポーク VNet 間の接続を管理し (ユーザー定義ルーティング (UDR) や NVA を設定する必要はありません)、同じ仮想ハブ内の VNet 間トラフィックの最大ネットワーク スループットは 50 ギガビット/秒です。必要に応じて、SAP ランディング ゾーンでは VNet ピアリングを使用して他のランディング ゾーンに接続し、この帯域幅の制限を克服できます。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "スケーラビリティのために 5,000 を超えるノードが必要な場合は、追加の AKS クラスターの使用を検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP ワークロードを実行している VM へのパブリック IP の割り当てはお勧めしません。",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "AKS 自動化のために EventGrid イベントをサブスクライブすることを検討する",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
- "severity": "高い",
- "text": "ASR を設定するときは、DR 側で IP アドレスを予約することを検討してください",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "AKS クラスターで実行時間の長い操作を行う場合は、イベントの終了を検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "高い",
- "text": "運用サイトと DR サイトで重複する IP アドレス範囲を使用しないでください。",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "必要に応じて、AKS ノードに Azure Dedicated Hosts を使用することを検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure では VNet に複数の委任サブネットを作成するのに役立ちますが、Azure NetApp Files の VNet に存在できる委任サブネットは 1 つだけです。Azure NetApp Files に複数の委任されたサブネットを使用すると、新しいボリュームを作成しようとすると失敗します。",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "エフェメラル OS ディスクを使用する",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルタリング (組織で必要な場合) を管理します",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
+ "severity": "高い",
+ "text": "非エフェメラル ディスクの場合、複数のポッドを実行するには高いパフォーマンスが必要であり、既定の AKS ログ ローテーションしきい値で巨大なログが生成されるため、多くのポッド/ノードを実行する場合は、ノードに高い IOPS とより大きな OS ディスクを使用します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
- "severity": "中程度",
- "text": "Application Gateway、SAP Web Dispatcher、およびその他のサードパーティサービスの比較に示すように、Application Gateway が SAP Web アプリのリバースプロキシとして機能する場合、Application Gateway と Web Application Firewall には制限があります。",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
+ "severity": "低い",
+ "text": "ハイパー パフォーマンス ストレージ オプションの場合は、AKS 上の Ultra Disks を使用します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン間でグローバルな保護を提供します。",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "安全"
+ "text": "クラスター内に状態を保持することは避け、外部 (AzStorage、AzSQL、Cosmos など) にデータを格納します",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
"severity": "中程度",
- "text": "Azure Front Door と Application Gateway を使用して HTTP/S アプリケーションを保護している場合は、Azure Front Door の Web アプリケーション ファイアウォール ポリシーを利用します。Azure Front Door からのトラフィックのみを受信するように Application Gateway をロックダウンします。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "安全"
+ "text": "AzFiles Standard を使用する場合は、パフォーマンス上の理由から AzFiles Premium や ANF を検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"severity": "中程度",
- "text": "Web アプリケーション ファイアウォールを使用して、インターネットに公開されているトラフィックをスキャンします。別のオプションは、ロード バランサーで使用するか、Application Gateway やサードパーティ ソリューションなどのファイアウォール機能が組み込まれているリソースで使用することです。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "安全"
+ "text": "Azure ディスクと AZ を使用する場合は、適切なゾーンにストレージをプロビジョニングするために VolumeBindingMode:WaitForFirstConsumer を使用して LRS ディスクのゾーン内にノードプールを配置するか、複数のゾーンにまたがるノードプールに ZRS ディスクを使用することを検討してください",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
- "severity": "中程度",
- "text": "Virtual WAN は、Azure リージョンとオンプレミスの場所間でグローバルなトランジット接続が必要な新しいネットワーク、大規模ネットワーク、またはグローバル ネットワークでの Azure デプロイに使用します。このアプローチでは、Azure ネットワークの推移的なルーティングを手動で設定する必要がなく、SAP on Azure デプロイの標準に従うことができます。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "高い",
+ "text": "2 つのレプリカで読み取り操作の可用性を 99.9% にする",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "中程度",
- "text": "データ漏えいを防ぐには、Azure Private Link を使用して、Azure Blob Storage、Azure Files、Azure Data Lake Storage Gen2、Azure Data Factory などのサービスとしてのプラットフォーム リソースに安全にアクセスします。Azure プライベート エンドポイントは、VNet と Azure Storage、Azure Backup などのサービス間のトラフィックをセキュリティで保護するのにも役立ちます。VNet とプライベート エンドポイント対応サービス間のトラフィックは、Microsoft グローバル ネットワークを経由するため、パブリック インターネットに公開されるのを防ぎます。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
- "waf": "安全"
+ "text": "3 つのレプリカで読み取り/書き込み操作の可用性を 99.9% に向上させる",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
"severity": "高い",
- "text": "SAP アプリケーションと DBMS レイヤーで使用される VM で Azure 高速ネットワークが有効になっていることを確認します。",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "パフォーマンス"
+ "text": "読み取りレプリカや書き込みレプリカを有効にすることでアベイラビリティーゾーンを活用する",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "中程度",
- "text": "Azure Load Balancer の内部デプロイが Direct Server Return (DSR) を使用するように設定されていることを確認します。この設定 (フローティング IP の有効化) は、DBMS レイヤーの高可用性構成に内部ロード バランサー構成を使用する場合のレイテンシを短縮します。",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "安全"
+ "text": "リージョンの冗長性については、地理的リージョン間で検索インデックスをレプリケートする自動化された方法が提供されないため、検索用に 2 つ以上のリージョンにサービスを手動で作成します",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"severity": "中程度",
- "text": "アプリケーション セキュリティ グループ (ASG) ルールと NSG ルールを使用して、SAP アプリケーションと DBMS レイヤー間のネットワーク セキュリティ アクセス制御リストを定義できます。ASG は、セキュリティの管理に役立つ仮想マシンをグループ化します。",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "高い",
- "text": "ピアリングされていない異なる Azure VNet に SAP アプリケーション レイヤーと SAP DBMS を配置することはサポートされていません。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "パフォーマンス"
+ "text": "複数のサービス間でデータを同期するには、複数のサービスでコンテンツを更新するためにインデクサーを使用するか、複数のサービスでコンテンツの更新をプッシュするために REST API を使用する",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"severity": "中程度",
- "text": "SAP アプリケーションでのネットワーク待機時間を最適化するには、Azure 近接通信配置グループの使用を検討してください。",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "パフォーマンス"
+ "text": "Azure Traffic Manager を使用して要求を調整する",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "高い",
- "text": "オンプレミスと Azure の間で分割された SAP アプリケーション サーバー レイヤーと DBMS レイヤーの実行はまったくサポートされていません。どちらのレイヤーも、オンプレミスまたは Azure に完全に存在する必要があります。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "パフォーマンス"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"severity": "高い",
- "text": "データベース管理システム (DBMS) と SAP システムのアプリケーション層を異なる VNet でホストし、それらを VNet ピアリングで接続することは、層間の過剰なネットワーク トラフィックによって大きなコストが発生する可能性があるため、お勧めしません。Azure 仮想ネットワーク内のサブネットを使用して、SAP アプリケーション レイヤーと DBMS レイヤーを分離することをお勧めします。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "費用"
+ "text": "Azure Cognitive Search インデックスをバックアップおよび復元します。このサンプル コードを使用して、インデックス定義とスナップショットを一連の Json ファイルにバックアップします",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
- "severity": "高い",
- "text": "Linux ゲスト・オペレーティング・システムで Load Balancer を使用する場合は、Linux ネットワーク・パラメーター net.ipv4.tcp_timestamps が 0 に設定されていることを確認します。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
+ "severity": "中程度",
+ "text": "Azure ランディング ゾーン接続リソースを複数のリージョンにデプロイして、複数リージョンのアプリケーション ランディング ゾーンとディザスター リカバリー シナリオを迅速にサポートできるようにします。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"severity": "中程度",
- "text": "SAP RISE/ECS デプロイの場合、仮想ピアリングは、お客様の既存の Azure 環境との接続を確立するための推奨される方法です。SAP vnet と顧客 vnet はどちらもネットワーク セキュリティ グループ (NSG) で保護されているため、vnet ピアリングを介して SAP ポートとデータベース ポートで通信できます",
- "waf": "安全"
+ "text": "Azure リソースの管理には 1 つの Entra テナントを使用します (マルチテナントに対する明確な規制要件やビジネス要件がない限り)。",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "高い",
- "text": "Azure VM の SAP HANA データベースのバックアップを確認します。",
- "waf": "費用"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "低い",
+ "text": "マルチテナント自動化アプローチを使用して、Microsoft Entra ID テナントを管理します。",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "severity": "中程度",
- "text": "Site Recovery の組み込み監視 (SAP に使用されている場所) を確認します。",
- "waf": "費用"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "高い",
+ "text": "同じ ID でマルチテナント管理に Azure Lighthouse を使用します。",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"severity": "高い",
- "text": "SAP HANA システムランドスケープの監視のガイダンスを確認します。",
- "waf": "オペレーションズ"
+ "text": "テナントを管理するためのアクセス権をパートナーに付与する場合は、Azure Lighthouse を使用します。",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
- "severity": "中程度",
- "text": "Azure Linux VM のバックアップ戦略で Oracle Database を確認します。",
- "waf": "オペレーションズ"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "severity": "高い",
+ "text": "クラウド運用モデルに合わせた RBAC モデルを適用します。管理グループとサブスクリプション全体のスコープと割り当て。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"severity": "中程度",
- "text": "SQL Server 2016 での Azure Blob Storage の使用を確認します。",
- "waf": "オペレーションズ"
+ "text": "すべてのアカウントの種類に対して、認証の種類である [職場または学校アカウント] のみを使用します。Microsoftアカウントの使用は避けてください",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
"severity": "中程度",
- "text": "Azure VM の自動バックアップ v2 の使用を確認します。",
- "waf": "オペレーションズ"
+ "text": "権限の割り当てには、グループのみを使用してください。グループ管理システムがすでに導入されている場合は、オンプレミス グループを Entra ID のみのグループに追加します。",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"severity": "高い",
- "text": "Premium ディスク使用時の M シリーズの書き込みアクセラレータの有効化 (V1)",
- "waf": "オペレーションズ"
+ "text": "Azure 環境に対する権限を持つすべてのユーザーに対して、Microsoft Entra ID 条件付きアクセス ポリシーを適用します。",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
- "severity": "中程度",
- "text": "可用性ゾーンの待機時間をテストします。",
- "waf": "パフォーマンス"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "高い",
+ "text": "Azure 環境に対する権限を持つすべてのユーザーに多要素認証を適用します。",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
"severity": "中程度",
- "text": "すべての SAP コンポーネントに対して SAP EarlyWatch Alert を有効化します。",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "パフォーマンス"
+ "text": "Microsoft Entra ID Privileged Identity Management (PIM) を適用して、ゼロスタンディング アクセスと最小特権を確立します。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "中程度",
- "text": "SAP ABAPMeter レポート /SSA/CAT を使用して、SAP アプリケーション サーバーとデータベース サーバー間の待機時間を確認します。",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "パフォーマンス"
+ "text": "Active Directory Domain Services から Entra ドメイン サービスへの切り替えを計画している場合は、すべてのワークロードの互換性を評価します。",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "中程度",
- "text": "CCMS を使用した SQL Server パフォーマンス監視を確認します。",
- "waf": "パフォーマンス"
+ "text": "Microsoft Entra Domain Services を使用する場合は、レプリカ セットを使用します。レプリカ セットを使用すると、マネージド ドメインの回復性が向上し、追加のリージョンにデプロイできるようになります。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"severity": "中程度",
- "text": "SAP アプリケーション レイヤー VM と DBMS VM 間のネットワーク遅延をテストします (NIPING)。",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "パフォーマンス"
+ "text": "Microsoft Entra ID ログをプラットフォーム中央の Azure Monitor と統合します。Azure Monitor を使用すると、Azure のログと監視データに関する信頼できる唯一の情報源を使用できるため、ログの収集と保持に関する要件を満たすためのクラウド ネイティブ オプションを組織に提供できます。",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
- "severity": "中程度",
- "text": "SAP HANA Studio のアラートを確認します。",
- "waf": "パフォーマンス"
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "高い",
+ "text": "テナント全体のアカウント ロックアウトを防ぐために、緊急アクセスまたは非常用アカウントを実装します。MFA は、2024 年 10 月にすべてのユーザーに対してデフォルトで有効になります。これらのアカウントを更新して、パスキー (FIDO2) を使用するか、MFA の証明書ベースの認証を構成することをお勧めします。",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"severity": "中程度",
- "text": "HANA_Configuration_Minichecksを使用して SAP HANA ヘルスチェックを実行します。",
- "waf": "パフォーマンス"
+ "text": "特に必要なシナリオがない限り、Microsoft Entra ID ロールの割り当てにオンプレミスの同期アカウントを使用しないでください。",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"severity": "中程度",
- "text": "Azure、オンプレミス、またはその他のクラウド環境で Windows VM と Linux VM を実行している場合は、Azure Automation の更新管理センターを使用して、セキュリティ パッチを含むオペレーティング システムの更新プログラムを管理できます。",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "text": "Microsoft Entra ID アプリケーション プロキシを使用してリモート ユーザーにアプリケーションへのアクセス権を付与する場合は、テナントごとに 1 つのインスタンスしか持つことができないため、プラットフォーム リソースとして管理します。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"severity": "中程度",
- "text": "SAP は、SAP システムを保護するために即時のアクションが必要な非常に重要なセキュリティパッチ (ホットフィックス) をリリースするため、SAP セキュリティ OSS ノートを定期的に確認してください。",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "低い",
- "text": "SQL Server 上の SAP システムではアカウントが使用されないため、SQL Server on SQL Server システム管理者アカウントを無効にすることができます。元のシステム管理者アカウントを無効にする前に、システム管理者権限を持つ別のユーザーがサーバーにアクセスできることを確認してください。",
+ "text": "ハブアンドスポークネットワークトポロジは、最大限の柔軟性を必要とするネットワークシナリオに使用します。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"severity": "高い",
- "text": "xp_cmdshellを無効にします。SQL Server 機能xp_cmdshellは、SQL Server 内部オペレーティング システム コマンド シェルを有効にします。これは、セキュリティ監査における潜在的なリスクです。",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "安全"
+ "text": "ExpressRoute ゲートウェイ、VPN ゲートウェイ、Azure Firewall またはパートナー NVA などの共有ネットワーク サービスを中央ハブ仮想ネットワークにデプロイします。必要に応じて、DNS サービスもデプロイします。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "費用"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"severity": "高い",
- "text": "Azure 上の SAP HANA データベース サーバーの暗号化には、SAP HANA ネイティブの暗号化テクノロジが使用されます。さらに、Azure で SQL Server を使用している場合は、Transparent Data Encryption (TDE) を使用してデータとログ ファイルを保護し、バックアップも暗号化されるようにします。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して、DDoS ネットワークまたは IP 保護プランを使用します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"severity": "中程度",
- "text": "Azure Storage の暗号化は、すべての Azure Resource Manager アカウントとクラシック ストレージ アカウントに対して有効になっており、無効にすることはできません。データは既定で暗号化されるため、Azure Storage の暗号化を使用するためにコードやアプリケーションを変更する必要はありません。",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "text": "パートナー ネットワーク テクノロジまたは NVA をデプロイする場合は、パートナー ベンダーのガイダンスに従ってください。",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "低い",
+ "text": "ハブ アンド スポークのシナリオで ExpressRoute ゲートウェイと VPN ゲートウェイ間のトランジットが必要な場合は、Azure Route Server を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
- "severity": "高い",
- "text": "Azure Key Vault を使用してシークレットと資格情報を格納する",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "低い",
+ "text": "Route Server を使用する場合は、Route Server サブネットに /27 プレフィックスを使用します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"severity": "中程度",
- "text": "デプロイが成功したら、承認されていない変更から保護するために、Azure リソースをロックすることをお勧めします。また、カスタマイズされた Azure ポリシー (カスタム ロール) を使用して、サブスクリプションごとに LOCK 制約とルールを適用することもできます。",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "安全"
+ "text": "Azure リージョン間で複数のハブ アンド スポーク トポロジを持つネットワーク アーキテクチャの場合は、ハブ VNet 間でグローバル仮想ネットワーク ピアリングを使用して、リージョンを相互に接続します。",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"severity": "中程度",
- "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "安全"
+ "text": "Azure Monitor for Networks を使用して、Azure 上のネットワークのエンドツーエンドの状態を監視します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
- "severity": "高い",
- "text": "既存の要件、規制、コンプライアンス制御 (内部/外部) に基づいて - 必要な Azure ポリシーと Azure RBAC ロールを決定します",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "中程度",
+ "text": "リージョンに 400 を超えるスポーク ネットワークがある場合は、VNet ピアリングの制限 (500) と ExpressRoute 経由でアドバタイズできるプレフィックスの最大数 (1000) をバイパスするために、追加のハブをデプロイします。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "中程度",
+ "text": "ルート テーブルあたりのルート数を 400 に制限します。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
"severity": "高い",
- "text": "SAP 環境でMicrosoft Defender for Endpointを有効にする場合は、すべてのサーバーをターゲットにするのではなく、DBMS サーバー上のデータ ファイルとログ ファイルを除外することをお勧めします。ターゲット ファイルを除外する場合は、DBMS ベンダーの推奨事項に従ってください。",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
- "waf": "安全"
+ "text": "VNet ピアリングを構成するときは、\"リモート仮想ネットワークへのトラフィックを許可する\" 設定を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"severity": "高い",
- "text": "Microsoft Defender for Cloud の Just-In-Time アクセス権を持つ SAP 管理者カスタム ロールを委任します。",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "waf": "安全"
+ "text": "Standard Load Balancer SKU をゾーン冗長デプロイで使用すると、Standard SKU Load Balancer を選択すると、可用性ゾーンとゾーンの回復性によって信頼性が向上し、デプロイがゾーンとリージョンの障害に耐えられるようになります。Basic とは異なり、グローバル負荷分散をサポートし、SLA を提供します。",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "低い",
- "text": "サードパーティのセキュリティ製品を DIAG (SAP GUI)、RFC、HTTPS の SPNEGO の Secure Network Communications (SNC) と統合することで、転送中のデータを暗号化します。",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
- "waf": "安全"
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "高い",
+ "text": "Load Balancer バックエンド プールに少なくとも 2 つのインスタンスが含まれていることを確認し、バックエンドに少なくとも 2 つのインスタンスがある Azure Load Balancers をデプロイすると、単一障害点が防止され、スケーラビリティがサポートされます。",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "プリンシパル暗号化機能には Microsoft マネージド キーが既定で設定され、必要に応じてカスタマー マネージド キーが使用されます。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "ExpressRoute Direct を使用している場合は、組織のルーターと MSEE の間のレイヤー 2 レベルでトラフィックを暗号化するために MACsec を構成します。この図は、フロー内のこの暗号化を示しています。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "高い",
- "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "MACsec がオプションではないシナリオ (ExpressRoute Direct を使用しない場合など) は、VPN ゲートウェイを使用して、ExpressRoute プライベート ピアリング経由で IPsec トンネルを確立します。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "HANA 以外の Windows および Windows 以外のオペレーティング システムのディスク暗号化キーとシークレットを制御および管理するには、Azure Key Vault を使用します。SAP HANA は Azure Key Vault ではサポートされていないため、SAP ABAP キーや SSH キーなどの別の方法を使用する必要があります。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "text": "Azure リージョンとオンプレミスの場所間で重複する IP アドレス空間が使用されていないことを確認します。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
- "severity": "高い",
- "text": "SAP on Azure スポーク サブスクリプションのロールベースのアクセス制御 (RBAC) ロールをカスタマイズして、ネットワーク関連の偶発的な変更を回避する",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "中程度",
+ "text": "プライベートインターネットのアドレス割り当て範囲(RFC 1918)のIPアドレスを使用します。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "高い",
- "text": "DMZ と NVA を他の SAP 資産から分離し、Azure Private Link を構成し、SAP on Azure リソースを安全に管理および制御します",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "低い",
- "text": "Azure で Microsoft マルウェア対策ソフトウェアを使用して、悪意のあるファイル、アドウェア、その他の脅威から仮想マシンを保護することを検討してください。",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
- "waf": "安全"
+ "text": "IP アドレス空間が無駄にならないようにし、不必要に大規模な仮想ネットワーク (/16 など) を作成しないでください。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "パフォーマンス"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "低い",
- "text": "さらに強力な保護を行うには、Microsoft Defender for Endpoint の使用を検討してください。",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "高い",
+ "text": "運用サイトとディザスター リカバリー サイトで重複する IP アドレス範囲を使用しないでください。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
"severity": "高い",
- "text": "仮想ネットワーク ピアリングによってスポーク ネットワークに接続されているハブ仮想ネットワークを介してすべてのトラフィックを通過させることにより、SAP アプリケーション サーバーとデータベース サーバーをインターネットまたはオンプレミス ネットワークから分離します。ピアリングされた仮想ネットワークにより、SAP on Azure ソリューションがパブリック インターネットから分離されることが保証されます。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
- "waf": "安全"
+ "text": "Standard SKU とゾーン冗長 IP を使用する (該当する場合)、Azure のパブリック IP アドレスは Standard SKU であり、非ゾーン、ゾーン、またはゾーン冗長として使用できます。ゾーン冗長 IP は、すべてのゾーンでアクセス可能であり、1 つのゾーンの障害に耐えるため、回復性が向上します。",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "waf": "確実"
},
{
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "低い",
- "text": "SAP Fiori のようなインターネットに接続するアプリケーションの場合は、セキュリティレベルを維持しながら、アプリケーション要件ごとに負荷を分散してください。レイヤー 7 セキュリティのために、Azure Marketplace で入手できるサードパーティの Web アプリケーション ファイアウォール (WAF) を使用できます。",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
+ "severity": "中程度",
+ "text": "Azure での名前解決が必要な環境では、Azure プライベート DNS を使用して解決し、名前解決に委任されたゾーン ('azure.contoso.com' など) を使用します。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "オペレーションズ"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
"severity": "中程度",
- "text": "Azure Monitor for SAP solutions でセキュリティで保護された通信を有効にするには、ルート証明書またはサーバー証明書のどちらを使用するかを選択できます。ルート証明書を使用することを強くお勧めします。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Azure とオンプレミス間での名前解決が必要で、Active Directory のような既存のエンタープライズ DNS サービスがない環境の場合は、Azure DNS Private Resolver を使用して DNS 要求を Azure またはオンプレミスの DNS サーバーにルーティングします。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
- "severity": "高い",
- "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "severity": "高い",
- "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "低い",
+ "text": "独自の DNS が必要でデプロイする特別なワークロード (Red Hat OpenShift など) は、優先する DNS ソリューションを使用する必要があります。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
"severity": "高い",
- "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
- "waf": "確実"
+ "text": "Azure DNS の自動登録を有効にすると、仮想ネットワーク内にデプロイされた仮想マシンの DNS レコードのライフサイクルが自動的に管理されます。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
- "severity": "高い",
- "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
+ "severity": "中程度",
+ "text": "複数の Azure リージョン間の DNS 解決を管理し、サービスが別のリージョンにフェールオーバーするときの計画を実装します",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
"severity": "中程度",
- "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護",
- "waf": "オペレーションズ"
+ "text": "Azure Bastion を使用して、ネットワークに安全に接続します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"severity": "中程度",
- "text": "「ストレージの Azure セキュリティ ベースライン」を検討する",
+ "text": "Azure Bastion は、/26 以上のサブネットで使用します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Azure Storage は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースのみに Azure Storage を安全に公開できるため、パブリック インターネットへの露出がなくなります",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "Azure Storage のプライベート エンドポイントの使用を検討する",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "中程度",
+ "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン間でグローバルな保護を提供します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "新しく作成されたストレージ アカウントは ARM デプロイ モデルを使用して作成されるため、RBAC、監査などがすべて有効になります。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認します",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "古いストレージ アカウントが \"クラシック デプロイ モデル\" を使用していないことを確認する",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "低い",
+ "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door の WAF ポリシーを使用します。Azure Application Gateway をロックダウンして、Azure Front Door からのトラフィックのみを受信するようにします。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"severity": "高い",
- "text": "すべてのストレージ アカウントで Microsoft Defender を有効にする",
+ "text": "受信 HTTP/S 接続に WAF やその他のリバース プロキシが必要な場合は、ランディング ゾーン仮想ネットワーク内にデプロイし、保護してインターネットに公開するアプリと共にデプロイします。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "論理的な削除メカニズムにより、誤って削除されたブロブを回復できます。",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "BLOB の '論理的な削除' を有効にする",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "高い",
+ "text": "Azure DDoS ネットワークまたは IP Protection プランを使用して、仮想ネットワーク内のパブリック IP アドレス エンドポイントを保護します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "BLOB の '論理的な削除' を無効にする",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "高い",
+ "text": "ネットワークの送信トラフィックの構成と戦略を管理する方法を、今後の破壊的変更の前に計画します。2025 年 9 月 30 日に、新しいデプロイの既定の送信アクセスは廃止され、明示的なアクセス構成のみが許可されます。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "コンテナの論理的な削除を使用すると、コンテナが削除された後に、たとえば、誤って削除した操作から回復するなどして、コンテナを回復できます。",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "コンテナの「論理的な削除」を有効にする",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "コンテナの「論理的な削除」を無効にする",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "削除する前に、ユーザーに削除ロックを最初に解除するように強制することで、ストレージ アカウントが誤って削除されるのを防ぎます",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
"severity": "高い",
- "text": "ストレージ アカウントでのリソース ロックの有効化",
+ "text": "診断設定を追加して、保護されたすべてのパブリック IP アドレス (DDoS IP またはネットワーク保護) の DDoS 関連のログを保存します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変 BLOB が含まれている場合、そのストレージ アカウントを \"削除\" する唯一の方法は、Azure サブスクリプションをキャンセルすることです。",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
"severity": "高い",
- "text": "不変ブロブについて考える",
+ "text": "Virtual Machines に直接関連付けられているパブリック IP アドレスを拒否するポリシーの割り当てがあることを確認します。 特定の VM でパブリック IP が必要な場合は、除外を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "ExpressRoute を Azure へのプライマリ接続として使用します。 バックアップ接続のソースとして VPN を使用します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要がある場合があります。",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "AS パスの先頭と接続の重みを使用して Azure からオンプレミスへのトラフィックに影響を与えたり、独自のルーターの BGP 属性の全範囲を使用してオンプレミスから Azure へのトラフィックに影響を与えたりできます。",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "複数の ExpressRoute 回線または複数のオンプレミスの場所を使用する場合は、BGP 属性を使用してルーティングを最適化します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報の損失リスクを最小限に抑えるのに役立ちます。",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
- "waf": "安全"
+ "text": "ExpressRoute/VPN ゲートウェイの適切な SKU は、帯域幅とパフォーマンスの要件に基づいて選択してください。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ".最新の TLS バージョンを適用すると、古いバージョンを使用しているクライアントからの要求が拒否されます。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "ストレージ アカウントに最新の TLS バージョンを適用する",
- "waf": "安全"
+ "text": "無制限のデータ ExpressRoute 回線を使用しているのは、そのコストを正当化する帯域幅に達した場合にのみしてください。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "費用"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Entra ID トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "BLOB アクセスに Microsoft Entra ID トークンを使用する",
- "waf": "安全"
+ "text": "ExpressRoute のローカル SKU を活用して、回線のコストを削減します (回線ピアリングの場所がローカル SKU の Azure リージョンをサポートしている場合)。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "費用"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをそのセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のある誤用の両方を防ぐことができます。",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "IaM アクセス許可の最小特権",
- "waf": "安全"
+ "text": "ゾーン冗長 ExpressRoute ゲートウェイをサポートされている Azure リージョンにデプロイします。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によって保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "10 Gbps を超える帯域幅または専用の 10/100 Gbps ポートが必要なシナリオでは、ExpressRoute Direct を使用します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰が/いつキーのコピーをフェッチしたかを監視することはできますが、キーが複数の人の手に渡ると、特定のユーザーに使用状況を帰属させることはできなくなります。Entra ID認証のみに依存すると、ストレージアクセスをユーザーに結び付けることが容易になります。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "Microsoft Entra ID アクセス (およびユーザー委任 SAS) のみがサポートされるように、ストレージ アカウント キーを無効にすることを検討してください。",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "待機時間を短くする必要がある場合、またはオンプレミスから Azure へのスループットを 10 Gbps より大きくする必要がある場合は、FastPath を有効にして、データ パスから ExpressRoute ゲートウェイをバイパスします。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティが (ストレージ アカウント キー、アクセス ポリシーなど) 表示または変更されているのは「いつ」、「誰が」、「何を」、「どのように」特定します。",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "Azure Monitor を使用して、ストレージ アカウントでのコントロール プレーン操作を監査することを検討してください",
- "waf": "安全"
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
+ "severity": "中程度",
+ "text": "ゾーン冗長 VPN ゲートウェイを使用して、ブランチまたはリモートの場所を Azure (使用可能な場合) に接続します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "キーの有効期限ポリシーを使用すると、アカウント アクセス キーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"severity": "中程度",
- "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
- "waf": "安全"
+ "text": "オンプレミスで冗長な VPN アプライアンス (アクティブ/アクティブまたはアクティブ/パッシブ) を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS 有効期限ポリシーは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーが、推奨間隔よりも長い有効期間でサービス SAS またはアカウント SAS を生成すると、警告が表示されます。",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "SAS 有効期限ポリシーの構成を検討する",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "severity": "高い",
+ "text": "ExpressRoute Direct を使用する場合は、コストを節約するために、ローカル Azure リージョンへの ExpressRoute ローカル回線を使用することを検討してください。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "費用"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "保存されているアクセス ポリシーでは、ストレージ アカウント キーを再生成しなくても、サービス SAS のアクセス許可を取り消すことができます。",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "SASを保存されたアクセスポリシーにリンクすることを検討する",
+ "text": "運用環境と非運用環境を分離する場合など、トラフィックの分離または専用の帯域幅が必要な場合は、異なる ExpressRoute 回線を使用します。これにより、ルーティングドメインを分離し、ノイズの多い隣人のリスクを軽減できます。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するように、アプリケーションのソース コード リポジトリを構成することを検討してください。",
- "waf": "安全"
+ "text": "ExpressRoute の可用性と使用率は、組み込みの Express Route Insights を使用して監視します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに持つことを検討してください。",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "接続モニターは、ネットワーク全体 (特にオンプレミスと Azure の間) の接続監視に使用します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "オペレーションズ"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "冗長性を確保するために、さまざまなピアリングの場所から ExpressRoute 回線を使用します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "ExpressRoute 回線を 1 つだけ使用する場合は、ExpressRoute のフェールオーバーとしてサイト間 VPN を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "Azure KeyVault に接続文字列を格納することを検討してください (マネージド ID が不可能なシナリオの場合)",
- "waf": "安全"
+ "text": "GatewaySubnet でルート テーブルを使用している場合は、ゲートウェイ ルートが伝達されていることを確認してください。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "アドホック SAS サービス SAS またはアカウント SAS で短期的な有効期限を使用します。このように、SASが侵害された場合でも、SASは短時間しか有効ではありません。この方法は、保存されたアクセス ポリシーを参照できない場合に特に重要です。有効期限が近いと、BLOB にアップロードできる時間を制限することで、BLOB に書き込むことができるデータの量も制限されます。",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "アドホックSASの有効期間を短くするよう努める",
- "waf": "安全"
+ "text": "ExpressRoute を使用する場合、オンプレミスのルーティングは動的である必要があり、接続エラーが発生した場合は、回線の残りの接続に収束する必要があります。負荷は、アクティブ/アクティブとして両方の接続で共有するのが理想的ですが、アクティブ/パッシブもサポートされています。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SASを作成するときは、できるだけ具体的で制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "SAS に狭いスコープを適用する",
- "waf": "安全"
+ "text": "ExpressRoute 回線の 2 つの物理リンクが、ネットワーク内の 2 つの異なるエッジ デバイスに接続されていることを確認します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS には、SAS を使用してリソースを要求する権限を与えられたクライアントの IP アドレスまたはアドレス範囲のパラメーターを含めることができます。",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
- "waf": "安全"
+ "text": "BFD(Bidirectional Forwarding Detection)が顧客またはプロバイダのエッジルーティングデバイスで有効で設定されていることを確認します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS は、クライアントがアップロードするデータの量を制限することはできません。時間の経過に伴うストレージ量の価格設定モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "低い",
- "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "高い",
+ "text": "ExpressRoute ゲートウェイを異なるピアリングの場所から 2 つ以上の回線に接続すると、回復性が向上します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "「ローカル ユーザー アカウント」を使用して SFTP 経由で BLOB ストレージにアクセスする場合、「通常の」RBAC コントロールは適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式は、ローカル ユーザーのみです",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "SFTP: SFTP アクセスの「ローカル ユーザー」の数を制限し、アクセスが必要かどうかを経時的に監査します。",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "中程度",
+ "text": "ExpressRoute 仮想ネットワーク ゲートウェイの診断ログとアラートを構成します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "SFTP: SFTP エンドポイントは POSIX のような ACL をサポートしていません。",
- "waf": "安全"
+ "text": "VNet 間通信に ExpressRoute 回線を使用しないでください。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "ストレージは、CORS(Cross-Origin Resource Sharing)、つまり、異なるドメインのWebアプリが同一生成元ポリシーを緩和できるようにするHTTP機能をサポートしています。CORS を有効にするときは、CorsRules を最小限の特権に保ちます。",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "過度に広範なCORSポリシーを避ける",
- "waf": "安全"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "低い",
+ "text": "検査のために Azure トラフィックをハイブリッドの場所に送信しないでください。 代わりに、Azure のリソース間の通信が Microsoft バックボーン ネットワーク経由で行われるように、\"Azure のトラフィックは Azure にとどまる\" という原則に従います。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム管理キー (デフォルト) またはカスタマー管理キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure ストレージに提供するか、クライアント側で暗号化を完全に処理することによって行われます。したがって、機密性の保証については Azure Storage にまったく依存しません。",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
"severity": "高い",
- "text": "保存データの暗号化方法を決定します。データのスレッドモデルを理解する。",
+ "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルタリング (組織で必要な場合) を管理します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "中程度",
- "text": "プラットフォームの暗号化を使用するかどうかを決定します。",
+ "text": "グローバル ネットワーク環境全体のセキュリティ体制を管理するためのグローバル Azure Firewall ポリシーを作成し、それをすべての Azure Firewall インスタンスに割り当てます。Azure のロールベースのアクセス制御を介して、増分ファイアウォール ポリシーをローカル セキュリティ チームに委任することで、特定のリージョンの要件を満たすためのきめ細かなポリシーを可能にします。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "クライアント側の暗号化を使用するかどうかを決定します。",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "低い",
+ "text": "サポートされているパートナー SaaS セキュリティプロバイダーを Firewall Manager 内で構成します。これは、組織がアウトバウンド接続を保護するためにそのようなソリューションを使用する場合です。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを見つけます。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
"severity": "高い",
- "text": "パブリック BLOB の匿名アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
+ "text": "アプリケーション・ルールを使用して、サポートされているプロトコルの宛先ホスト名でアウトバウンド・トラフィックをフィルタリングします。 FQDN ベースのネットワーク規則と Azure Firewall と DNS プロキシを使用して、他のプロトコル経由でインターネットへのエグレス トラフィックをフィルター処理します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
"severity": "高い",
- "text": "storagev2 アカウントタイプを活用して、パフォーマンスと信頼性を向上させます",
- "waf": "確実"
+ "text": "Azure Firewall Premium を使用して、追加のセキュリティ機能を有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
"severity": "高い",
- "text": "GRS、ZRS、またはGZRSストレージを活用して、最高の可用性を実現",
- "waf": "確実"
+ "text": "Azure Firewall の脅威インテリジェンス モードを [アラート] と [拒否] に構成して、保護を強化します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "フェールオーバー後の書き込み操作には、顧客管理のフェールオーバーを使用します",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "高い",
+ "text": "Azure Firewall の IDPS モードを [拒否] に構成して、保護を強化します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "Microsoft マネージド フェールオーバーの詳細を理解する",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "高い",
+ "text": "Virtual WAN に接続されていない VNet 内のサブネットの場合は、インターネット トラフィックが Azure Firewall またはネットワーク仮想アプライアンスにリダイレクトされるようにルート テーブルをアタッチします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"severity": "中程度",
- "text": "ソフト削除を有効にする",
- "waf": "確実"
+ "text": "診断設定を追加して、リソース固有の宛先テーブルを使用して、すべての Azure Firewall デプロイのログを保存します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
- "severity": "中程度",
- "text": "Azure Data Factory の FTA 回復性プレイブックの活用",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "severity": "高い",
+ "text": "Azure Firewall クラシック ルール (存在する場合) からファイアウォール ポリシーに移行します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "高い",
- "text": "Availability Zones をサポートするリージョンでゾーン冗長パイプラインを使用するUse zone redundant pipelines in regions that support Availability Zones",
- "waf": "確実"
+ "text": "Azure Firewall サブネットに /26 プレフィックスを使用します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
"severity": "中程度",
- "text": "DevOps を使用して Github と Azure DevOps の統合で ARM テンプレートをバックアップする",
- "waf": "確実"
+ "text": "ファイアウォールポリシー内のルールを、使用頻度に基づいて「ルールコレクショングループ」と「ルールコレクション」に整理します。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
"severity": "中程度",
- "text": "セルフホステッド統合ランタイム VM を別のリージョンにレプリケートしてください",
- "waf": "確実"
+ "text": "IP グループまたは IP プレフィックスを使用して、IP テーブル・ルールの数を減らします。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
"severity": "中程度",
- "text": "必ず、姉妹リージョンでネットワークをレプリケートまたは複製してください。別のリージョンに VNet のコピーを作成する必要があります",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "ADF パイプラインで Key Vault が使用されている場合は、Key Vault をレプリケートするために何もする必要はありません。Key Vault はマネージド サービスであり、Microsoft が処理します",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
- "severity": "低い",
- "text": "Keyvault 統合を使用している場合は、Keyvault の SLA を使用して可用性を把握します",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "高い",
- "text": "2 つのレプリカで読み取り操作の可用性を 99.9% にする",
- "waf": "確実"
+ "text": "DNATSのソースIPとしてワイルドカード(*やanyなど)を使用せず、受信DNATのソースIPを指定する必要があります。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
"severity": "中程度",
- "text": "3 つのレプリカで読み取り/書き込み操作の可用性を 99.9% に向上させる",
- "waf": "確実"
+ "text": "SNAT ポートの使用状況を監視し、NAT ゲートウェイの設定を評価し、シームレスなフェールオーバーを確保することで、SNAT ポートの枯渇を防ぎます。ポート数が制限に近づく場合は、SNAT の枯渇が差し迫っている可能性があります。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"severity": "高い",
- "text": "読み取りレプリカや書き込みレプリカを有効にすることでアベイラビリティーゾーンを活用する",
- "waf": "確実"
+ "text": "Azure Firewall Premium を使用している場合は、TLS 検査を有効にします。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "中程度",
- "text": "リージョンの冗長性については、地理的リージョン間で検索インデックスをレプリケートする自動化された方法が提供されないため、検索用に 2 つ以上のリージョンにサービスを手動で作成します",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "低い",
+ "text": "Web カテゴリを使用して、特定のトピックへの送信アクセスを許可または拒否します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
"severity": "中程度",
- "text": "複数のサービス間でデータを同期するには、複数のサービスでコンテンツを更新するためにインデクサーを使用するか、複数のサービスでコンテンツの更新をプッシュするために REST API を使用する",
- "waf": "確実"
+ "text": "TLS 検査の一環として、Azure App Gateway からのトラフィックの受信を検査用に計画します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
"severity": "中程度",
- "text": "Azure Traffic Manager を使用して要求を調整する",
- "waf": "確実"
+ "text": "Azure Firewall DNS プロキシ構成を有効にします。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "高い",
- "text": "Azure Cognitive Search インデックスをバックアップおよび復元します。このサンプル コードを使用して、インデックス定義とスナップショットを一連の Json ファイルにバックアップします",
- "waf": "確実"
+ "text": "Azure Firewall を Azure Monitor と統合し、診断ログを有効にして、ファイアウォールのログとメトリックを格納および分析します。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "高い",
- "text": "ビジネスとSLOの要件に基づいて適切な関数ホスティングプランを選択します",
- "waf": "確実"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "低い",
+ "text": "ファイアウォールルールのバックアップを実装する",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"severity": "高い",
- "text": "リージョンで適用可能な場合は Availability Zones を活用します (従量課金レベルでは使用できません)",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
- "severity": "中程度",
- "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
+ "text": "Azure Firewall を複数の可用性ゾーンにデプロイします。Azure Firewall は、そのデプロイに応じて異なる SLA を提供します。1 つの可用性ゾーンまたは複数の可用性ゾーンで、信頼性とパフォーマンスが向上する可能性があります。",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "高い",
- "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
+ "text": "Azure Firewall VNet で DDoS Protection を構成し、DDoS Protection プランを Azure Firewall をホストしている仮想ネットワークに関連付けて、DDoS 攻撃に対する軽減を強化します。Azure Firewall Manager は、ファイアウォール インフラストラクチャと DDoS 保護プランの作成を統合します。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"severity": "高い",
- "text": "App Service プランで実行されているすべての関数アプリで \"Always On\" が有効になっていることを確認する",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
- "severity": "中程度",
- "text": "関数アプリを独自のストレージ アカウントにペアリングします。Function Apps のストレージ アカウントは、緊密に結合されていない限り、再利用しないようにしてください",
- "waf": "確実"
+ "text": "0.0.0.0/0 ルートやコントロール プレーン トラフィックをブロックする NSG ルールなど、仮想ネットワークに挿入された Azure PaaS サービスのコントロール プレーン通信を中断しないでください。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "中程度",
- "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、関数アプリのコードを保護します",
- "waf": "オペレーションズ"
+ "text": "オンプレミスからプライベート エンドポイントと ExpressRoute プライベート ピアリングを介して Azure PaaS サービスにアクセスします。この方法では、公共のインターネット経由のトランジットを回避できます。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.Network/virtualNetworks",
"checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
"service": "VNet",
- "severity": "中程度",
- "text": "Azure ランディング ゾーン接続リソースを複数のリージョンにデプロイして、複数リージョンのアプリケーション ランディング ゾーンとディザスター リカバリー シナリオを迅速にサポートできるようにします。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "確実"
+ "severity": "高い",
+ "text": "既定では、すべてのサブネットで仮想ネットワーク サービス エンドポイントを有効にしないでください。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/azureFirewalls",
"checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
"severity": "中程度",
- "text": "Azure リソースの管理には 1 つの Entra テナントを使用します (マルチテナントに対する明確な規制要件やビジネス要件がない限り)。",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
- "waf": "オペレーションズ"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "低い",
- "text": "マルチテナント自動化アプローチを使用して、Microsoft Entra ID テナントを管理します。",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "オペレーションズ"
+ "text": "Azure Firewall または NVA の IP アドレスではなく FQDN を使用して Azure PaaS サービスへのエグレス トラフィックをフィルター処理し、データの流出を防ぎます。Private Link を使用している場合は、すべての FQDN をブロックでき、それ以外の場合は必要な PaaS サービスのみを許可できます。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
+ "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
"severity": "高い",
- "text": "同じ ID でマルチテナント管理に Azure Lighthouse を使用します。",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
- "waf": "オペレーションズ"
+ "text": "Gateway サブネットには、少なくとも /27 プレフィックスを使用します。",
+ "waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
"checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"severity": "高い",
- "text": "テナントを管理するためのアクセス権をパートナーに付与する場合は、Azure Lighthouse を使用します。",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "費用"
+ "text": "VirtualNetwork サービス タグを使用して接続を制限する NSG 受信既定の規則に依存しないでください。",
+ "waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
"checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
- "severity": "高い",
- "text": "クラウド運用モデルに合わせた RBAC モデルを適用します。管理グループとサブスクリプション全体のスコープと割り当て。",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "severity": "中程度",
+ "text": "NSG を使用して、サブネット間のトラフィックと、プラットフォーム全体の East/West トラフィック (ランディング ゾーン間のトラフィック) を保護します。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
"checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
"severity": "中程度",
- "text": "すべてのアカウントの種類に対して、認証の種類である [職場または学校アカウント] のみを使用します。Microsoftアカウントの使用は避けてください",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "NSG とアプリケーション セキュリティ グループを使用して、ランディング ゾーン内のトラフィックをマイクロセグメント化し、中央の NVA を使用してトラフィック フローをフィルター処理しないようにします。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
"checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"severity": "中程度",
- "text": "権限の割り当てには、グループのみを使用してください。グループ管理システムがすでに導入されている場合は、オンプレミス グループを Entra ID のみのグループに追加します。",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "VNet フロー ログを有効にし、Traffic Analytics にフィードして、内部および外部のトラフィック フローに関する分析情報を取得します。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "安全"
},
{
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
"checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
- "severity": "高い",
- "text": "Azure 環境に対する権限を持つすべてのユーザーに対して、Microsoft Entra ID 条件付きアクセス ポリシーを適用します。",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "安全"
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "severity": "中程度",
+ "text": "1000 ルールの制限があるため、NSG ごとに 900 を超える NSG ルールを実装しないでください。",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "確実"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
- "severity": "高い",
- "text": "Azure 環境に対する権限を持つすべてのユーザーに多要素認証を適用します。",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "安全"
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "severity": "中程度",
+ "text": "Virtual WAN ルーティング設計の一覧にシナリオが明示的に説明されている場合は、Virtual WAN を使用します。",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "オペレーションズ"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
"severity": "中程度",
- "text": "Microsoft Entra ID Privileged Identity Management (PIM) を適用して、ゼロスタンディング アクセスと最小特権を確立します。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "text": "Azure リージョンごとに Virtual WAN ハブを使用して、共通のグローバル Azure Virtual WAN を介して Azure リージョン間で複数のランディング ゾーンを接続します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "パフォーマンス"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
"severity": "中程度",
- "text": "Active Directory Domain Services から Entra ドメイン サービスへの切り替えを計画している場合は、すべてのワークロードの互換性を評価します。",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "text": "送信インターネット トラフィックの保護とフィルタリングを行うには、セキュリティで保護されたハブに Azure Firewall をデプロイします。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
"severity": "中程度",
- "text": "Microsoft Entra Domain Services を使用する場合は、レプリカ セットを使用します。レプリカ セットを使用すると、マネージド ドメインの回復性が向上し、追加のリージョンにデプロイできるようになります。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "text": "Virtual WAN ネットワーク アーキテクチャが、特定されたアーキテクチャ シナリオと一致していることを確認します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "確実"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
"severity": "中程度",
- "text": "Microsoft Entra ID ログをプラットフォーム中央の Azure Monitor と統合します。Azure Monitor を使用すると、Azure のログと監視データに関する信頼できる唯一の情報源を使用できるため、ログの収集と保持に関する要件を満たすためのクラウド ネイティブ オプションを組織に提供できます。",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "安全"
- },
- {
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
- "severity": "高い",
- "text": "テナント全体のアカウント ロックアウトを防ぐために、緊急アクセスまたは非常用アカウントを実装します。MFA は、2024 年 10 月にすべてのユーザーに対してデフォルトで有効になります。これらのアカウントを更新して、パスキー (FIDO2) を使用するか、MFA の証明書ベースの認証を構成することをお勧めします。",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "安全"
+ "text": "Azure Monitor Insights for Virtual WAN を使用して、Virtual WAN のエンドツーエンド トポロジ、状態、および主要なメトリックを監視します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "オペレーションズ"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
"severity": "中程度",
- "text": "特に必要なシナリオがない限り、Microsoft Entra ID ロールの割り当てにオンプレミスの同期アカウントを使用しないでください。",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "安全"
+ "text": "Virtual WAN のブランチ間トラフィックは、これらのフローを明示的にブロックする必要がない限り、無効にしないでください。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "確実"
},
{
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
"severity": "中程度",
- "text": "Microsoft Entra ID アプリケーション プロキシを使用してリモート ユーザーにアプリケーションへのアクセス権を付与する場合は、テナントごとに 1 つのインスタンスしか持つことができないため、プラットフォーム リソースとして管理します。",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "安全"
+ "text": "AS-Path は ExpressRoute や VPN よりも柔軟性が高いため、ハブ ルーティング設定として使用します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
"severity": "中程度",
- "text": "ハブアンドスポークネットワークトポロジは、最大限の柔軟性を必要とするネットワークシナリオに使用します。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "text": "Virtual WAN でラベルベースの伝達を構成すると、仮想ハブ間の接続が損なわれます。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "microsoft.network/virtualWans",
"checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
"severity": "高い",
- "text": "ExpressRoute ゲートウェイ、VPN ゲートウェイ、Azure Firewall またはパートナー NVA などの共有ネットワーク サービスを中央ハブ仮想ネットワークにデプロイします。必要に応じて、DNS サービスもデプロイします。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "費用"
+ "text": "仮想ハブに少なくとも /23 プレフィックスを割り当てて、十分な IP スペースが使用可能であることを確認します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "高い",
- "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して、DDoS ネットワークまたは IP 保護プランを使用します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Azure Policy を戦略的に活用し、環境のコントロールを定義し、ポリシー イニシアチブを使用して関連するポリシーをグループ化します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "中程度",
- "text": "パートナー ネットワーク テクノロジまたは NVA をデプロイする場合は、パートナー ベンダーのガイダンスに従ってください。",
- "waf": "確実"
+ "text": "規制とコンプライアンスの要件を Azure Policy 定義と Azure ロールの割り当てにマップします。",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "severity": "低い",
- "text": "ハブ アンド スポークのシナリオで ExpressRoute ゲートウェイと VPN ゲートウェイ間のトランジットが必要な場合は、Azure Route Server を使用します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "中程度",
+ "text": "中間ルート管理グループで Azure Policy 定義を確立して、継承されたスコープで割り当てられるようにします。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
- "severity": "低い",
- "text": "Route Server を使用する場合は、Route Server サブネットに /27 プレフィックスを使用します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "高い",
+ "text": "ポリシーの割り当てを適切な最上位レベルで管理し、必要に応じて下位レベルで除外します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
- "severity": "中程度",
- "text": "Azure リージョン間で複数のハブ アンド スポーク トポロジを持つネットワーク アーキテクチャの場合は、ハブ VNet 間でグローバル仮想ネットワーク ピアリングを使用して、リージョンを相互に接続します。",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
- "waf": "パフォーマンス"
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "低い",
+ "text": "Azure Policy を使用して、ユーザーがサブスクリプション/管理グループ レベルでプロビジョニングできるサービスを制御します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
- "severity": "中程度",
- "text": "Azure Monitor for Networks を使用して、Azure 上のネットワークのエンドツーエンドの状態を監視します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "オペレーションズ"
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "高い",
+ "text": "可能な場合は組み込みポリシーを使用して、運用オーバーヘッドを最小限に抑えます。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "description": "Resource Policy Contributor ロールを特定のスコープに割り当てると、ポリシー管理を関連するチームに委任できます。たとえば、中央のITチームが管理グループレベルのポリシーを監督し、アプリケーションチームがサブスクリプションのポリシーを処理することで、組織の標準に準拠した分散型ガバナンスが可能になります。",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "中程度",
- "text": "リージョンに 400 を超えるスポーク ネットワークがある場合は、VNet ピアリングの制限 (500) と ExpressRoute 経由でアドバタイズできるプレフィックスの最大数 (1000) をバイパスするために、追加のハブをデプロイします。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "確実"
+ "text": "特定のスコープで組み込みのリソース ポリシー共同作成者ロールを割り当てて、アプリケーション レベルのガバナンスを有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "中程度",
- "text": "ルート テーブルあたりのルート数を 400 に制限します。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "確実"
+ "text": "ルート管理グループのスコープで行われる Azure Policy の割り当ての数を制限して、継承されたスコープでの除外による管理を回避します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
- "severity": "高い",
- "text": "VNet ピアリングを構成するときは、\"リモート仮想ネットワークへのトラフィックを許可する\" 設定を使用します。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "確実"
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "severity": "中程度",
+ "text": "データ主権の要件が存在する場合は、それらを適用するために Azure ポリシーをデプロイする必要があります。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "安全"
},
{
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
- "severity": "高い",
- "text": "Standard Load Balancer SKU をゾーン冗長デプロイで使用すると、Standard SKU Load Balancer を選択すると、可用性ゾーンとゾーンの回復性によって信頼性が向上し、デプロイがゾーンとリージョンの障害に耐えられるようになります。Basic とは異なり、グローバル負荷分散をサポートし、SLA を提供します。",
- "waf": "確実"
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "severity": "中程度",
+ "text": "ソブリン ランディング ゾーンの場合は、ソブリン ポリシー ベースラインをデプロイし、正しい管理グループ レベルで割り当てます。",
+ "waf": "安全"
},
{
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
- "severity": "高い",
- "text": "Load Balancer バックエンド プールに少なくとも 2 つのインスタンスが含まれていることを確認し、バックエンドに少なくとも 2 つのインスタンスがある Azure Load Balancers をデプロイすると、単一障害点が防止され、スケーラビリティがサポートされます。",
- "waf": "確実"
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "severity": "中程度",
+ "text": "ソブリン ランディング ゾーンの場合は、ソブリン制御の目標をポリシー マッピングに文書化します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
"checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
"severity": "中程度",
- "text": "ExpressRoute Direct を使用している場合は、組織のルーターと MSEE の間のレイヤー 2 レベルでトラフィックを暗号化するために MACsec を構成します。この図は、フロー内のこの暗号化を示しています。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "text": "ソブリン・ランディング・ゾーンについては、「ソブリン・コントロールの目標からポリシー・マッピングまで」の管理プロセスが実施されていることを確認してください。",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
"severity": "中程度",
- "text": "MACsec がオプションではないシナリオ (ExpressRoute Direct を使用しない場合など) は、VPN ゲートウェイを使用して、ExpressRoute プライベート ピアリング経由で IPsec トンネルを確立します。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
- "severity": "高い",
- "text": "Azure リージョンとオンプレミスの場所間で重複する IP アドレス空間が使用されていないことを確認します。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "text": "Azure ロールベースのアクセス制御 (Azure RBAC)、データ主権要件、またはデータ保持ポリシーで個別のワークスペースが義務付けられている場合を除き、1 つのモニター ログ ワークスペースを使用してプラットフォームを一元的に管理します。",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "中程度",
- "text": "プライベートインターネットのアドレス割り当て範囲(RFC 1918)のIPアドレスを使用します。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "text": "すべてのリージョンで 1 つの Azure Monitor ログ ワークスペースを使用するか、さまざまな地理的リージョンをカバーする複数のワークスペースを作成するかを決定します。各アプローチには、リージョン間のネットワーク料金の可能性など、長所と短所があります",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "高い",
- "text": "IP アドレス空間が無駄にならないようにし、不必要に大規模な仮想ネットワーク (/16 など) を作成しないでください。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "パフォーマンス"
+ "text": "ログの保持要件が 12 年を超える場合は、ログを Azure Storage にエクスポートします。write-once、read-many ポリシーで不変ストレージを使用して、ユーザーが指定した間隔でデータを消去および変更できないようにします。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
- "severity": "高い",
- "text": "運用サイトとディザスター リカバリー サイトで重複する IP アドレス範囲を使用しないでください。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "確実"
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "中程度",
+ "text": "Azure Policy を使用して、OS レベルの仮想マシン (VM) 構成のずれを監視します。ポリシーを使用して Azure Automanage マシン構成の監査機能を有効にすると、アプリケーション チームのワークロードは、わずかな労力で機能機能をすぐに使用できます。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "オペレーションズ"
},
{
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
- "severity": "高い",
- "text": "Standard SKU とゾーン冗長 IP を使用する (該当する場合)、Azure のパブリック IP アドレスは Standard SKU であり、非ゾーン、ゾーン、またはゾーン冗長として使用できます。ゾーン冗長 IP は、すべてのゾーンでアクセス可能であり、1 つのゾーンの障害に耐えるため、回復性が向上します。",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "確実"
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "severity": "中程度",
+ "text": "Azure Update Manager は、Azure の Windows VM と Linux VM の修正プログラム適用メカニズムとして使用します。",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
"severity": "中程度",
- "text": "Azure での名前解決が必要な環境では、Azure プライベート DNS を使用して解決し、名前解決に委任されたゾーン ('azure.contoso.com' など) を使用します。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Azure Arc を使用して、Azure の外部にある Windows および Linux VM の修正プログラム適用メカニズムとして Azure Update Manager を使用します。",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
+ "arm-service": "microsoft.network/networkWatchers",
"checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
"severity": "中程度",
- "text": "Azure とオンプレミス間での名前解決が必要で、Active Directory のような既存のエンタープライズ DNS サービスがない環境の場合は、Azure DNS Private Resolver を使用して DNS 要求を Azure またはオンプレミスの DNS サーバーにルーティングします。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "安全"
+ "text": "Network Watcher を使用して、トラフィック フローを事前に監視します。",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
- "severity": "低い",
- "text": "独自の DNS が必要でデプロイする特別なワークロード (Red Hat OpenShift など) は、優先する DNS ソリューションを使用する必要があります。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "中程度",
+ "text": "Azure Monitor ログを使用して、分析情報とレポートを作成します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
- "severity": "高い",
- "text": "Azure DNS の自動登録を有効にすると、仮想ネットワーク内にデプロイされた仮想マシンの DNS レコードのライフサイクルが自動的に管理されます。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "中程度",
+ "text": "Azure Monitor アラートを使用して、運用アラートを生成します。",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
"severity": "中程度",
- "text": "複数の Azure リージョン間の DNS 解決を管理し、サービスが別のリージョンにフェールオーバーするときの計画を実装します",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Azure Automation アカウントを使用して変更とインベントリの追跡を使用する場合は、Log Analytics ワークスペースと Automation アカウントをリンクするためにサポートされているリージョンが選択されていることを確認してください。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "オペレーションズ"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "低い",
+ "text": "Azure Backup を使用する場合は、既定の設定が GRS であるため、バックアップに正しいバックアップの種類 (GRS、ZRS、LRS) を使用します。",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/bastionHosts",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
"severity": "中程度",
- "text": "Azure Bastion を使用して、ネットワークに安全に接続します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "text": "Azure ゲスト ポリシーを使用して、VM 拡張機能を通じてソフトウェア構成を自動的にデプロイし、準拠したベースライン VM 構成を適用します。",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/bastionHosts",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "description": "Azure Policy のゲスト構成機能を使用して、マシンの設定 (OS、アプリケーション、環境など) を監査および修復し、リソースが予想される構成と一致していることを確認し、Update Management では VM のパッチ管理を適用できます。",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
"severity": "中程度",
- "text": "Azure Bastion は、/26 以上のサブネットで使用します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "text": "Azure Policy を使用して VM セキュリティ構成のドリフトを監視します。",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"severity": "中程度",
- "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン間でグローバルな保護を提供します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "text": "Azure Site Recovery は、Azure から Azure Virtual Machines へのディザスター リカバリー シナリオに使用します。これにより、リージョン間でワークロードをレプリケートできます。",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "オペレーションズ"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "中程度",
+ "text": "Azure ネイティブのバックアップ機能、または Azure と互換性のあるサード パーティのバックアップ ソリューションを使用します。",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "オペレーションズ"
},
{
"arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
"checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
"service": "WAF",
- "severity": "低い",
- "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door の WAF ポリシーを使用します。Azure Application Gateway をロックダウンして、Azure Front Door からのトラフィックのみを受信するようにします。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "severity": "高い",
+ "text": "診断設定を追加して、Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを保存します。ログを定期的に確認して、攻撃や誤検知の検出がないか確認します。",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "オペレーションズ"
},
{
"arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
"checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
"service": "WAF",
- "severity": "高い",
- "text": "受信 HTTP/S 接続に WAF やその他のリバース プロキシが必要な場合は、ランディング ゾーン仮想ネットワーク内にデプロイし、保護してインターネットに公開するアプリと共にデプロイします。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "severity": "中程度",
+ "text": "Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを Microsoft Sentinel に送信します。攻撃を検出し、WAF テレメトリを Azure 環境全体に統合します。",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"severity": "高い",
- "text": "Azure DDoS ネットワークまたは IP Protection プランを使用して、仮想ネットワーク内のパブリック IP アドレス エンドポイントを保護します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Azure Key Vault を使用して、シークレットと資格情報を格納します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
- "severity": "高い",
- "text": "ネットワークの送信トラフィックの構成と戦略を管理する方法を、今後の破壊的変更の前に計画します。2025 年 9 月 30 日に、新しいデプロイの既定の送信アクセスは廃止され、明示的なアクセス構成のみが許可されます。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "高い",
- "text": "診断設定を追加して、保護されたすべてのパブリック IP アドレス (DDoS IP またはネットワーク保護) の DDoS 関連のログを保存します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
+ "severity": "中程度",
+ "text": "アプリケーションやリージョンごとに異なる Azure Key Vault を使用して、トランザクションのスケール制限を回避し、シークレットへのアクセスを制限します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
- "severity": "高い",
- "text": "Virtual Machines に直接関連付けられているパブリック IP アドレスを拒否するポリシーの割り当てがあることを確認します。 特定の VM でパブリック IP が必要な場合は、除外を使用します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "中程度",
+ "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "ExpressRoute を Azure へのプライマリ接続として使用します。 バックアップ接続のソースとして VPN を使用します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "パフォーマンス"
+ "text": "最小特権モデルに従って、キー、シークレット、証明書を完全に削除する承認を、特殊なカスタム Microsoft Entra ID ロールに制限します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "description": "AS パスの先頭と接続の重みを使用して Azure からオンプレミスへのトラフィックに影響を与えたり、独自のルーターの BGP 属性の全範囲を使用してオンプレミスから Azure へのトラフィックに影響を与えたりできます。",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "複数の ExpressRoute 回線または複数のオンプレミスの場所を使用する場合は、BGP 属性を使用してルーティングを最適化します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "公開認証局を使用して証明書の管理と更新プロセスを自動化し、管理を容易にします。",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "ExpressRoute/VPN ゲートウェイの適切な SKU は、帯域幅とパフォーマンスの要件に基づいて選択してください。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "パフォーマンス"
+ "text": "キーと証明書のローテーションのための自動化されたプロセスを確立します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
- "severity": "高い",
- "text": "無制限のデータ ExpressRoute 回線を使用しているのは、そのコストを正当化する帯域幅に達した場合にのみしてください。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "費用"
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "中程度",
+ "text": "コンテナーでファイアウォールと仮想ネットワーク サービス エンドポイントまたはプライベート エンドポイントを有効にして、キー コンテナーへのアクセスを制御します。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
- "severity": "高い",
- "text": "ExpressRoute のローカル SKU を活用して、回線のコストを削減します (回線ピアリングの場所がローカル SKU の Azure リージョンをサポートしている場合)。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "費用"
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
+ "severity": "中程度",
+ "text": "プラットフォーム中央の Azure Monitor Log Analytics ワークスペースを使用して、Key Vault の各インスタンス内のキー、証明書、シークレットの使用状況を監査します。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "ゾーン冗長 ExpressRoute ゲートウェイをサポートされている Azure リージョンにデプロイします。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "Key Vault のインスタンス化と特権アクセスを委任し、Azure Policy を使用して一貫した準拠構成を適用します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "10 Gbps を超える帯域幅または専用の 10/100 Gbps ポートが必要なシナリオでは、ExpressRoute Direct を使用します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "パフォーマンス"
+ "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "待機時間を短くする必要がある場合、またはオンプレミスから Azure へのスループットを 10 Gbps より大きくする必要がある場合は、FastPath を有効にして、データ パスから ExpressRoute ゲートウェイをバイパスします。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "パフォーマンス"
+ "text": "独自のキーを持ち込む場合、これは考慮されるすべてのサービスでサポートされているとは限りません。不整合が望ましい結果を妨げないように、適切な軽減策を実装します。レイテンシを最小限に抑える適切なリージョンペアとディザスタリカバリリージョンを選択します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "ゾーン冗長 VPN ゲートウェイを使用して、ブランチまたはリモートの場所を Azure (使用可能な場合) に接続します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "確実"
+ "text": "ソブリン ランディング ゾーンの場合は、Azure Key Vault マネージド HSM を使用してシークレットと資格情報を格納します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
"checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"severity": "中程度",
- "text": "オンプレミスで冗長な VPN アプライアンス (アクティブ/アクティブまたはアクティブ/パッシブ) を使用します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "確実"
+ "text": "Microsoft Entra ID レポート機能を使用して、アクセス制御監査レポートを生成します。",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
"severity": "高い",
- "text": "ExpressRoute Direct を使用する場合は、コストを節約するために、ローカル Azure リージョンへの ExpressRoute ローカル回線を使用することを検討してください。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "費用"
+ "text": "すべてのサブスクリプションで Defender Cloud セキュリティ態勢管理を有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
- "severity": "中程度",
- "text": "運用環境と非運用環境を分離する場合など、トラフィックの分離または専用の帯域幅が必要な場合は、異なる ExpressRoute 回線を使用します。これにより、ルーティングドメインを分離し、ノイズの多い隣人のリスクを軽減できます。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "高い",
+ "text": "すべてのサブスクリプションで、サーバーの Defender Cloud ワークロード保護プランを有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
- "severity": "中程度",
- "text": "ExpressRoute の可用性と使用率は、組み込みの Express Route Insights を使用して監視します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "オペレーションズ"
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "高い",
+ "text": "すべてのサブスクリプションで Azure リソースの Defender Cloud ワークロード保護プランを有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "中程度",
- "text": "接続モニターは、ネットワーク全体 (特にオンプレミスと Azure の間) の接続監視に使用します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "オペレーションズ"
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "高い",
+ "text": "IaaS サーバーでエンドポイント保護を有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "中程度",
- "text": "冗長性を確保するために、さまざまなピアリングの場所から ExpressRoute 回線を使用します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "Azure Monitor ログと Defender for Cloud を使用して、基本オペレーティング システムの修正プログラムのずれを監視します。",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "中程度",
- "text": "ExpressRoute 回線を 1 つだけ使用する場合は、ExpressRoute のフェールオーバーとしてサイト間 VPN を使用します。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "既定のリソース構成を一元化された Azure Monitor Log Analytics ワークスペースに接続します。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
"severity": "高い",
- "text": "GatewaySubnet でルート テーブルを使用している場合は、ゲートウェイ ルートが伝達されていることを確認してください。",
- "waf": "確実"
+ "text": "相関ログによる一元的な脅威検出 - セキュリティデータを中央の場所に統合して、SIEM(セキュリティ情報およびイベント管理)を介してさまざまなサービス間で関連付けることができます",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
- "severity": "高い",
- "text": "ExpressRoute を使用する場合、オンプレミスのルーティングは動的である必要があり、接続エラーが発生した場合は、回線の残りの接続に収束する必要があります。負荷は、アクティブ/アクティブとして両方の接続で共有するのが理想的ですが、アクティブ/パッシブもサポートされています。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
+ "severity": "中程度",
+ "text": "ソブリン ランディング ゾーンの場合は、Entra ID テナントで透明度ログを有効にします。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
"checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"severity": "中程度",
- "text": "ExpressRoute 回線の 2 つの物理リンクが、ネットワーク内の 2 つの異なるエッジ デバイスに接続されていることを確認します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "Sovereign Landing Zone の場合は、Entra ID テナントでカスタマー ロックボックスを有効にします。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
- "severity": "中程度",
- "text": "BFD(Bidirectional Forwarding Detection)が顧客またはプロバイダのエッジルーティングデバイスで有効で設定されていることを確認します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "高い",
+ "text": "ストレージ アカウントへの安全な転送を有効にします。",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
"severity": "高い",
- "text": "ExpressRoute ゲートウェイを異なるピアリングの場所から 2 つ以上の回線に接続すると、回復性が向上します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "確実"
+ "text": "ストレージ アカウントのコンテナーの論理的な削除を有効にして、削除されたコンテナーとその内容を回復します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
- "severity": "中程度",
- "text": "ExpressRoute 仮想ネットワーク ゲートウェイの診断ログとアラートを構成します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "severity": "高い",
+ "text": "Key Vault シークレットを使用して、資格情報 (仮想マシン、ユーザー パスワード)、証明書、キーなどの機密情報のハードコーディングを回避します。",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "VNet 間通信に ExpressRoute 回線を使用しないでください。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "パフォーマンス"
+ "text": "\"ストレージの Azure セキュリティ ベースライン\" を検討する",
+ "waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
- "severity": "低い",
- "text": "検査のために Azure トラフィックをハイブリッドの場所に送信しないでください。 代わりに、Azure のリソース間の通信が Microsoft バックボーン ネットワーク経由で行われるように、\"Azure のトラフィックは Azure にとどまる\" という原則に従います。",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "既定では、Azure Storage にはパブリック IP アドレスがあり、インターネットにアクセス可能です。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースにのみ Azure Storage を安全に公開できるため、パブリック インターネットへの露出を排除できます",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure Storage にプライベート エンドポイントを使用することを検討する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "新しく作成されたストレージ アカウントは、RBAC や監査などがすべて有効になるように、ARM デプロイ モデルを使用して作成されます。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認する",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "古いストレージ アカウントで \"クラシック デプロイ モデル\" が使用されていないことを確認する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルタリング (組織で必要な場合) を管理します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "すべてのストレージ アカウントに対して Microsoft Defender を有効にする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "論理的な削除メカニズムを使用すると、誤って削除された BLOB を回復できます。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "グローバル ネットワーク環境全体のセキュリティ体制を管理するためのグローバル Azure Firewall ポリシーを作成し、それをすべての Azure Firewall インスタンスに割り当てます。Azure のロールベースのアクセス制御を介して、増分ファイアウォール ポリシーをローカル セキュリティ チームに委任することで、特定のリージョンの要件を満たすためのきめ細かなポリシーを可能にします。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "BLOB の \"論理的な削除\" を有効にする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
- "severity": "低い",
- "text": "サポートされているパートナー SaaS セキュリティプロバイダーを Firewall Manager 内で構成します。これは、組織がアウトバウンド接続を保護するためにそのようなソリューションを使用する場合です。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "BLOB の '論理的な削除' を無効にする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "コンテナーの論理的な削除を使用すると、コンテナーが削除された後に回復できます (たとえば、偶発的な削除操作から回復します)。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "アプリケーション・ルールを使用して、サポートされているプロトコルの宛先ホスト名でアウトバウンド・トラフィックをフィルタリングします。 FQDN ベースのネットワーク規則と Azure Firewall と DNS プロキシを使用して、他のプロトコル経由でインターネットへのエグレス トラフィックをフィルター処理します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "コンテナーの \"論理的な削除\" を有効にする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
- "severity": "高い",
- "text": "Azure Firewall Premium を使用して、追加のセキュリティ機能を有効にします。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "コンテナーの \"論理的な削除\" を無効にする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "削除前に削除ロックを最初に解除するようにユーザーに強制することで、ストレージ アカウントが誤って削除されないようにします",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall の脅威インテリジェンス モードを [アラート] と [拒否] に構成して、保護を強化します。",
+ "text": "ストレージ アカウントでのリソース ロックの有効化",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変の BLOB が含まれる場合、そのストレージ アカウントを \"取り除く\" 唯一の方法は、Azure サブスクリプションを取り消すことです。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall の IDPS モードを [拒否] に構成して、保護を強化します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "不変の BLOB を検討する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Virtual WAN に接続されていない VNet 内のサブネットの場合は、インターネット トラフィックが Azure Firewall またはネットワーク仮想アプライアンスにリダイレクトされるようにルート テーブルをアタッチします。",
+ "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
- "severity": "中程度",
- "text": "診断設定を追加して、リソース固有の宛先テーブルを使用して、すべての Azure Firewall デプロイのログを保存します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
- "severity": "大事な",
- "text": "Azure Firewall クラシック ルール (存在する場合) からファイアウォール ポリシーに移行します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要があります。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall サブネットに /26 プレフィックスを使用します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報が失われるリスクを最小限に抑えることができます。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "ファイアウォールポリシー内のルールを、使用頻度に基づいて「ルールコレクショングループ」と「ルールコレクション」に整理します。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "パフォーマンス"
+ "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
- "severity": "中程度",
- "text": "IP グループまたは IP プレフィックスを使用して、IP テーブル・ルールの数を減らします。",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "AAD トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "BLOB アクセスに Azure Active Directory (Azure AD) トークンを使用する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のあるデータの誤用の両方を防ぐことができます。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "DNATSのソースIPとしてワイルドカード(*やanyなど)を使用せず、受信DNATのソースIPを指定する必要があります。",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "パフォーマンス"
+ "text": "IaM アクセス許可の最小特権",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
- "severity": "中程度",
- "text": "SNAT ポートの使用状況を監視し、NAT ゲートウェイの設定を評価し、シームレスなフェールオーバーを確保することで、SNAT ポートの枯渇を防ぎます。ポート数が制限に近づく場合は、SNAT の枯渇が差し迫っている可能性があります。",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によってセキュリティで保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰がいつキーのコピーを取得したかを監視できますが、キーが複数の人の手に渡ると、使用状況を特定のユーザーに帰属させることは不可能です。AAD 認証のみに依存することで、ストレージへのアクセスをユーザーに結び付けやすくなります。",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall Premium を使用している場合は、TLS 検査を有効にします。",
- "waf": "パフォーマンス"
+ "text": "ストレージ アカウント キーを無効にして、AAD アクセス (およびユーザー委任 SAS) のみがサポートされるようにすることを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
- "severity": "低い",
- "text": "Web カテゴリを使用して、特定のトピックへの送信アクセスを許可または拒否します。",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティ (ストレージ アカウント キー、アクセス ポリシーなど) が \"いつ、誰が、何を、\"どのように\" 表示または変更されているかを特定します。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure Monitor を使用して、ストレージ アカウントに対するコントロール プレーン操作を監査することを検討してください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "キーの有効期限ポリシーを使用すると、アカウントアクセスキーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "TLS 検査の一環として、Azure App Gateway からのトラフィックの受信を検査用に計画します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "パフォーマンス"
+ "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS 有効期限ポリシーでは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーがサービス SAS またはアカウント SAS を、推奨間隔よりも長い有効期間で生成すると、警告が表示されます。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "Azure Firewall DNS プロキシ構成を有効にします。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "text": "SAS 有効期限ポリシーの構成を検討する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
- "severity": "高い",
- "text": "Azure Firewall を Azure Monitor と統合し、診断ログを有効にして、ファイアウォールのログとメトリックを格納および分析します。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "低い",
- "text": "ファイアウォールルールのバックアップを実装する",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "保存されているアクセス ポリシーを使用すると、ストレージ アカウント キーを再生成することなく、サービス SAS のアクセス許可を取り消すことができます。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "保存されているアクセス ポリシーに SAS をリンクすることを検討する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
- "severity": "高い",
- "text": "Azure Firewall を複数の可用性ゾーンにデプロイします。Azure Firewall は、そのデプロイに応じて異なる SLA を提供します。1 つの可用性ゾーンまたは複数の可用性ゾーンで、信頼性とパフォーマンスが向上する可能性があります。",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "確実"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するようにアプリケーションのソース コード リポジトリを構成することを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに用意することを検討してください。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure Firewall VNet で DDoS Protection を構成し、DDoS Protection プランを Azure Firewall をホストしている仮想ネットワークに関連付けて、DDoS 攻撃に対する軽減を強化します。Azure Firewall Manager は、ファイアウォール インフラストラクチャと DDoS 保護プランの作成を統合します。",
- "waf": "確実"
+ "text": "接続文字列を Azure KeyVault に格納することを検討する (マネージド ID が不可能なシナリオの場合)",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "アドホック SAS サービス SAS またはアカウント SAS で、有効期限が近づいています。このように、SAS が侵害された場合でも、有効期間は短時間です。この方法は、保存されているアクセス ポリシーを参照できない場合に特に重要です。また、有効期限が近いと、BLOB にアップロードできる時間が制限されるため、BLOB に書き込めるデータの量も制限されます。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "0.0.0.0/0 ルートやコントロール プレーン トラフィックをブロックする NSG ルールなど、仮想ネットワークに挿入された Azure PaaS サービスのコントロール プレーン通信を中断しないでください。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "アドホックSASの有効期間を短くする",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS を作成するときは、できるだけ具体的かつ制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "オンプレミスからプライベート エンドポイントと ExpressRoute プライベート ピアリングを介して Azure PaaS サービスにアクセスします。この方法では、公共のインターネット経由のトランジットを回避できます。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "SAS に狭いスコープを適用する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS には、SAS を使用してリソースを要求する権限をクライアント IP アドレスまたはアドレス範囲に与えるパラメーターを含めることができます。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS は、クライアントがアップロードするデータの量を制限できません。時間の経過に伴うストレージ容量の価格モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低い",
+ "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "\"ローカル ユーザー アカウント\" を使用して SFTP 経由で BLOB ストレージにアクセスする場合、\"通常の\" RBAC 制御は適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式はローカル ユーザーだけです",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "既定では、すべてのサブネットで仮想ネットワーク サービス エンドポイントを有効にしないでください。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "SFTP: SFTPアクセスの「ローカルユーザー」の数を制限し、時間の経過とともにアクセスが必要かどうかを監査します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "Azure Firewall または NVA の IP アドレスではなく FQDN を使用して Azure PaaS サービスへのエグレス トラフィックをフィルター処理し、データの流出を防ぎます。Private Link を使用している場合は、すべての FQDN をブロックでき、それ以外の場合は必要な PaaS サービスのみを許可できます。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "SFTP: SFTP エンドポイントは、POSIX ライクな ACL をサポートしていません。",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "ストレージは、CORS (Cross-Origin Resource Sharing)、つまり、異なるドメインの Web アプリが同一生成元ポリシーを緩めることを可能にする HTTP 機能をサポートしています。CORS を有効にする場合は、CorsRules を最小の特権に保ちます。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Gateway サブネットには、少なくとも /27 プレフィックスを使用します。",
+ "text": "過度に広範な CORS ポリシーを避ける",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム マネージド キー (既定) またはカスタマー マネージド キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure Storage に提供するか、クライアント側で暗号化を完全に処理することによって行われます。そのため、機密性の保証を Azure Storage にまったく依存しません。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "VirtualNetwork サービス タグを使用して接続を制限する NSG 受信既定の規則に依存しないでください。",
+ "text": "保存データの暗号化方法を決定します。データのスレッド モデルを理解します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "NSG を使用して、サブネット間のトラフィックと、プラットフォーム全体の East/West トラフィック (ランディング ゾーン間のトラフィック) を保護します。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "どのプラットフォーム暗号化を使用するか、または使用するかを決定します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "NSG とアプリケーション セキュリティ グループを使用して、ランディング ゾーン内のトラフィックをマイクロセグメント化し、中央の NVA を使用してトラフィック フローをフィルター処理しないようにします。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "クライアント側の暗号化を使用するかどうかを決定します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "severity": "中程度",
- "text": "VNet フロー ログを有効にし、Traffic Analytics にフィードして、内部および外部のトラフィック フローに関する分析情報を取得します。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを検索します。",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "パブリック BLOB アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
- "severity": "中程度",
- "text": "1000 ルールの制限があるため、NSG ごとに 900 を超える NSG ルールを実装しないでください。",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
+ "severity": "高い",
+ "text": "ビジネスとSLOの要件に基づいて適切な関数ホスティングプランを選択します",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "severity": "中程度",
- "text": "Virtual WAN ルーティング設計の一覧にシナリオが明示的に説明されている場合は、Virtual WAN を使用します。",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
+ "severity": "高い",
+ "text": "リージョンで適用可能な場合は Availability Zones を活用します (従量課金レベルでは使用できません)",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
"severity": "中程度",
- "text": "Azure リージョンごとに Virtual WAN ハブを使用して、共通のグローバル Azure Virtual WAN を介して Azure リージョン間で複数のランディング ゾーンを接続します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "パフォーマンス"
+ "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
- "severity": "中程度",
- "text": "送信インターネット トラフィックの保護とフィルタリングを行うには、セキュリティで保護されたハブに Azure Firewall をデプロイします。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
+ "severity": "高い",
+ "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "Azure Functions",
+ "severity": "高い",
+ "text": "App Service プランで実行されているすべての関数アプリで \"Always On\" が有効になっていることを確認する",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"severity": "中程度",
- "text": "Virtual WAN ネットワーク アーキテクチャが、特定されたアーキテクチャ シナリオと一致していることを確認します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "関数アプリを独自のストレージ アカウントにペアリングします。Function Apps のストレージ アカウントは、緊密に結合されていない限り、再利用しないようにしてください",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
"severity": "中程度",
- "text": "Azure Monitor Insights for Virtual WAN を使用して、Virtual WAN のエンドツーエンド トポロジ、状態、および主要なメトリックを監視します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、関数アプリのコードを保護します",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
- "severity": "中程度",
- "text": "Virtual WAN のブランチ間トラフィックは、これらのフローを明示的にブロックする必要がない限り、無効にしないでください。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
+ "severity": "高い",
+ "text": "Availability Zones (リージョンで適用可能な場合) を活用する (これは自動的に有効になります)",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "中程度",
- "text": "AS-Path は ExpressRoute や VPN よりも柔軟性が高いため、ハブ ルーティング設定として使用します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "Microsoft が開始するフェールオーバーに注意してください。これらは、まれに、影響を受けるリージョンから対応する geo ペア リージョンにすべての IoT ハブをフェールオーバーするために Microsoft によって実行されます。",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
- "severity": "中程度",
- "text": "Virtual WAN でラベルベースの伝達を構成すると、仮想ハブ間の接続が損なわれます。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
+ "severity": "高い",
+ "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "高い",
- "text": "仮想ハブに少なくとも /23 プレフィックスを割り当てて、十分な IP スペースが使用可能であることを確認します。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "手動フェールオーバーをトリガーする方法を学習します。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
"severity": "高い",
- "text": "Azure Policy を戦略的に活用し、環境のコントロールを定義し、ポリシー イニシアチブを使用して関連するポリシーをグループ化します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "安全"
+ "text": "フェールオーバー後にフェールバックする方法を学習します。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "規制とコンプライアンスの要件を Azure Policy 定義と Azure ロールの割り当てにマップします。",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "text": "Application Gateway v2 SKU を使用していることを確認する",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
"severity": "中程度",
- "text": "中間ルート管理グループで Azure Policy 定義を確立して、継承されたスコープで割り当てられるようにします。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "Azure Load Balancers に Standard SKU を使用していることを確認します",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
- "severity": "高い",
- "text": "ポリシーの割り当てを適切な最上位レベルで管理し、必要に応じて下位レベルで除外します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
+ "severity": "中程度",
+ "text": "Load Balancer フロントエンドの IP アドレスがゾーン冗長であることを確認します (ゾーン フロントエンドが必要な場合を除く)。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "低い",
- "text": "Azure Policy を使用して、ユーザーがサブスクリプション/管理グループ レベルでプロビジョニングできるサービスを制御します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
+ "severity": "中程度",
+ "text": "Application Gateways v2 は、IP プレフィックスが /24 以上のサブネットにデプロイする必要があります",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
- "severity": "高い",
- "text": "可能な場合は組み込みポリシーを使用して、運用オーバーヘッドを最小限に抑えます。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "リバースプロキシの管理全般、特にWAFの管理は、ネットワーキングよりもアプリケーションに近いため、アプリと同じサブスクリプションに属します。Application Gateway と WAF を接続サブスクリプションに一元化することは、1 つのチームによって管理されている場合は問題ない可能性があります。",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
+ "severity": "中程度",
+ "text": "ランディング ゾーン仮想ネットワーク内の受信 HTTP(S) 接続のプロキシに使用される Azure Application Gateway v2 またはパートナー NVA と、それらがセキュリティ保護しているアプリをデプロイします。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "Resource Policy Contributor ロールを特定のスコープに割り当てると、ポリシー管理を関連するチームに委任できます。たとえば、中央のITチームが管理グループレベルのポリシーを監督し、アプリケーションチームがサブスクリプションのポリシーを処理することで、組織の標準に準拠した分散型ガバナンスが可能になります。",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "特定のスコープで組み込みのリソース ポリシー共同作成者ロールを割り当てて、アプリケーション レベルのガバナンスを有効にします。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して、DDoS ネットワークまたは IP 保護プランを使用します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "ルート管理グループのスコープで行われる Azure Policy の割り当ての数を制限して、継承されたスコープでの除外による管理を回避します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "安全"
+ "text": "自動スケールは、最小インスタンス数が 2 になるように構成します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "データ主権の要件が存在する場合は、それらを適用するために Azure ポリシーをデプロイする必要があります。",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "安全"
+ "text": "Application Gateway を複数の可用性ゾーンにデプロイする",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"severity": "中程度",
- "text": "ソブリン ランディング ゾーンの場合は、ソブリン ポリシー ベースラインをデプロイし、正しい管理グループ レベルで割り当てます。",
+ "text": "Front Door と Application Gateway を使用して HTTP/S アプリを保護する場合は、Front Door で WAF ポリシーを使用します。Application Gateway をロックダウンして、Front Door からのトラフィックのみを受信します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
- "severity": "中程度",
- "text": "ソブリン ランディング ゾーンの場合は、ソブリン制御の目標をポリシー マッピングに文書化します。",
- "waf": "安全"
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
+ "severity": "高い",
+ "text": "Traffic Manager を使用して、HTTP/S 以外のプロトコルにまたがるグローバル アプリを配信します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
- "severity": "中程度",
- "text": "ソブリン・ランディング・ゾーンについては、「ソブリン・コントロールの目標からポリシー・マッピングまで」の管理プロセスが実施されていることを確認してください。",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "低い",
+ "text": "ユーザーが内部アプリケーションへのアクセスのみを必要とする場合、Microsoft Entra ID アプリケーション プロキシは Azure Virtual Desktop (AVD) の代替手段として検討されていますか?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "中程度",
- "text": "Azure ロールベースのアクセス制御 (Azure RBAC)、データ主権要件、またはデータ保持ポリシーで個別のワークスペースが義務付けられている場合を除き、1 つのモニター ログ ワークスペースを使用してプラットフォームを一元的に管理します。",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "オペレーションズ"
+ "text": "ネットワーク内の着信接続用に開かれるファイアウォール ポートの数を減らすには、Microsoft Entra ID アプリケーション プロキシを使用して、リモート ユーザーに内部アプリケーションへの安全で認証されたアクセスを提供することを検討してください。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
- "severity": "中程度",
- "text": "すべてのリージョンで 1 つの Azure Monitor ログ ワークスペースを使用するか、さまざまな地理的リージョンをカバーする複数のワークスペースを作成するかを決定します。各アプローチには、リージョン間のネットワーク料金の可能性など、長所と短所があります",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
+ "severity": "高い",
+ "text": "Load Balancer のアウトバウンド規則の代わりに Azure NAT Gateway を使用して SNAT のスケーラビリティを向上させる",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
"severity": "高い",
- "text": "ログの保持要件が 12 年を超える場合は、ログを Azure Storage にエクスポートします。write-once、read-many ポリシーで不変ストレージを使用して、ユーザーが指定した間隔でデータを消去および変更できないようにします。",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
- "severity": "中程度",
- "text": "Azure Policy を使用して、OS レベルの仮想マシン (VM) 構成のずれを監視します。ポリシーを使用して Azure Automanage マシン構成の監査機能を有効にすると、アプリケーション チームのワークロードは、わずかな労力で機能機能をすぐに使用できます。",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
- "severity": "中程度",
- "text": "Azure Update Manager は、Azure の Windows VM と Linux VM の修正プログラム適用メカニズムとして使用します。",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "オペレーションズ"
+ "text": "Azure Application Gateway WAF ボット保護ルール セットを有効にします。ボット ルールは、良いボットと悪いボットを検出します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
- "severity": "中程度",
- "text": "Azure Arc を使用して、Azure の外部にある Windows および Linux VM の修正プログラム適用メカニズムとして Azure Update Manager を使用します。",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "オペレーションズ"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "Azure Application Gateway WAF ポリシーで要求本文の検査機能が有効になっているかどうかを確認します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
- "severity": "中程度",
- "text": "Network Watcher を使用して、トラフィック フローを事前に監視します。",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "オペレーションズ"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "ワークロードの検出モードで Azure Application Gateway WAF を調整します。誤検出を減らします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
- "severity": "中程度",
- "text": "Azure Monitor ログを使用して、分析情報とレポートを作成します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "オペレーションズ"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "Application Gateway の WAF ポリシーを \"防止\" モードでデプロイします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Monitor アラートを使用して、運用アラートを生成します。",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "オペレーションズ"
+ "text": "Azure Application Gateway WAF にレート制限を追加します。レート制限は、クライアントが誤ってまたは意図的に短時間に大量のトラフィックを送信するのをブロックします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Automation アカウントを使用して変更とインベントリの追跡を使用する場合は、Log Analytics ワークスペースと Automation アカウントをリンクするためにサポートされているリージョンが選択されていることを確認してください。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "オペレーションズ"
+ "text": "Azure Application Gateway WAF のレート制限には高いしきい値を使用します。レート制限のしきい値を高くすると、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多くのリクエストに対する保護を提供します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
"severity": "低い",
- "text": "Azure Backup を使用する場合は、既定の設定が GRS であるため、バックアップに正しいバックアップの種類 (GRS、ZRS、LRS) を使用します。",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "確実"
+ "text": "すべての地理的地域からのトラフィックを想定していない場合は、geo フィルタを使用して、想定外の国からのトラフィックをブロックします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure ゲスト ポリシーを使用して、VM 拡張機能を通じてソフトウェア構成を自動的にデプロイし、準拠したベースライン VM 構成を適用します。",
+ "text": "Azure Application Gateway WAF を使用してトラフィックを geo フィルタリングする場合は、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致できない場合に、正当な要求を誤ってブロックしないようにします。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "Azure Policy のゲスト構成機能を使用して、マシンの設定 (OS、アプリケーション、環境など) を監査および修復し、リソースが予想される構成と一致していることを確認し、Update Management では VM のパッチ管理を適用できます。",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Policy を使用して VM セキュリティ構成のドリフトを監視します。",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "最新の Azure Application Gateway WAF ルール セット バージョンを使用します。ルールセットの更新は、現在の脅威の状況を考慮して定期的に更新されます。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Site Recovery は、Azure から Azure Virtual Machines へのディザスター リカバリー シナリオに使用します。これにより、リージョン間でワークロードをレプリケートできます。",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "text": "診断設定を追加して、Azure Application Gateway WAF ログを保存します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure ネイティブのバックアップ機能、または Azure と互換性のあるサード パーティのバックアップ ソリューションを使用します。",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "text": "Azure Application Gateway WAF ログを Microsoft Sentinel に送信します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
- "severity": "高い",
- "text": "診断設定を追加して、Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを保存します。ログを定期的に確認して、攻撃や誤検知の検出がないか確認します。",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
+ "severity": "中程度",
+ "text": "Azure Application Gateway WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを Microsoft Sentinel に送信します。攻撃を検出し、WAF テレメトリを Azure 環境全体に統合します。",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "text": "従来のWAF構成のかわりにWAFポリシーを使用します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
- "severity": "高い",
- "text": "Azure Key Vault を使用して、シークレットと資格情報を格納します。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
+ "severity": "中程度",
+ "text": "バックエンドの受信トラフィックをフィルター処理して、Application Gateway サブネット (NSG など) からの接続のみを受け入れるようにします。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
- "severity": "中程度",
- "text": "アプリケーションやリージョンごとに異なる Azure Key Vault を使用して、トランザクションのスケール制限を回避し、シークレットへのアクセスを制限します。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "バックエンド サーバーへのトラフィックを暗号化する必要があります。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "中程度",
- "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "Web アプリケーション ファイアウォールを使用する必要があります。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "中程度",
- "text": "最小特権モデルに従って、キー、シークレット、証明書を完全に削除する承認を、特殊なカスタム Microsoft Entra ID ロールに制限します。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "公開認証局を使用して証明書の管理と更新プロセスを自動化し、管理を容易にします。",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "HTTP を HTTPS にリダイレクトする",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "キーと証明書のローテーションのための自動化されたプロセスを確立します。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "安全"
+ "text": "ゲートウェイで管理される Cookie を使用して、ユーザーセッションからのトラフィックを同じサーバーに転送して処理する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "中程度",
- "text": "コンテナーでファイアウォールと仮想ネットワーク サービス エンドポイントまたはプライベート エンドポイントを有効にして、キー コンテナーへのアクセスを制御します。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
+ "severity": "高い",
+ "text": "計画されたサービス更新中に接続ドレインを有効にして、バックエンド プールの既存のメンバーへの接続が失われないようにします",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
- "severity": "中程度",
- "text": "プラットフォーム中央の Azure Monitor Log Analytics ワークスペースを使用して、Key Vault の各インスタンス内のキー、証明書、シークレットの使用状況を監査します。",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "安全"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
+ "severity": "低い",
+ "text": "カスタムエラーページを作成して、パーソナライズされたユーザーエクスペリエンスを表示する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Key Vault のインスタンス化と特権アクセスを委任し、Azure Policy を使用して一貫した準拠構成を適用します。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "text": "HTTP 要求と応答ヘッダーを編集して、クライアントとサーバー間のルーティングと情報交換を容易にします",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "安全"
+ "text": "Front Door を構成して、グローバル Web トラフィックのルーティングと最上位のエンドユーザーのパフォーマンス、および迅速なグローバル フェイルオーバーによる信頼性を最適化する",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "独自のキーを持ち込む場合、これは考慮されるすべてのサービスでサポートされているとは限りません。不整合が望ましい結果を妨げないように、適切な軽減策を実装します。レイテンシを最小限に抑える適切なリージョンペアとディザスタリカバリリージョンを選択します。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "安全"
+ "text": "トランスポート層の負荷分散を使用する",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "ソブリン ランディング ゾーンの場合は、Azure Key Vault マネージド HSM を使用してシークレットと資格情報を格納します。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "1 つのゲートウェイ上の複数の Web アプリケーションのホスト名またはドメイン名に基づいてルーティングを構成する",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"severity": "中程度",
- "text": "Microsoft Entra ID レポート機能を使用して、アクセス制御監査レポートを生成します。",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "text": "SSL証明書管理を一元化して、バックエンドサーバーファームからの暗号化と復号化のオーバーヘッドを削減します",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
- "severity": "高い",
- "text": "すべてのサブスクリプションで Defender Cloud セキュリティ態勢管理を有効にします。",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
+ "severity": "低い",
+ "text": "Application Gateway を使用して WebSocket プロトコルと HTTP/2 プロトコルをネイティブにサポートする",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"severity": "高い",
- "text": "すべてのサブスクリプションで、サーバーの Defender Cloud ワークロード保護プランを有効にします。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "text": "ADDS ドメイン コントローラーがネイティブ Azure の ID サブスクリプションにデプロイされていることを確認する",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
- "severity": "高い",
- "text": "すべてのサブスクリプションで Azure リソースの Defender Cloud ワークロード保護プランを有効にします。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure ベースのリソース (Azure VMware Solution を含む) からの認証要求を Azure にローカルに保持するように ADDS サイトとサービスが構成されていることを確認します",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"severity": "高い",
- "text": "IaaS サーバーでエンドポイント保護を有効にします。",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "text": "vCenterがADDに接続されていることを確認し、「名前付きユーザーアカウント」に基づく認証を有効にします",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"severity": "中程度",
- "text": "Azure Monitor ログと Defender for Cloud を使用して、基本オペレーティング システムの修正プログラムのずれを監視します。",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "text": "vCenter から ADDS への接続でセキュア プロトコル (LDAPS) が使用されていることを確認します",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"severity": "中程度",
- "text": "既定のリソース構成を一元化された Azure Monitor Log Analytics ワークスペースに接続します。",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "text": "vCenter IdP の CloudAdmin アカウントは、緊急アカウント(非常用アカウント)としてのみ使用されます",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"severity": "高い",
- "text": "相関ログによる一元的な脅威検出 - セキュリティデータを中央の場所に統合して、SIEM(セキュリティ情報およびイベント管理)を介してさまざまなサービス間で関連付けることができます",
+ "text": "NSX-Manager が外部 ID プロバイダ (LDAPS) と統合されていることを確認します。",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"severity": "中程度",
- "text": "ソブリン ランディング ゾーンの場合は、Entra ID テナントで透明度ログを有効にします。",
+ "text": "VMware vSphere 内で使用するために RBAC モデルが作成されているか",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"severity": "中程度",
- "text": "Sovereign Landing Zone の場合は、Entra ID テナントでカスタマー ロックボックスを有効にします。",
+ "text": "RBAC アクセス許可は、特定のユーザーではなく、ADDS グループに付与する必要があります",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"severity": "高い",
- "text": "ストレージ アカウントへの安全な転送を有効にします。",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "text": "Azure の Azure VMware Solution リソースに対する RBAC アクセス許可は、限られた所有者のセットのみに \"ロックダウン\" されます",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"severity": "高い",
- "text": "ストレージ アカウントのコンテナーの論理的な削除を有効にして、削除されたコンテナーとその内容を回復します。",
+ "text": "すべてのカスタム ロールのスコープが CloudAdmin で許可された承認で設定されていることを確認する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"severity": "高い",
- "text": "Key Vault シークレットを使用して、資格情報 (仮想マシン、ユーザー パスワード)、証明書、キーなどの機密情報のハードコーディングを回避します。",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "オペレーションズ"
+ "text": "お客様のユース ケースに適した Azure VMware Solution 接続モデルが選択されているか",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
- "severity": "低い",
- "text": "ベスト プラクティスについては、「ベースラインの高可用性ゾーン冗長 Web アプリケーション アーキテクチャ」を参照してください",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "オンプレミスから Azure への ExpressRoute または VPN 接続が \"接続モニター\" を使用して監視されていることを確認する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"severity": "中程度",
- "text": "Premium レベルと Standard レベルを使用します。これらの層では、ステージング スロットと自動バックアップがサポートされています。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
- "severity": "高い",
- "text": "リージョンで適用可能な場合は Availability Zones を活用します (Premium v2 または v3 レベルが必要)",
- "waf": "確実"
+ "text": "Azure VMware Solution バックエンドの ExpressRoute 接続を監視するために、Azure ネイティブ リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"severity": "中程度",
- "text": "ヘルスチェックの実装",
- "waf": "確実"
+ "text": "エンド 2 エンドの接続を監視するために、オンプレミス リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"severity": "高い",
- "text": "「Azure App Service のバックアップと復元のベスト プラクティス」を参照してください",
- "waf": "確実"
+ "text": "ルート サーバーを使用する場合は、ルート サーバーから ExR ゲートウェイ、オンプレミスに伝達されるルートが 1000 を超えないようにします (ARS 制限)。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"severity": "高い",
- "text": "Azure App Service の信頼性に関するベスト プラクティスを実装する",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "低い",
- "text": "災害時に App Service アプリを別のリージョンに移動する方法を理解する",
- "waf": "確実"
+ "text": "Azure Portal で Azure VMware Solution リソースを管理するロールに対して Privileged Identity Management が実装されていますか (永続的なアクセス許可は許可されません)",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"severity": "高い",
- "text": "Azure App Service の信頼性サポートについて理解する",
- "waf": "確実"
+ "text": "Privileged Identity Management 監査レポートは、Azure VMware Solution PIM ロールに対して実装する必要がある",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"severity": "中程度",
- "text": "App Service プランで実行されている Function Apps に対して \"Always On\" が有効になっていることを確認する",
- "waf": "確実"
+ "text": "Privileged Identity Management を使用している場合は、Azure VMware Solution のホストの自動置換通知用の有効な SMTP レコードを使用して、有効な Entra ID が有効なアカウントが作成されていることを確認します。(常任許可が必要)",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
- "severity": "中程度",
- "text": "正常性チェックを使用した App Service インスタンスの監視",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "CloudAdmin アカウントの使用を緊急アクセスのみに制限する",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
"severity": "中程度",
- "text": "Application Insights の可用性テストを使用して Web アプリまたは Web サイトの可用性と応答性を監視する",
- "waf": "確実"
+ "text": "vCenter Server でカスタム RBAC ロールを作成して、vCenter 内に最小特権モデルを実装します",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "severity": "低い",
- "text": "Application Insights Standard テストを使用して、Web アプリまたは Web サイトの可用性と応答性を監視する",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "cloudadmin (vCenter) と admin (NSX) の資格情報を定期的にローテーションするように定義されたプロセスです。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Key Vault を使用して、アプリケーションに必要なシークレットを格納します。 Key Vault は、シークレットを格納するための安全で監査された環境を提供し、Key Vault SDK または App Service Key Vault リファレンスを通じて App Service と適切に統合されています。",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"severity": "高い",
- "text": "Key Vault を使用してシークレットを格納する",
+ "text": "一元化された ID プロバイダーを使用して、Azure VMware Solution で実行されているワークロード (VM) に使用する",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "マネージド ID を使用して、Key Vault SDK または App Service Key Vault 参照を使用して Key Vault に接続します。",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "高い",
- "text": "マネージド ID を使用して Key Vault に接続する",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "East-West トラフィック フィルタリングは NSX-T 内に実装されていますか",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service TLS 証明書を Key Vault に格納します。",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"severity": "高い",
- "text": "Key Vault を使用して TLS 証明書を格納します。",
+ "text": "Azure VMware Solution 上のワークロードは、インターネットに直接公開されません。トラフィックは、Azure Application Gateway、Azure Firewall、またはサード パーティのソリューションによってフィルター処理され、検査されます",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "機密情報を処理するシステムは分離する必要があります。 そのためには、個別の App Service プランまたは App Service Environment を使用し、異なるサブスクリプションまたは管理グループの使用を検討してください。",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
- "severity": "中程度",
- "text": "機密情報を処理するシステムを分離する",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "監査とログ記録は、Azure VMware Solution および Azure VMware Solution ベースのワークロードへの受信インターネット要求に対して実装されます",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service のローカル ディスクは暗号化されていないため、機密データを格納しないでください。 (例: D:\\\\Local and %TMP%)。",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
"severity": "中程度",
- "text": "機密データをローカルディスクに保存しない",
+ "text": "セッション監視は、疑わしい/悪意のあるアクティビティを特定するために、Azure VMware Solution または Azure VMware Solution ベースのワークロードからの送信インターネット接続に実装されます",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "認証された Web アプリケーションの場合は、Azure AD や Azure AD B2C などの確立された ID プロバイダーを使用します。 選択したアプリケーション フレームワークを利用して、このプロバイダーと統合するか、App Service の認証/承認機能を使用します。",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"severity": "中程度",
- "text": "認証に確立された ID プロバイダーを使用する",
+ "text": "Azure の ExR/VPN Gateway サブネットで DDoS Standard 保護が有効になっているか",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "適切に管理され、セキュリティで保護された DevOps デプロイ パイプラインなど、制御された信頼できる環境から App Service にコードをデプロイします。これにより、バージョン管理されておらず、悪意のあるホストからデプロイされることが確認されていないコードが回避されます。",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
- "severity": "高い",
- "text": "信頼できる環境からのデプロイ",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "FTP/FTPS と WebDeploy/SCM の両方の基本認証を無効にします。 これにより、これらのサービスへのアクセスが無効になり、デプロイに Azure AD で保護されたエンドポイントの使用が強制されます。 SCM サイトは、Azure AD 資格情報を使用して開くこともできます。",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
- "severity": "高い",
- "text": "基本認証の無効化",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "可能な場合は、マネージド ID を使用して Azure AD のセキュリティで保護されたリソースに接続します。 これが不可能な場合は、Key Vault にシークレットを格納し、代わりにマネージド ID を使用して Key Vault に接続します。",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "severity": "高い",
- "text": "マネージド ID を使用してリソースに接続する",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "専用の特権アクセス ワークステーション (PAW) を使用して、Azure VMware Solution、vCenter、NSX Manager、HCX Manager を管理する",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Container Registry に格納されているイメージを使用する場合は、マネージド ID を使用してこれらをプルします。",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
- "severity": "高い",
- "text": "マネージド ID を使用してコンテナーをプルするPull containers using a Managed Identity",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure VMware Solution で実行されているワークロードに対して Advanced Threat Detection (Microsoft Defender for Cloud 別名 ASC) を有効にする",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service の診断設定を構成することで、ログ記録と監視の中央の宛先として、すべてのテレメトリを Log Analytics に送信できます。これにより、HTTP ログ、アプリケーション ログ、プラットフォーム ログなどの App Service のランタイム アクティビティを監視できます。",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"severity": "中程度",
- "text": "App Service ランタイム ログを Log Analytics に送信する",
+ "text": "Azure ARC for Servers を使用して、Azure ネイティブ テクノロジを使用して Azure VMware Solution で実行されているワークロードを適切に管理します (Azure ARC for Azure VMware Solution はまだ利用できません)",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "ログ記録と監視の中央の宛先としてアクティビティ ログを Log Analytics に送信するための診断設定を設定します。これにより、App Service リソース自体のコントロール プレーンのアクティビティを監視できます。",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
- "severity": "中程度",
- "text": "App Service アクティビティ ログを Log Analytics に送信する",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "Azure VMware Solution 上のワークロードで、実行時に十分なデータ暗号化 (ゲスト内ディスク暗号化や SQL TDE など) が使用されるようにします。(保存時の vSAN 暗号化がデフォルトです)",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "リージョンの VNet 統合、ネットワーク セキュリティ グループ、および UDR の組み合わせを使用して、送信ネットワーク アクセスを制御します。 トラフィックは、Azure Firewall などの NVA にルーティングする必要があります。 ファイアウォールのログを必ず監視してください。",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
- "severity": "中程度",
- "text": "送信ネットワーク アクセスを制御する必要がある",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "ゲスト内暗号化を使用する場合は、可能な場合は Azure Key Vault に暗号化キーを格納します",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "VNet 統合を使用し、VNet NAT ゲートウェイまたは Azure Firewall などの NVA を使用することで、安定した送信 IP を提供できます。 これにより、受信側は必要に応じて IP に基づいて許可リストに登録できます。 多くの場合、Azure サービスへの通信では、IP アドレスに依存する必要はなく、代わりにサービス エンドポイントなどのメカニズムを使用する必要があります。 (また、受信側でプライベート エンドポイントを使用すると、SNAT の発生が回避され、安定した送信 IP 範囲が提供されます)。",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
- "severity": "低い",
- "text": "インターネットアドレスへの送信通信のIPを安定させる",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure VMware Solution で実行されているワークロードには、拡張セキュリティ更新プログラムのサポートの使用を検討してください (Azure VMware Solution は ESU の対象です)",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service のアクセス制限、サービス エンドポイント、またはプライベート エンドポイントの組み合わせを使用して、受信ネットワーク アクセスを制御します。Web アプリ自体と SCM サイトに対して異なるアクセス制限を要求し、構成できます。",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"severity": "高い",
- "text": "受信ネットワーク アクセスを制御する必要がある",
- "waf": "安全"
+ "text": "適切な vSAN データ冗長化方式(RAID 仕様)が使用されていることを確認します。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Application Gateway や Azure Front Door などの Web アプリケーション ファイアウォールを使用して、悪意のある受信トラフィックから保護します。 WAFのログを必ず監視してください。",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"severity": "高い",
- "text": "App Service の前で WAF を使用するUse a WAF in Front of App Service",
- "waf": "安全"
+ "text": "許容障害ポリシーが vSAN ストレージのニーズを満たすために設定されていることを確認します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "WAFのみへのアクセスをロックダウンすることで、WAFをバイパスできないようにします。 アクセス制限、サービス・エンドポイントおよびプライベート・エンドポイントを組み合わせて使用します。",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"severity": "高い",
- "text": "WAFをバイパスすることは避けてください",
- "waf": "安全"
+ "text": "十分なクォータを要求し、拡張とディザスタリカバリの要件を考慮していることを確認します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service の構成で最小 TLS ポリシーを 1.2 に設定します。",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"severity": "中程度",
- "text": "最小 TLS ポリシーを 1.2 に設定します。",
- "waf": "安全"
+ "text": "ESXiへのアクセス制限を理解し、サードパーティのソリューションに影響を与える可能性のあるアクセス制限があることを確認してください。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "HTTPS のみを使用するように App Service を構成します。 これにより、App Service は HTTP から HTTPS にリダイレクトされます。 HTTP Strict Transport Security (HSTS) をコード内または WAF から使用して、サイトに HTTPS を使用してのみアクセスする必要があることをブラウザーに通知することを強く検討してください。",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
- "severity": "高い",
- "text": "HTTPS のみを使用",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "ESXi ホストの密度と効率に関するポリシーがあることを確認し、新しいノードを要求するためのリード タイムを念頭に置いてください",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "CORS 構成では、すべての配信元がサービスにアクセスできるため、ワイルドカードを使用しないでください (これにより、CORS の目的が損なわれます)。具体的には、サービスにアクセスできると予想される配信元のみを許可します。",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
- "severity": "高い",
- "text": "ワイルドカードは CORS に使用しないでください",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure VMware Solution の適切なコスト管理プロセスが整っていることを確認する - Azure Cost Management を使用できます",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "リモート デバッグは、サービスに追加のポートが開き、攻撃対象領域が増加するため、運用環境でオンにしないでください。このサービスは、48 時間後に自動的にリモート デバッグをオフにすることに注意してください。",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
- "severity": "高い",
- "text": "リモートデバッグをオフにする",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "Azure VMware Solution を使用するためのコストを最適化するために Azure 予約インスタンスが使用されているか",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Defender for App Service を有効にします。 これは(他の脅威の中でも)既知の悪意のあるIPアドレスへの通信を検出します。 操作の一環として、Defender for App Service からの推奨事項を確認します。",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"severity": "中程度",
- "text": "Defender for Cloud を有効にする - Defender for App Service",
+ "text": "他の Azure Native Services を使用する場合は、Azure Private-Link の使用を検討してください",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure は、ネットワーク上で DDoS Basic 保護を提供しており、通常のトラフィック パターンを学習し、異常な動作を検出できるインテリジェントな DDoS Standard 機能によって改善できます。DDoS Standard は仮想ネットワークに適用されるため、Application Gateway や NVA など、アプリの前にあるネットワーク リソース用に構成する必要があります。",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "必要なすべてのリソースが同じ Azure 可用性ゾーン内に存在することを確認する",
+ "waf": "パフォーマンス"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"severity": "中程度",
- "text": "WAF VNet で DDoS Protection Standard を有効にするEnable DDOS Protection Standard on the WAF VNet",
+ "text": "Azure VMware Solution ゲスト VM ワークロードに対して Microsoft Defender for Cloud を有効にする",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Container Registry に格納されているイメージを使用する場合は、プライベート エンドポイントとアプリ設定 \"WEBSITE_PULL_IMAGE_OVER_VNET\" を使用して、Azure Container Registry から仮想ネットワーク経由でイメージをプルします。",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
"severity": "中程度",
- "text": "Virtual Network 経由でコンテナーをプルする",
+ "text": "Azure Arc 対応サーバーを使用して Azure VMware Solution ゲスト VM のワークロードを管理する",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "ペネトレーションテストのルールに従って、Webアプリケーションでペネトレーションテストを実施します。",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
- "severity": "中程度",
- "text": "ペネトレーションテストの実施",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
- "severity": "中程度",
- "text": "検証済みコードのデプロイ",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
"severity": "高い",
- "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用",
- "waf": "安全"
+ "text": "Azure VMware Solution での診断ログとメトリック ログを有効にするEnable Diagnostic and metric logging on Azure VMware Solution",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
"severity": "中程度",
- "text": "\"ストレージの Azure セキュリティ ベースライン\" を検討する",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "既定では、Azure Storage にはパブリック IP アドレスがあり、インターネットにアクセス可能です。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースにのみ Azure Storage を安全に公開できるため、パブリック インターネットへの露出を排除できます",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "Azure Storage にプライベート エンドポイントを使用することを検討する",
- "waf": "安全"
+ "text": "Log Analytics エージェントを Azure VMware Solution ゲスト VM ワークロードにデプロイする",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "新しく作成されたストレージ アカウントは、RBAC や監査などがすべて有効になるように、ARM デプロイ モデルを使用して作成されます。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認する",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
"severity": "中程度",
- "text": "古いストレージ アカウントで \"クラシック デプロイ モデル\" が使用されていないことを確認する",
- "waf": "安全"
+ "text": "Azure VMware Solution VM ワークロードのバックアップ ポリシーとソリューションが文書化され、実装されていることを確認します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "すべてのストレージ アカウントに対して Microsoft Defender を有効にする",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Microsoft Defender for Cloud を使用して、Azure VMware Solution で実行されているワークロードのコンプライアンス監視を行う",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "論理的な削除メカニズムを使用すると、誤って削除された BLOB を回復できます。",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
"severity": "中程度",
- "text": "BLOB の \"論理的な削除\" を有効にする",
+ "text": "適用可能なコンプライアンス ベースラインは Microsoft Defender for Cloud に追加されていますか",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "BLOB の '論理的な削除' を無効にする",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "Azure VMware Solution のデプロイに使用する Azure リージョンを選択するときにデータ所在地が評価されましたか",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "コンテナーの論理的な削除を使用すると、コンテナーが削除された後に回復できます (たとえば、偶発的な削除操作から回復します)。",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
"severity": "高い",
- "text": "コンテナーの \"論理的な削除\" を有効にする",
+ "text": "データ処理への影響 (サービス プロバイダー/サービス コンシューマー モデル) が明確で文書化されているか",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"severity": "中程度",
- "text": "コンテナーの \"論理的な削除\" を無効にする",
+ "text": "コンプライアンス上の理由で必要な場合にのみ、vSAN に CMK (カスタマー マネージド キー) を使用することを検討してください。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "削除前に削除ロックを最初に解除するようにユーザーに強制することで、ストレージ アカウントが誤って削除されないようにします",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
"severity": "高い",
- "text": "ストレージ アカウントでのリソース ロックの有効化",
- "waf": "安全"
+ "text": "Azure VMware Solution のコア監視分析情報を有効にするダッシュボードを作成するCreate dashboards to enable a core Azure VMware Solution monitoring insights",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変の BLOB が含まれる場合、そのストレージ アカウントを \"取り除く\" 唯一の方法は、Azure サブスクリプションを取り消すことです。",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"severity": "高い",
- "text": "不変の BLOB を検討する",
- "waf": "安全"
+ "text": "Azure VMware Solution のパフォーマンス (CPU >80%、平均メモリ >80%、vSAN >70%) に関する自動アラートの重大しきい値の警告アラートを作成する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
"severity": "高い",
- "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
- "waf": "安全"
+ "text": "vSAN の消費量が 75% を下回っているかどうかを監視するための重要なアラートが作成されていることを確認します (これは VMware からのサポートしきい値です)。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要があります。",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"severity": "高い",
- "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
- "waf": "安全"
+ "text": "Azure Service Health のアラートと通知に対してアラートが構成されていることを確認する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報が失われるリスクを最小限に抑えることができます。",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"severity": "中程度",
- "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
- "waf": "安全"
+ "text": "処理のために Azure Storage アカウントまたは Azure EventHub に送信するように Azure VMware Solution ログを構成する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "AAD トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "BLOB アクセスに Azure Active Directory (Azure AD) トークンを使用する",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "VMware vSphere での詳細な分析情報が必要な場合:vRealize Operations や vRealize Network Insights がソリューションで使用されていますか?",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のあるデータの誤用の両方を防ぐことができます。",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
- "severity": "中程度",
- "text": "IaM アクセス許可の最小特権",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "仮想マシンの vSAN ストレージ ポリシーはシック プロビジョニングを適用するため、このポリシーがデフォルトのストレージ ポリシーではないことを確認します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によってセキュリティで保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "vSAN は有限のリソースであるため、vSphere コンテンツ ライブラリが vSAN に配置されていないことを確認する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰がいつキーのコピーを取得したかを監視できますが、キーが複数の人の手に渡ると、使用状況を特定のユーザーに帰属させることは不可能です。AAD 認証のみに依存することで、ストレージへのアクセスをユーザーに結び付けやすくなります。",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "ストレージ アカウント キーを無効にして、AAD アクセス (およびユーザー委任 SAS) のみがサポートされるようにすることを検討してください。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティ (ストレージ アカウント キー、アクセス ポリシーなど) が \"いつ、誰が、何を、\"どのように\" 表示または変更されているかを特定します。",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "Azure Monitor を使用して、ストレージ アカウントに対するコントロール プレーン操作を監査することを検討してください",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "キーの有効期限ポリシーを使用すると、アカウントアクセスキーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
"severity": "中程度",
- "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
- "waf": "安全"
+ "text": "バックアップ ソリューションのデータ リポジトリが vSAN ストレージの外部に保存されていることを確認します。Azure ネイティブまたはディスク プールでバックアップされるデータストア上",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS 有効期限ポリシーでは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーがサービス SAS またはアカウント SAS を、推奨間隔よりも長い有効期間で生成すると、警告が表示されます。",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
"severity": "中程度",
- "text": "SAS 有効期限ポリシーの構成を検討する",
- "waf": "安全"
+ "text": "Azure Arc for Servers を使用して Azure VMware Solution で実行されているワークロードがハイブリッド管理されていることを確認する (Arc for Azure VMware Solution はプレビュー段階です)",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "保存されているアクセス ポリシーを使用すると、ストレージ アカウント キーを再生成することなく、サービス SAS のアクセス許可を取り消すことができます。",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"severity": "中程度",
- "text": "保存されているアクセス ポリシーに SAS をリンクすることを検討する",
- "waf": "安全"
+ "text": "Azure VMware Solution で実行されているワークロードが Azure Log Analytics と Azure Monitor を使用して監視されていることを確認する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"severity": "中程度",
- "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するようにアプリケーションのソース コード リポジトリを構成することを検討してください。",
- "waf": "安全"
+ "text": "Azure VMware Solution で実行されているワークロードを、既存の更新プログラム管理ツールまたは Azure Update Management に含める",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに用意することを検討してください。",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "接続文字列を Azure KeyVault に格納することを検討する (マネージド ID が不可能なシナリオの場合)",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure Policy を使用して、Azure の管理、監視、セキュリティ ソリューションに Azure VMware Solution ワークロードをオンボードする",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "アドホック SAS サービス SAS またはアカウント SAS で、有効期限が近づいています。このように、SAS が侵害された場合でも、有効期間は短時間です。この方法は、保存されているアクセス ポリシーを参照できない場合に特に重要です。また、有効期限が近いと、BLOB にアップロードできる時間が制限されるため、BLOB に書き込めるデータの量も制限されます。",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "アドホックSASの有効期間を短くする",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "Azure VMware Solution で実行されているワークロードが Microsoft Defender for Cloud にオンボードされていることを確認する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS を作成するときは、できるだけ具体的かつ制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
"severity": "中程度",
- "text": "SAS に狭いスコープを適用する",
- "waf": "安全"
+ "text": "vSAN は有限のリソースであるため、バックアップが vSAN に保存されないようにする",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS には、SAS を使用してリソースを要求する権限をクライアント IP アドレスまたはアドレス範囲に与えるパラメーターを含めることができます。",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"severity": "中程度",
- "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
- "waf": "安全"
+ "text": "すべてのDRソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS は、クライアントがアップロードするデータの量を制限できません。時間の経過に伴うストレージ容量の価格モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "低い",
- "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "ディザスター リカバリー テクノロジがネイティブの Azure IaaS の場合は、Azure Site Recovery を使用します",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "\"ローカル ユーザー アカウント\" を使用して SFTP 経由で BLOB ストレージにアクセスする場合、\"通常の\" RBAC 制御は適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式はローカル ユーザーだけです",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
"severity": "高い",
- "text": "SFTP: SFTPアクセスの「ローカルユーザー」の数を制限し、時間の経過とともにアクセスが必要かどうかを監査します。",
- "waf": "安全"
+ "text": "いずれかの災害ソリューションで自動復旧計画を使用し、手動タスクを可能な限り回避します",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"severity": "中程度",
- "text": "SFTP: SFTP エンドポイントは、POSIX ライクな ACL をサポートしていません。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "ストレージは、CORS (Cross-Origin Resource Sharing)、つまり、異なるドメインの Web アプリが同一生成元ポリシーを緩めることを可能にする HTTP 機能をサポートしています。CORS を有効にする場合は、CorsRules を最小の特権に保ちます。",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "過度に広範な CORS ポリシーを避ける",
- "waf": "安全"
+ "text": "地政学的リージョンのペアをセカンダリディザスタリカバリ環境として使用する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム マネージド キー (既定) またはカスタマー マネージド キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure Storage に提供するか、クライアント側で暗号化を完全に処理することによって行われます。そのため、機密性の保証を Azure Storage にまったく依存しません。",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
"severity": "高い",
- "text": "保存データの暗号化方法を決定します。データのスレッド モデルを理解します。",
- "waf": "安全"
+ "text": "リージョン間で 2 つの異なるアドレス空間を使用します (例: 10.0.0.0/16 と 192.168.0.0/16)。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
"severity": "中程度",
- "text": "どのプラットフォーム暗号化を使用するか、または使用するかを決定します。",
- "waf": "安全"
+ "text": "ExpressRoute Global Reach は、プライマリとセカンダリの Azure VMware Solution プライベート クラウド間の接続に使用されますか、それともネットワーク仮想アプライアンスを介してルーティングされますか?",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
"severity": "中程度",
- "text": "クライアント側の暗号化を使用するかどうかを決定します。",
- "waf": "安全"
+ "text": "すべてのバックアップソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[ MABS/CommVault/Metallic.io/Veeam/ . ]",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを検索します。",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
- "severity": "高い",
- "text": "パブリック BLOB アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "バックアップ ソリューションを Azure VMware Solution プライベート クラウドと同じリージョンにデプロイする",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
"severity": "中程度",
- "text": "Azure Spring Apps では、アプリごとに 2 つのデプロイが許可され、そのうちの 1 つだけが運用トラフィックを受信します。ブルーグリーンデプロイ戦略により、ダウンタイムをゼロにすることができます。ブルー グリーン デプロイは、Standard レベルと Enterprise レベルでのみ使用できます。CI/CD と ADO/GitHub Actions を使用してデプロイを自動化できます",
+ "text": "バックアップ ソリューションを vSan の外部の Azure ネイティブ コンポーネントにデプロイする",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "Azure Spring Apps インスタンスは、アプリケーション用に複数のリージョンに作成でき、トラフィックは Traffic Manager/Front Door によってルーティングできます。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "Azure プラットフォームによって管理されている VMware コンポーネントの復元を要求するプロセスは用意されていますか?",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "サポートされているリージョンでは、Azure Spring Apps をゾーン冗長としてデプロイできるため、インスタンスは可用性ゾーン間で自動的に分散されます。この機能は、Standard レベルと Enterprise レベルでのみ使用できます。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "手動デプロイの場合、すべての構成とデプロイを文書化する必要があります",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "アプリに複数のアプリ インスタンスを使用する",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "手動デプロイの場合は、Azure VMware Solution プライベート クラウドでの偶発的なアクションを防ぐために、リソース ロックの実装を検討してください",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "Azure Spring Apps をログ、メトリック、トレースで監視します。ASA を Application Insights と統合し、障害を追跡し、ブックを作成します。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "自動デプロイの場合は、最小限のプライベート クラウドをデプロイし、必要に応じてスケーリングします",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "Spring Cloud Gateway で自動スケーリングを設定する",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "自動デプロイの場合は、デプロイを開始する前にクォータを要求または予約します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
"severity": "低い",
- "text": "Standard 従量課金プランと専用プランのアプリの自動スケーリングを有効にします。",
- "waf": "確実"
+ "text": "自動デプロイの場合は、適切なガバナンスのために、自動化または Azure Policy を使用して関連するリソース ロックが作成されていることを確認します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
- "severity": "中程度",
- "text": "ミッション クリティカルなアプリの Spring Boot の商用サポートには、Enterprise プランを使用します。他のレベルでは、OSS のサポートを受けることができます。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "ExR 認証キーに人間が理解できる名前を実装して、キーの目的/用途を簡単に識別できるようにします",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "高い",
- "text": "Key Vault のベスト プラクティス (分離の推奨事項、アクセス制御、データ保護、バックアップ、ログ記録など) について理解しておいてください。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "Azure VMware Solution と ExpressRoute のデプロイに個別のサービス プリンシパルを使用する場合は、キー コンテナーを使用してシークレットと承認キーを格納します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "Azure VMware Solution では限られた数の並列操作しかサポートされないため、Azure VMware Solution に多くのリソースをデプロイする必要がある場合に、IaC でアクションをシリアル化するためのリソースの依存関係を定義します。",
+ "waf": "オペレーションズ"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
+ "severity": "低い",
+ "text": "単一の Tier-1 ゲートウェイで NSX-T セグメントの自動構成を実行する場合は、NSX-Manager API ではなく Azure Portal API を使用します",
+ "waf": "オペレーションズ"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
"severity": "中程度",
- "text": "Key Vault はマネージド サービスであり、Microsoft はリージョン内およびリージョン間のフェールオーバーを処理します。Key Vault の可用性と冗長性について理解しておいてください。",
- "waf": "確実"
+ "text": "自動スケールアウトを使用する場合は、Azure VMware Solution を実行しているサブスクリプションに対して十分な Azure VMware Solution クォータを申請してください",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"severity": "中程度",
- "text": "キー コンテナーの内容は、リージョン内と少なくとも 150 マイル離れたセカンダリ リージョンにレプリケートされますが、キーとシークレットの高い持続性を維持するために、同じ地域内でレプリケートされます。Key Vault のデータ レプリケーションについて理解しておいてください。",
- "waf": "確実"
+ "text": "自動スケールインを使用する場合は、そのようなアクションを実行する前に、ストレージ ポリシーの要件を必ず考慮してください",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"severity": "中程度",
- "text": "フェールオーバー中は、アクセス ポリシーまたはファイアウォールの構成と設定を変更することはできません。キー コンテナーは、フェールオーバー中は読み取り専用モードになります。Key Vault のフェールオーバー ガイダンスについて理解しておいてください。",
- "waf": "確実"
+ "text": "スケーリング操作は、一度に 1 つのスケール操作しか実行できないため、常に 1 つの SDDC 内でシリアル化する必要があります (複数のクラスタが使用されている場合でも)",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
"severity": "中程度",
- "text": "シークレット、キー、証明書などのキー コンテナー オブジェクトをバックアップすると、バックアップ操作によってオブジェクトが暗号化された BLOB としてダウンロードされます。この BLOB は、Azure の外部で暗号化を解除できません。この BLOB から使用可能なデータを取得するには、BLOB を同じ Azure サブスクリプションと Azure 地域内のキー コンテナーに復元する必要があります。Key Vault のバックアップと復元のガイダンスについて理解しておいてください。",
- "waf": "確実"
+ "text": "アーキテクチャで使用されるサードパーティソリューションでのスケーリング操作を検討および検証します(サポートされているかどうか)",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "高い",
- "text": "シークレットの偶発的または悪意のある削除に対する保護が必要な場合は、キー コンテナーで論理的な削除と消去保護機能を構成します。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "自動化で環境のスケールイン/スケールアウトの上限を定義して適用する",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "低い",
- "text": "Key Vault の論理的に削除されたリソースは、90 暦日の一定期間保持されます。Key Vault の論理的な削除のガイダンスについて理解しておいてください。",
- "waf": "確実"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "監視ルールを実装して、自動スケーリング操作を監視し、成功と失敗を監視して、適切な (自動化された) 応答を有効にします",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "低い",
- "text": "Key Vault のバックアップの制限事項を理解します。Key Vault では、キー、シークレット、または証明書オブジェクトの過去のバージョンを 500 個以上バックアップする機能はサポートされていません。キー、シークレット、または証明書オブジェクトをバックアップしようとすると、エラーが発生する可能性があります。以前のバージョンのキー、シークレット、または証明書を削除することはできません。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "MONを使用する場合は、同時に構成されたVMの制限(HCXのMON制限[400 - 標準、1000 - 大規模アプライアンス])に注意してください",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "確実"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "低い",
- "text": "現在、Key Vault では 1 回の操作でキー コンテナー全体をバックアップする方法は提供されておらず、キー、シークレット、証明書を個別にバックアップする必要があります。Key Vault のバックアップと復元のガイダンスについて理解しておいてください。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "MON を使用する場合、100 を超えるネットワーク拡張で MON を有効にすることはできません",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "確実"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"severity": "中程度",
- "text": "データの損失を防ぐために、暗号化にキーを使用する場合は、パージ保護をお勧めします。消去保護はオプションの Key Vault の動作であり、既定では有効になっていません。消去保護は、論理的な削除が有効になった場合にのみ有効にできます。CLI、PowerShell、またはポータルを使用してオンにすることができます。",
- "waf": "確実"
+ "text": "移行に VPN 接続を使用する場合は、それに応じて MTU サイズを調整します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
"severity": "中程度",
- "text": "RBAC は、キー コンテナーへのアクセスを制御するために推奨されます。Key Vault のアクセス制御ガイダンスについて理解しておいてください。",
- "waf": "安全"
+ "text": "Azure に接続する接続性の低いリージョン (500 Mbps 以下) の場合は、HCX WAN 最適化アプライアンスのデプロイを検討してください",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus Premium は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
- "severity": "低い",
- "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
+ "severity": "中程度",
+ "text": "移行がオンプレミスアプライアンスから開始され、クラウドアプライアンスから開始されていないことを確認します(逆移行は実行しないでください)",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "クライアント アプリケーションと Azure Service Bus 名前空間間の通信は、トランスポート層セキュリティ (TLS) を使用して暗号化されます。Azure Service Bus 名前空間を使用すると、クライアントは TLS 1.0 以上でデータを送受信できます。より厳格なセキュリティ対策を適用するために、クライアントが新しいバージョンの TLS を使用してデータを送受信することを要求するように Service Bus 名前空間を構成できます。",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"severity": "中程度",
- "text": "要求に対して最低限必要なバージョンの Transport Layer Security (TLS) を適用する",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "安全"
+ "text": "Azure NetApp Files を使用して Azure VMware Solution のストレージを拡張する場合は、VM に直接接続するのではなく、これを VMware データストアとして使用することを検討してください。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Service Bus 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前の SAS ルールが自動的に作成されます。このポリシーには、名前空間全体に対する Manage アクセス許可があります。このルールは管理ルート アカウントのように扱い、アプリケーションで使用しないことをお勧めします。 RBAC を使用した認証プロバイダーとして AAD を使用することをお勧めします。",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"severity": "中程度",
- "text": "必要のないときに root アカウントを使用することは避けてください",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "安全"
+ "text": "専用の ExpressRoute ゲートウェイが外部データ ストレージ ソリューションに使用されていることを確認する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure App Service アプリケーション内、または Azure リソースのサポートに対して有効なマネージド エンティティを持つ仮想マシンで実行されている Service Bus クライアント アプリは、SAS のルールとキー、またはその他のアクセス トークンを処理する必要はありません。クライアント アプリに必要なのは、Service Bus メッセージング名前空間のエンドポイント アドレスのみです。",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"severity": "中程度",
- "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Service Bus に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに持つことを検討してください",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "text": "外部データ ストレージ ソリューションに使用されている ExpressRoute ゲートウェイで FastPath が有効になっていることを確認します",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus のアクセス許可は、キュー、トピック、サブスクリプションなどの個々のリソース レベルにスコープを設定でき、またそうする必要があります。",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
"severity": "高い",
- "text": "最小特権データ プレーン RBAC を使用する",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus リソース ログには、操作ログ、仮想ネットワーク、IP フィルタリング ログが含まれます。ランタイム監査ログは、Service Bus でのさまざまなデータ プレーン アクセス操作 (メッセージの送受信など) の集計された診断情報をキャプチャします。",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
- "severity": "中程度",
- "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用してリソース ログとランタイム監査ログをトレースする (現在は Premium レベルでのみ使用できます)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "安全"
+ "text": "ストレッチ クラスタを使用している場合は、選択したディザスタ リカバリ ソリューションがベンダーによってサポートされていることを確認します",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Service Bus の間のトラフィックは、Microsoft のバックボーン ネットワークを経由します。それに加えて、パブリックエンドポイントが使用されていない場合は無効にする必要があります。",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
- "severity": "中程度",
- "text": "プライベート エンドポイントを使用して Azure Service Bus にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "ストレッチ クラスターを使用する場合は、提供される SLA が要件を満たしていることを確認します",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを IPv4 アドレスのセットのみ、または CIDR (Classless Inter-Domain Routing) 表記の IPv4 アドレス範囲のみにさらに制限できます。",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
- "severity": "中程度",
- "text": "特定の IP アドレスまたは範囲からのみ Azure Service Bus 名前空間へのアクセスを許可することを検討してください",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線が接続ハブに接続されていることを確認します。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"severity": "高い",
- "text": "Availability Zones (リージョンで適用可能な場合) を活用する (これは自動的に有効になります)",
+ "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線で GlobalReach が有効になっていることを確認します。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "中程度",
- "text": "Microsoft が開始するフェールオーバーに注意してください。これらは、まれに、影響を受けるリージョンから対応する geo ペア リージョンにすべての IoT ハブをフェールオーバーするために Microsoft によって実行されます。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
+ "severity": "高い",
+ "text": "サイトの耐障害性の設定を適切に検討し、必要に応じてビジネスに合わせて変更しましたか?",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
- "severity": "高い",
- "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
+ "severity": "中程度",
+ "text": "フレキシブル サーバーの活用",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"severity": "高い",
- "text": "手動フェールオーバーをトリガーする方法を学習します。",
+ "text": "Availability Zones (地域的に適用可能な場合) を活用する",
"waf": "確実"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
- "severity": "高い",
- "text": "フェールオーバー後にフェールバックする方法を学習します。",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
+ "severity": "中程度",
+ "text": "リージョン間の DR シナリオでのデータイン レプリケーションの活用",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door でカスタマー マネージド TLS 証明書を使用する場合は、\"最新\" の証明書バージョンを使用します。証明書の手動更新による停止のリスクを軽減します。",
+ "text": "グローバルレベルでのエラー処理ポリシーの実装",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door と WAF ポリシーを使用して、複数の Azure リージョンにまたがるグローバル HTTP/S アプリを提供し、保護します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "text": "すべての API ポリシーに要素が含まれていることを確認します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"severity": "中程度",
- "text": "Front Door と Application Gateway を使用して HTTP/S アプリを保護する場合は、Front Door で WAF ポリシーを使用します。Application Gateway をロックダウンして、Front Door からのトラフィックのみを受信します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "text": "ポリシーフラグメントを使用して、複数の API で同じポリシー定義を繰り返さないようにする",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
- "severity": "高い",
- "text": "Front Door の WAF ポリシーを \"防止\" モードでデプロイし、Web アプリケーション ファイアウォールがトラフィックを許可または拒否するための適切なアクションを実行するようにします。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
- "severity": "高い",
- "text": "Traffic Manager を Front Door の後ろに配置しないでください。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
- "severity": "高い",
- "text": "Azure Front Door と配信元で同じドメイン名を使用します。ホスト名が一致しないと、微妙なバグが発生する可能性があります。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "低い",
- "text": "Azure Front Door の配信元グループに配信元が 1 つしかない場合は、正常性プローブを無効にします。",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door の適切な正常性プローブ エンドポイントを選択します。アプリケーションのすべての依存関係をチェックする正常性エンドポイントの構築を検討してください。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
- "severity": "低い",
- "text": "Azure Front Door で HEAD 正常性プローブを使用して、Front Door がアプリケーションに送信するトラフィックを減らします。",
- "waf": "パフォーマンス"
+ "text": "API の収益化を計画している場合は、「収益化のサポート」の記事でおすすめの方法をご確認ください",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"severity": "高い",
- "text": "Azure Front Door でマネージド TLS 証明書を使用します。運用コストと、証明書の更新による停止のリスクを軽減します。",
+ "text": "診断設定を有効にしてログを Azure Monitor にエクスポートする",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。",
+ "text": "Application Insights を有効にして、より詳細なテレメトリを実現する",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "高い",
- "text": "Azure Front Door でエンド ツー エンド TLS を使用します。クライアントから Front Door への接続、および Front Door から配信元への接続には TLS を使用します。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
- "severity": "中程度",
- "text": "Azure Front Door で HTTP から HTTPS へのリダイレクトを使用します。古いクライアントを自動的に HTTPS リクエストにリダイレクトすることで、クライアントをサポートします。",
- "waf": "安全"
+ "text": "最も重要なメトリックに関するアラートを構成する",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"severity": "高い",
- "text": "Azure Front Door WAF を有効にします。さまざまな攻撃からアプリケーションを保護します。",
+ "text": "カスタム SSL 証明書が Azure Key Vault に格納され、安全にアクセスして更新できるようにする",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"severity": "高い",
- "text": "ワークロードに合わせて Azure Front Door WAF を調整するには、検出モードで WAF を構成して誤検知の検出を減らして修正します。",
+ "text": "Azure AD を使用して API (データ プレーン) への受信要求を保護する",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
- "severity": "高い",
- "text": "Azure Front Door WAF ポリシーで有効になっている要求本文の検査機能を有効にします。",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
+ "severity": "中程度",
+ "text": "Microsoft Entra ID を使用して開発者ポータルでユーザーを認証する",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
- "severity": "高い",
- "text": "Azure Front Door WAF の既定のルール セットを有効にします。デフォルトのルールセットは、一般的な攻撃を検出してブロックします。",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
+ "severity": "中程度",
+ "text": "適切なグループを作成して、製品の可視性を制御します",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
- "severity": "高い",
- "text": "Azure Front Door WAF ボット保護ルール セットを有効にします。ボット ルールは、良いボットと悪いボットを検出します。",
- "waf": "安全"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
+ "severity": "中程度",
+ "text": "バックエンド機能を使用して、冗長な API バックエンド構成を排除します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"severity": "中程度",
- "text": "最新の Azure Front Door WAF ルール セット バージョンを使用します。ルールセットの更新は、現在の脅威の状況を考慮して定期的に更新されます。",
- "waf": "安全"
+ "text": "名前付き値を使用して、ポリシーで使用できる共通の値を格納します",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door WAF にレート制限を追加します。レート制限は、クライアントが誤ってまたは意図的に短時間に大量のトラフィックを送信するのをブロックします。",
- "waf": "安全"
+ "text": "DR の場合は、99.99% の SLA で 2 つ以上のリージョンにスケーリングされたデプロイで Premium レベルを活用します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door WAF のレート制限には高いしきい値を使用します。レート制限のしきい値を高くすると、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多くのリクエストに対する保護を提供します。",
- "waf": "安全"
+ "text": "少なくとも 1 つのユニットを 2 つ以上の可用性ゾーンにデプロイして、SLA を 99.99% に向上させる",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
- "severity": "低い",
- "text": "すべての地理的地域からのトラフィックを想定していない場合は、geo フィルタを使用して、想定外の国からのトラフィックをブロックします。",
- "waf": "安全"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
+ "severity": "高い",
+ "text": "自動バックアップ・ルーチンがあることを確認する",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "中程度",
- "text": "Azure Front Door WAF を使用してトラフィックを geo フィルタリングする場合は、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致できない場合に、正当な要求を誤ってブロックしないようにします。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
- "severity": "中程度",
- "text": "ログとメトリックをキャプチャするには、診断設定をオンにします。リソース アクティビティ ログ、アクセス ログ、正常性プローブ ログ、WAF ログを含めます。アラートを設定します。",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
- "severity": "中程度",
- "text": "Azure Front Door WAF ログを Microsoft Sentinel に送信します。",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
- "severity": "中程度",
- "text": "デプロイ戦略をサポートするルーティング方法を選択します。設定された重み係数に基づいてトラフィックを分散する加重方式は、アクティブ/アクティブモデルをサポートします。プライマリ リージョンがすべてのトラフィックを受信し、バックアップとしてセカンダリ リージョンにトラフィックを送信するように設定する優先度ベースの値は、アクティブ/パッシブ モデルをサポートします。上記の方法とレイテンシを組み合わせて、レイテンシが最も低いオリジンがトラフィックを受信するようにします。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
- "severity": "高い",
- "text": "1 つ以上のバックエンド プールに複数の配信元を持つことで冗長性をサポートします。アプリケーションの冗長インスタンスを常に用意し、各インスタンスがエンドポイントまたはオリジンを公開していることを確認します。これらの配信元は、1 つ以上のバックエンド プールに配置できます。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
- "severity": "中程度",
- "text": "バックエンドへの要求の転送にタイムアウトを設定します。エンドポイントのニーズに応じてタイムアウト設定を調整します。そうしないと、配信元が応答を送信する前に Azure Front Door が接続を閉じる可能性があります。また、すべての配信元のタイムアウトが短い場合は、Azure Front Door の既定のタイムアウトを下げることもできます。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
- "severity": "中程度",
- "text": "アプリケーションにセッション アフィニティが必要かどうかを判断します。高い信頼性要件がある場合は、セッション アフィニティを無効にすることをお勧めします。",
+ "text": "ポリシーを使用して、フェイルオーバー・バックエンドURLとキャッシュを追加し、コールの失敗を減らします。",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
- "severity": "中程度",
- "text": "ホストヘッダーをバックエンドに送信します。バックエンド サービスは、そのホストからのトラフィックのみを受け入れるルールを作成できるように、ホスト名を認識する必要があります。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
- "severity": "中程度",
- "text": "キャッシュをサポートするエンドポイントにはキャッシュを使用します。",
- "waf": "費用"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
"severity": "低い",
- "text": "単一のバックエンド・プールのヘルス・チェックを無効にします。Azure Front Door の配信元グループに配信元が 1 つしか構成されていない場合、これらの呼び出しは不要です。これは、エンドポイントに複数のオリジンを持てない場合にのみ推奨されます。",
- "waf": "費用"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
- "severity": "中程度",
- "text": "セキュリティ レポートを活用するには Premium レベルを使用することをお勧めしますが、Standard Azure Front Door プロファイルでは、組み込みの分析/レポートでトラフィック レポートのみが提供されます。",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
- "severity": "中程度",
- "text": "可能な場合は、ワイルドカード TLS 証明書を使用します。",
+ "text": "高パフォーマンス レベルでログを記録する必要がある場合は、Event Hubs ポリシーを検討してください",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"severity": "中程度",
- "text": "キャッシュ用にアプリケーションのクエリ文字列を最適化します。純粋に静的なコンテンツの場合は、クエリ文字列を無視して、キャッシュを最大限に活用します。アプリケーションでクエリ文字列を使用する場合は、それらをキャッシュキーに含めることを検討してください。キャッシュ キーにクエリ文字列を含めると、Azure Front Door は、構成に基づいてキャッシュされた応答またはその他の応答を提供できます。",
+ "text": "調整ポリシーを適用して、毎秒の要求数を制御する",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"severity": "中程度",
- "text": "ダウンロード可能なコンテンツにアクセスするときは、ファイル圧縮を使用します。",
+ "text": "負荷が増加したときにインスタンスの数をスケールアウトするように自動スケーリングを構成する",
"waf": "パフォーマンス"
},
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
- "severity": "高い",
- "text": "現在クラシック Azure Front Door を使用している場合は、クラシック Azure Front Door は 2027 年 3 月までに非推奨になるため、Standard SKU または Premium SKU への移行を検討してください。",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
- "severity": "中程度",
- "text": "ミッション クリティカルな高可用性シナリオには、Traffic Manager の負荷分散 Azure Front Door とサード パーティの CDN プロバイダー CDN プロファイルの使用を検討してください。",
- "waf": "確実"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
- "severity": "高い",
- "text": "配信元を App Services として Front Door を使用する場合は、アクセス制限を使用して Azure Front Door 経由でのみアプリ サービスへのトラフィックをロックダウンすることを検討してください。",
- "waf": "安全"
- },
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
"service": "APIM",
"severity": "中程度",
- "text": "グローバルレベルでのエラー処理ポリシーの実装",
- "waf": "オペレーションズ"
+ "text": "セルフホステッド ゲートウェイをデプロイする場所は、バックエンド API に近いリージョンが Azure にありません。",
+ "waf": "パフォーマンス"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
"service": "APIM",
"severity": "中程度",
- "text": "すべての API ポリシーに要素が含まれていることを確認します。",
- "waf": "オペレーションズ"
+ "text": "運用環境のワークロードには Premium レベルを使用します。",
+ "waf": "確実"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
"service": "APIM",
"severity": "中程度",
- "text": "ポリシーフラグメントを使用して、複数の API で同じポリシー定義を繰り返さないようにする",
- "waf": "オペレーションズ"
+ "text": "複数リージョン モデルでは、ポリシーを使用して、可用性または待機時間に基づいてリージョン バックエンドに要求をルーティングします。",
+ "waf": "確実"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
"service": "APIM",
- "severity": "中程度",
- "text": "API の収益化を計画している場合は、「収益化のサポート」の記事でおすすめの方法をご確認ください",
- "waf": "オペレーションズ"
+ "severity": "高い",
+ "text": "APIM の制限に注意する",
+ "waf": "確実"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
"service": "APIM",
"severity": "高い",
- "text": "診断設定を有効にしてログを Azure Monitor にエクスポートする",
- "waf": "オペレーションズ"
+ "text": "セルフホステッド ゲートウェイのデプロイに回復性があることを確認します。",
+ "waf": "確実"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
"service": "APIM",
"severity": "中程度",
- "text": "Application Insights を有効にして、より詳細なテレメトリを実現する",
- "waf": "オペレーションズ"
+ "text": "複数リージョンのデプロイに APIM の前で Azure Front Door を使用するUse Azure Front Door in front of APIM for multi-region deployment",
+ "waf": "パフォーマンス"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
"service": "APIM",
- "severity": "高い",
- "text": "最も重要なメトリックに関するアラートを構成する",
- "waf": "オペレーションズ"
+ "severity": "中程度",
+ "text": "仮想ネットワーク (VNet) 内にサービスをデプロイするDeploy the service within a Virtual Network (VNet)",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
"service": "APIM",
- "severity": "高い",
- "text": "カスタム SSL 証明書が Azure Key Vault に格納され、安全にアクセスして更新できるようにする",
+ "severity": "中程度",
+ "text": "ネットワーク セキュリティ グループ (NSG) をサブネットにデプロイして、APIM との間のトラフィックを制限または監視します。",
"waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
"service": "APIM",
- "severity": "高い",
- "text": "Azure AD を使用して API (データ プレーン) への受信要求を保護する",
+ "severity": "中程度",
+ "text": "プライベート エンドポイントをデプロイして、APIM が VNet にデプロイされていない場合に受信トラフィックをフィルター処理します。",
"waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
"service": "APIM",
- "severity": "中程度",
- "text": "Microsoft Entra ID を使用して開発者ポータルでユーザーを認証する",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
- "severity": "中程度",
- "text": "適切なグループを作成して、製品の可視性を制御します",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
- "severity": "中程度",
- "text": "バックエンド機能を使用して、冗長な API バックエンド構成を排除します",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
- "severity": "中程度",
- "text": "名前付き値を使用して、ポリシーで使用できる共通の値を格納します",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
- "severity": "中程度",
- "text": "DR の場合は、99.99% の SLA で 2 つ以上のリージョンにスケーリングされたデプロイで Premium レベルを活用します",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
- "severity": "中程度",
- "text": "少なくとも 1 つのユニットを 2 つ以上の可用性ゾーンにデプロイして、SLA を 99.99% に向上させる",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
- "severity": "高い",
- "text": "自動バックアップ・ルーチンがあることを確認する",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
- "severity": "中程度",
- "text": "ポリシーを使用して、フェイルオーバー・バックエンドURLとキャッシュを追加し、コールの失敗を減らします。",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "低い",
- "text": "高パフォーマンス レベルでログを記録する必要がある場合は、Event Hubs ポリシーを検討してください",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
- "severity": "中程度",
- "text": "調整ポリシーを適用して、毎秒の要求数を制御する",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
- "severity": "中程度",
- "text": "負荷が増加したときにインスタンスの数をスケールアウトするように自動スケーリングを構成する",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
- "severity": "中程度",
- "text": "セルフホステッド ゲートウェイをデプロイする場所は、バックエンド API に近いリージョンが Azure にありません。",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
- "severity": "中程度",
- "text": "運用環境のワークロードには Premium レベルを使用します。",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
- "severity": "中程度",
- "text": "複数リージョン モデルでは、ポリシーを使用して、可用性または待機時間に基づいてリージョン バックエンドに要求をルーティングします。",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
- "severity": "高い",
- "text": "APIM の制限に注意する",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
- "severity": "高い",
- "text": "セルフホステッド ゲートウェイのデプロイに回復性があることを確認します。",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
- "severity": "中程度",
- "text": "複数リージョンのデプロイに APIM の前で Azure Front Door を使用するUse Azure Front Door in front of APIM for multi-region deployment",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
- "severity": "中程度",
- "text": "仮想ネットワーク (VNet) 内にサービスをデプロイするDeploy the service within a Virtual Network (VNet)",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
- "severity": "中程度",
- "text": "ネットワーク セキュリティ グループ (NSG) をサブネットにデプロイして、APIM との間のトラフィックを制限または監視します。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
- "severity": "中程度",
- "text": "プライベート エンドポイントをデプロイして、APIM が VNet にデプロイされていない場合に受信トラフィックをフィルター処理します。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
- "severity": "高い",
- "text": "パブリックネットワークアクセスの無効化",
+ "severity": "高い",
+ "text": "パブリックネットワークアクセスの無効化",
"waf": "安全"
},
{
@@ -6142,3845 +5373,4614 @@
"waf": "安全"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "高い",
+ "text": "Key Vault のベスト プラクティス (分離の推奨事項、アクセス制御、データ保護、バックアップ、ログ記録など) について理解しておいてください。",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "Azure Bot Service の信頼性サポートの推奨事項に従う",
+ "text": "Key Vault はマネージド サービスであり、Microsoft はリージョン内およびリージョン間のフェールオーバーを処理します。Key Vault の可用性と冗長性について理解しておいてください。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "ローカル データ所在地とリージョン コンプライアンスを備えたボットのデプロイ",
+ "text": "キー コンテナーの内容は、リージョン内と少なくとも 150 マイル離れたセカンダリ リージョンにレプリケートされますが、キーとシークレットの高い持続性を維持するために、同じ地域内でレプリケートされます。Key Vault のデータ レプリケーションについて理解しておいてください。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "Azure Bot Service は、グローバル サービスとリージョン サービスの両方に対してアクティブ/アクティブ モードで実行されます。停止が発生した場合、エラーを検出したり、サービスを管理したりする必要はありません。Azure Bot Service は、複数リージョンの地理的アーキテクチャで自動フェールオーバーと自動復旧を自動的に実行します。EU ボット リージョン サービスの場合、Azure Bot Service は、冗長性を確保するために、アクティブ/アクティブ レプリケーションを備えたヨーロッパ内の 2 つの完全なリージョンを提供します。グローバル ボット サービスの場合、使用可能なすべてのリージョン/地域をグローバル フットプリントとして提供できます。",
+ "text": "フェールオーバー中は、アクセス ポリシーまたはファイアウォールの構成と設定を変更することはできません。キー コンテナーは、フェールオーバー中は読み取り専用モードになります。Key Vault のフェールオーバー ガイダンスについて理解しておいてください。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "フレキシブル サーバーの活用",
+ "text": "シークレット、キー、証明書などのキー コンテナー オブジェクトをバックアップすると、バックアップ操作によってオブジェクトが暗号化された BLOB としてダウンロードされます。この BLOB は、Azure の外部で暗号化を解除できません。この BLOB から使用可能なデータを取得するには、BLOB を同じ Azure サブスクリプションと Azure 地域内のキー コンテナーに復元する必要があります。Key Vault のバックアップと復元のガイダンスについて理解しておいてください。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"severity": "高い",
- "text": "Availability Zones (地域的に適用可能な場合) を活用する",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
- "severity": "中程度",
- "text": "リージョン間の DR シナリオでのデータイン レプリケーションの活用",
+ "text": "シークレットの偶発的または悪意のある削除に対する保護が必要な場合は、キー コンテナーで論理的な削除と消去保護機能を構成します。",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
- "severity": "中程度",
- "text": "有効期間の長い取り消し可能なトークンを使用し、トークンをキャッシュし、Microsoft ID ライブラリを使用してサイレントに取得します",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "低い",
+ "text": "Key Vault の論理的に削除されたリソースは、90 暦日の一定期間保持されます。Key Vault の論理的な削除のガイダンスについて理解しておいてください。",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
- "severity": "中程度",
- "text": "サインイン ユーザー フローがバックアップされ、回復性があることを確認します。ユーザーのサインインに使用するコードがバックアップされ、回復可能であることを確認します。外部プロセスとの回復力のあるインターフェース",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "低い",
+ "text": "Key Vault のバックアップの制限事項を理解します。Key Vault では、キー、シークレット、または証明書オブジェクトの過去のバージョンを 500 個以上バックアップする機能はサポートされていません。キー、シークレット、または証明書オブジェクトをバックアップしようとすると、エラーが発生する可能性があります。以前のバージョンのキー、シークレット、または証明書を削除することはできません。",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
- "severity": "中程度",
- "text": "カスタムブランドアセットはCDNでホストする必要がある",
- "waf": "パフォーマンス"
- },
- {
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"severity": "低い",
- "text": "複数のIDプロバイダーを持っている(つまり、Microsoft、Google、Facebookアカウントでログインする)",
+ "text": "現在、Key Vault では 1 回の操作でキー コンテナー全体をバックアップする方法は提供されておらず、キー、シークレット、証明書を個別にバックアップする必要があります。Key Vault のバックアップと復元のガイダンスについて理解しておいてください。",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "VM レベルでの高可用性に関する VM ルールに従う (Premium ディスク、リージョン内の 2 つ以上、異なる可用性ゾーン内)",
+ "text": "データの損失を防ぐために、暗号化にキーを使用する場合は、パージ保護をお勧めします。消去保護はオプションの Key Vault の動作であり、既定では有効になっていません。消去保護は、論理的な削除が有効になった場合にのみ有効にできます。CLI、PowerShell、またはポータルを使用してオンにすることができます。",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"severity": "中程度",
- "text": "複製しないでください!レプリケーションにより、ディレクトリ同期に関する問題が発生する可能性があります",
- "waf": "確実"
+ "text": "RBAC は、キー コンテナーへのアクセスを制御するために推奨されます。Key Vault のアクセス制御ガイダンスについて理解しておいてください。",
+ "waf": "安全"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
"severity": "中程度",
- "text": "マルチリージョンのアクティブ/アクティブを持つ",
+ "text": "Azure Data Factory の FTA 回復性プレイブックの活用",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
- "severity": "中程度",
- "text": "Azure AD Domain Service スタンプを追加のリージョンと場所に追加する",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "高い",
+ "text": "Availability Zones をサポートするリージョンでゾーン冗長パイプラインを使用するUse zone redundant pipelines in regions that support Availability Zones",
"waf": "確実"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
"severity": "中程度",
- "text": "DR にレプリカ セットを使用する",
+ "text": "DevOps を使用して Github と Azure DevOps の統合で ARM テンプレートをバックアップする",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "中程度",
- "text": "Application Gateway v2 SKU を使用していることを確認する",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "text": "セルフホステッド統合ランタイム VM を別のリージョンにレプリケートしてください",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "中程度",
- "text": "Azure Load Balancers に Standard SKU を使用していることを確認します",
- "waf": "安全"
+ "text": "必ず、姉妹リージョンでネットワークをレプリケートまたは複製してください。別のリージョンに VNet のコピーを作成する必要があります",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
- "severity": "中程度",
- "text": "Load Balancer フロントエンドの IP アドレスがゾーン冗長であることを確認します (ゾーン フロントエンドが必要な場合を除く)。",
- "waf": "安全"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "ADF パイプラインで Key Vault が使用されている場合は、Key Vault をレプリケートするために何もする必要はありません。Key Vault はマネージド サービスであり、Microsoft が処理します",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
+ "severity": "低い",
+ "text": "Keyvault 統合を使用している場合は、Keyvault の SLA を使用して可用性を把握します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "Application Gateways v2 は、IP プレフィックスが /24 以上のサブネットにデプロイする必要があります",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
+ "severity": "高い",
+ "text": "Azure Cache for Redis のゾーン冗長を有効にします。Azure Cache for Redis では、Premium レベルと Enterprise レベルでゾーン冗長構成がサポートされています。ゾーン冗長キャッシュでは、同じリージョン内の異なる Azure Availability Zones にノードを配置できます。これにより、データセンターや AZ の停止が単一障害点として排除され、キャッシュの全体的な可用性が向上します。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "description": "リバースプロキシの管理全般、特にWAFの管理は、ネットワーキングよりもアプリケーションに近いため、アプリと同じサブスクリプションに属します。Application Gateway と WAF を接続サブスクリプションに一元化することは、1 つのチームによって管理されている場合は問題ない可能性があります。",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"severity": "中程度",
- "text": "ランディング ゾーン仮想ネットワーク内の受信 HTTP(S) 接続のプロキシに使用される Azure Application Gateway v2 またはパートナー NVA と、それらがセキュリティ保護しているアプリをデプロイします。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "text": "Azure Cache for Redis インスタンスのデータ永続化を構成します。キャッシュ データはメモリに格納されるため、まれに複数のノードで計画外の障害が発生すると、すべてのデータがドロップされる可能性があります。データの完全な損失を回避するために、Redis 永続化では、メモリ内データのスナップショットを定期的に取得し、ストレージ アカウントに格納できます。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"severity": "中程度",
- "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して、DDoS ネットワークまたは IP 保護プランを使用します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "text": "geo 冗長ストレージ アカウントを使用して Azure Cache for Redis データを保持するか、geo 冗長性を使用できない場合はゾーン冗長を使用します",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "中程度",
- "text": "自動スケールは、最小インスタンス数が 2 になるように構成します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "Premium Azure Cache for Redis インスタンスのパッシブ geo レプリケーションを構成します。geo レプリケーションは、2 つ以上の Azure Cache for Redis インスタンス (通常は 2 つの Azure リージョンにまたがる) をリンクするためのメカニズムです。geo レプリケーションは、主にリージョン間のディザスター リカバリー用に設計されています。2 つの Premium レベルのキャッシュ インスタンスは、プライマリ キャッシュへの読み取りと書き込みを提供する方法で geo レプリケーションを介して接続され、そのデータはセカンダリ キャッシュにレプリケートされます。",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "Application Gateway を複数の可用性ゾーンにデプロイする",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
+ "severity": "高い",
+ "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する",
"waf": "確実"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
- "severity": "中程度",
- "text": "Front Door と Application Gateway を使用して HTTP/S アプリを保護する場合は、Front Door で WAF ポリシーを使用します。Application Gateway をロックダウンして、Front Door からのトラフィックのみを受信します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "severity": "高い",
+ "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する",
+ "waf": "確実"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"severity": "高い",
- "text": "Traffic Manager を使用して、HTTP/S 以外のプロトコルにまたがるグローバル アプリを配信します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
"waf": "確実"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
- "severity": "低い",
- "text": "ユーザーが内部アプリケーションへのアクセスのみを必要とする場合、Microsoft Entra ID アプリケーション プロキシは Azure Virtual Desktop (AVD) の代替手段として検討されていますか?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
+ "severity": "高い",
+ "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
+ "waf": "確実"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "中程度",
- "text": "ネットワーク内の着信接続用に開かれるファイアウォール ポートの数を減らすには、Microsoft Entra ID アプリケーション プロキシを使用して、リモート ユーザーに内部アプリケーションへの安全で認証されたアクセスを提供することを検討してください。",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "安全"
+ "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護",
+ "waf": "オペレーションズ"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
"severity": "高い",
- "text": "Load Balancer のアウトバウンド規則の代わりに Azure NAT Gateway を使用して SNAT のスケーラビリティを向上させる",
+ "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する",
"waf": "確実"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
"severity": "高い",
- "text": "Azure Application Gateway WAF ボット保護ルール セットを有効にします。ボット ルールは、良いボットと悪いボットを検出します。",
- "waf": "安全"
+ "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する",
+ "waf": "確実"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
"severity": "高い",
- "text": "Azure Application Gateway WAF ポリシーで要求本文の検査機能が有効になっているかどうかを確認します。",
- "waf": "安全"
+ "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
+ "waf": "確実"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
"severity": "高い",
- "text": "ワークロードの検出モードで Azure Application Gateway WAF を調整します。誤検出を減らします。",
- "waf": "安全"
+ "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
+ "waf": "確実"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
- "severity": "高い",
- "text": "Application Gateway の WAF ポリシーを \"防止\" モードでデプロイします。",
- "waf": "安全"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
+ "severity": "中程度",
+ "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "Azure Application Gateway WAF にレート制限を追加します。レート制限は、クライアントが誤ってまたは意図的に短時間に大量のトラフィックを送信するのをブロックします。",
- "waf": "安全"
+ "text": "Azure Spring Apps では、アプリごとに 2 つのデプロイが許可され、そのうちの 1 つだけが運用トラフィックを受信します。ブルーグリーンデプロイ戦略により、ダウンタイムをゼロにすることができます。ブルー グリーン デプロイは、Standard レベルと Enterprise レベルでのみ使用できます。CI/CD と ADO/GitHub Actions を使用してデプロイを自動化できます",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "Azure Application Gateway WAF のレート制限には高いしきい値を使用します。レート制限のしきい値を高くすると、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多くのリクエストに対する保護を提供します。",
- "waf": "安全"
+ "text": "Azure Spring Apps インスタンスは、アプリケーション用に複数のリージョンに作成でき、トラフィックは Traffic Manager/Front Door によってルーティングできます。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
- "severity": "低い",
- "text": "すべての地理的地域からのトラフィックを想定していない場合は、geo フィルタを使用して、想定外の国からのトラフィックをブロックします。",
- "waf": "安全"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
+ "severity": "中程度",
+ "text": "サポートされているリージョンでは、Azure Spring Apps をゾーン冗長としてデプロイできるため、インスタンスは可用性ゾーン間で自動的に分散されます。この機能は、Standard レベルと Enterprise レベルでのみ使用できます。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "Azure Application Gateway WAF を使用してトラフィックを geo フィルタリングする場合は、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致できない場合に、正当な要求を誤ってブロックしないようにします。",
- "waf": "安全"
+ "text": "アプリに複数のアプリ インスタンスを使用する",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "最新の Azure Application Gateway WAF ルール セット バージョンを使用します。ルールセットの更新は、現在の脅威の状況を考慮して定期的に更新されます。",
- "waf": "安全"
+ "text": "Azure Spring Apps をログ、メトリック、トレースで監視します。ASA を Application Insights と統合し、障害を追跡し、ブックを作成します。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "診断設定を追加して、Azure Application Gateway WAF ログを保存します。",
- "waf": "オペレーションズ"
+ "text": "Spring Cloud Gateway で自動スケーリングを設定する",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "Azure Application Gateway WAF ログを Microsoft Sentinel に送信します。",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "低い",
+ "text": "Standard 従量課金プランと専用プランのアプリの自動スケーリングを有効にします。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"severity": "中程度",
- "text": "Azure Application Gateway WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。",
- "waf": "オペレーションズ"
+ "text": "ミッション クリティカルなアプリの Spring Boot の商用サポートには、Enterprise プランを使用します。他のレベルでは、OSS のサポートを受けることができます。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "従来のWAF構成のかわりにWAFポリシーを使用します。",
- "waf": "オペレーションズ"
+ "text": "「ストレージの Azure セキュリティ ベースライン」を検討する",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "バックエンドの受信トラフィックをフィルター処理して、Application Gateway サブネット (NSG など) からの接続のみを受け入れるようにします。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースのみに Azure Storage を安全に公開できるため、パブリック インターネットへの露出がなくなります",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure Storage のプライベート エンドポイントの使用を検討する",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
- "severity": "高い",
- "text": "バックエンド サーバーへのトラフィックを暗号化する必要があります。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "新しく作成されたストレージ アカウントは ARM デプロイ モデルを使用して作成されるため、RBAC、監査などがすべて有効になります。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認します",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "古いストレージ アカウントが \"クラシック デプロイ モデル\" を使用していないことを確認する",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Web アプリケーション ファイアウォールを使用する必要があります。",
+ "text": "すべてのストレージ アカウントで Microsoft Defender を有効にする",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "論理的な削除メカニズムにより、誤って削除されたブロブを回復できます。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "HTTP を HTTPS にリダイレクトする",
+ "text": "BLOB の '論理的な削除' を有効にする",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "ゲートウェイで管理される Cookie を使用して、ユーザーセッションからのトラフィックを同じサーバーに転送して処理する",
- "waf": "オペレーションズ"
+ "text": "BLOB の '論理的な削除' を無効にする",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "コンテナの論理的な削除を使用すると、コンテナが削除された後に、たとえば、誤って削除した操作から回復するなどして、コンテナを回復できます。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "計画されたサービス更新中に接続ドレインを有効にして、バックエンド プールの既存のメンバーへの接続が失われないようにします",
+ "text": "コンテナの「論理的な削除」を有効にする",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
- "severity": "低い",
- "text": "カスタムエラーページを作成して、パーソナライズされたユーザーエクスペリエンスを表示する",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "コンテナの「論理的な削除」を無効にする",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "HTTP 要求と応答ヘッダーを編集して、クライアントとサーバー間のルーティングと情報交換を容易にします",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "削除する前に、ユーザーに削除ロックを最初に解除するように強制することで、ストレージ アカウントが誤って削除されるのを防ぎます",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "ストレージ アカウントでのリソース ロックの有効化",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "Front Door を構成して、グローバル Web トラフィックのルーティングと最上位のエンドユーザーのパフォーマンス、および迅速なグローバル フェイルオーバーによる信頼性を最適化する",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変 BLOB が含まれている場合、そのストレージ アカウントを \"削除\" する唯一の方法は、Azure サブスクリプションをキャンセルすることです。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "不変ブロブについて考える",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "トランスポート層の負荷分散を使用する",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
- "severity": "中程度",
- "text": "1 つのゲートウェイ上の複数の Web アプリケーションのホスト名またはドメイン名に基づいてルーティングを構成する",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要がある場合があります。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報の損失リスクを最小限に抑えるのに役立ちます。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "SSL証明書管理を一元化して、バックエンドサーバーファームからの暗号化と復号化のオーバーヘッドを削減します",
+ "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "低い",
- "text": "Application Gateway を使用して WebSocket プロトコルと HTTP/2 プロトコルをネイティブにサポートする",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ".最新の TLS バージョンを適用すると、古いバージョンを使用しているクライアントからの要求が拒否されます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "ストレージ アカウントに最新の TLS バージョンを適用する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "共鳴可能なAIのためのメタプロンプトガードレールに従う",
- "waf": "オペレーショナルエクセレンス"
+ "text": "BLOB アクセスに Microsoft Entra ID トークンを使用する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "APIM や AI Central などのソリューションを使用したゲートウェイ パターンを検討して、レート制限、負荷分散、認証、ログ記録を改善します",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをそのセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のある誤用の両方を防ぐことができます。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "IaM アクセス許可の最小特権",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によって保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "AOAI インスタンスの監視を有効にする",
- "waf": "オペレーショナルエクセレンス"
+ "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰が/いつキーのコピーをフェッチしたかを監視することはできますが、キーが複数の人の手に渡ると、特定のユーザーに使用状況を帰属させることはできなくなります。Entra ID認証のみに依存すると、ストレージアクセスをユーザーに結び付けることが容易になります。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "リソースに対して実行されたアクション (サブスクリプション キーの再生成など) によって作成されたアクティビティ ログのエントリや、1 時間に 10 を超えるエラー数などのメトリックしきい値によって作成されたアクティビティ ログのエントリなど、イベントを通知するアラートを作成します",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Microsoft Entra ID アクセス (およびユーザー委任 SAS) のみがサポートされるように、ストレージ アカウント キーを無効にすることを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティが (ストレージ アカウント キー、アクセス ポリシーなど) 表示または変更されているのは「いつ」、「誰が」、「何を」、「どのように」特定します。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "トークンの使用状況を監視して、容量によるサービスの中断を防ぎます",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Azure Monitor を使用して、ストレージ アカウントでのコントロール プレーン操作を監査することを検討してください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "キーの有効期限ポリシーを使用すると、アカウント アクセス キーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "処理された推論トークン、生成された完了トークンなどのメトリックを観察し、レート制限を監視します",
- "waf": "オペレーショナルエクセレンス"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
- "severity": "低い",
- "text": "診断が十分でない場合は、Azure OpenAI の前で Azure API Management などのゲートウェイを使用して、受信プロンプトと送信応答の両方をログに記録することを検討してください (許可されている場合)",
- "waf": "オペレーショナルエクセレンス"
+ "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "コードとしてのインフラストラクチャを使用して、Azure OpenAI Service、モデル デプロイ、およびすべての関連リソースをデプロイします",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 有効期限ポリシーは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーが、推奨間隔よりも長い有効期間でサービス SAS またはアカウント SAS を生成すると、警告が表示されます。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SAS 有効期限ポリシーの構成を検討する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "API キーの代わりにマネージド ID で Microsoft Entra 認証を使用する",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "保存されているアクセス ポリシーでは、ストレージ アカウント キーを再生成しなくても、サービス SAS のアクセス許可を取り消すことができます。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SASを保存されたアクセスポリシーにリンクすることを検討する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "入力と正しい答えを持つ既知のゴールデンデータセットを使用して、システムのパフォーマンス/精度を評価します。PromptFlowの機能を評価に活用します。",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するように、アプリケーションのソース コード リポジトリを構成することを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに持つことを検討してください。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "プロビジョニング済みスループットモデルの使用状況の評価",
- "waf": "パフォーマンス"
+ "text": "Azure KeyVault に接続文字列を格納することを検討してください (マネージド ID が不可能なシナリオの場合)",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "アドホック SAS サービス SAS またはアカウント SAS で短期的な有効期限を使用します。このように、SASが侵害された場合でも、SASは短時間しか有効ではありません。この方法は、保存されたアクセス ポリシーを参照できない場合に特に重要です。有効期限が近いと、BLOB にアップロードできる時間を制限することで、BLOB に書き込むことができるデータの量も制限されます。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "Azure AI コンテンツの安全性を確認して実装する",
- "waf": "オペレーショナルエクセレンス"
+ "text": "アドホックSASの有効期間を短くするよう努める",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "トークンと1分あたりのレスポンスに基づいてシステムのスループットを定義および評価し、要件に合わせます",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SASを作成するときは、できるだけ具体的で制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SAS に狭いスコープを適用する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS には、SAS を使用してリソースを要求する権限を与えられたクライアントの IP アドレスまたはアドレス範囲のパラメーターを含めることができます。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "トークンサイズ、ストリーミングオプションを制限することにより、システムのレイテンシーを改善します",
- "waf": "パフォーマンス"
+ "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "弾力性の要求を見積もり、優先順位に基づいて同期要求とバッチ要求の分離を決定します。優先度が高い場合は同期アプローチを使用し、優先度が低い場合はキューを使用した非同期バッチ処理が推奨されます",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS は、クライアントがアップロードするデータの量を制限することはできません。時間の経過に伴うストレージ量の価格設定モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低い",
+ "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "「ローカル ユーザー アカウント」を使用して SFTP 経由で BLOB ストレージにアクセスする場合、「通常の」RBAC コントロールは適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式は、ローカル ユーザーのみです",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "消費者からの推定需要に基づくトークン消費要件のベンチマーク。プロビジョニングされたスループット ユニットのデプロイを使用している場合は、Azure OpenAI ベンチマーク ツールを使用してスループットを検証することを検討してください",
- "waf": "パフォーマンス"
+ "text": "SFTP: SFTP アクセスの「ローカル ユーザー」の数を制限し、アクセスが必要かどうかを経時的に監査します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "プロビジョニングされたスループットユニット (PTU) を使用している場合は、オーバーフローリクエストに対して Token-Per Minute (TPM) デプロイメントをデプロイすることを検討してください。ゲートウェイを使用して、PTU の制限に達したときに要求を TPM デプロイにルーティングします。",
- "waf": "パフォーマンス"
+ "text": "SFTP: SFTP エンドポイントは POSIX のような ACL をサポートしていません。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージは、CORS(Cross-Origin Resource Sharing)、つまり、異なるドメインのWebアプリが同一生成元ポリシーを緩和できるようにするHTTP機能をサポートしています。CORS を有効にするときは、CorsRules を最小限の特権に保ちます。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "適切なタスクに適したモデルを選択してください。速度、応答の品質、出力の複雑さの間で適切なトレードオフを持つモデルを選択する",
- "waf": "パフォーマンス"
+ "text": "過度に広範なCORSポリシーを避ける",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "微調整によってモデルのパフォーマンスが向上したかどうかを知るための微調整を行わずに、パフォーマンスのベースラインを設定する",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム管理キー (デフォルト) またはカスタマー管理キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure ストレージに提供するか、クライアント側で暗号化を完全に処理することによって行われます。したがって、機密性の保証については Azure Storage にまったく依存しません。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "保存データの暗号化方法を決定します。データのスレッドモデルを理解する。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "低い",
- "text": "複数のOAIインスタンスを複数のリージョンにデプロイする",
- "waf": "確実"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "プラットフォームの暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "クライアント側の暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを見つけます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"severity": "高い",
- "text": "APIM のようなゲートウェイ パターンを使用した再試行とヘルスチェックの実装",
+ "text": "パブリック BLOB の匿名アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "storagev2 アカウントタイプを活用して、パフォーマンスと信頼性を向上させます",
"waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "GRS、ZRS、またはGZRSストレージを活用して、最高の可用性を実現",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "ワークロードに対してTPMとRPMの適切なクォータがあることを確認します",
+ "text": "フェールオーバー後の書き込み操作には、顧客管理のフェールオーバーを使用します",
"waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "HAIツールキットガイダンスの考慮事項を確認し、それらの相互作用の実践をslutionに適用します",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Microsoft マネージド フェールオーバーの詳細を理解する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"severity": "中程度",
- "text": "ファインチューニングが採用されている場合は、リージョン間で個別の微調整モデルをデプロイします",
+ "text": "ソフト削除を有効にする",
"waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"severity": "中程度",
- "text": "重要なデータを定期的にバックアップおよびレプリケートして、データの損失やシステム障害が発生した場合のデータの可用性と回復性を確保します。Azure のバックアップおよびディザスター リカバリー サービスを活用して、データを保護します。",
+ "text": "Azure Bot Service の信頼性サポートの推奨事項に従う",
"waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "Azure AI Search サービス レベルは、SLA を持つために選択する必要があります",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
+ "severity": "中程度",
+ "text": "ローカル データ所在地とリージョン コンプライアンスを備えたボットのデプロイ",
"waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
- "severity": "低い",
- "text": "データと機密性を分類し、埋め込みを生成する前に Microsoft Purview でラベル付けし、生成された埋め込みを同じ感度と分類で処理するようにしてください",
- "waf": "安全"
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
+ "severity": "中程度",
+ "text": "Azure Bot Service は、グローバル サービスとリージョン サービスの両方に対してアクティブ/アクティブ モードで実行されます。停止が発生した場合、エラーを検出したり、サービスを管理したりする必要はありません。Azure Bot Service は、複数リージョンの地理的アーキテクチャで自動フェールオーバーと自動復旧を自動的に実行します。EU ボット リージョン サービスの場合、Azure Bot Service は、冗長性を確保するために、アクティブ/アクティブ レプリケーションを備えたヨーロッパ内の 2 つの完全なリージョンを提供します。グローバル ボット サービスの場合、使用可能なすべてのリージョン/地域をグローバル フットプリントとして提供できます。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "SSE/ディスク暗号化(オプションのBYOKを使用)を使用してRAGに使用されるデータを暗号化",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus Premium は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "低い",
+ "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "データソース間で転送されるデータ、Retrieval-Augmented Generation(RAG)およびLLM通信に使用されるAI検索にTLSが適用されていることを確認します",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "クライアント アプリケーションと Azure Service Bus 名前空間間の通信は、トランスポート層セキュリティ (TLS) を使用して暗号化されます。Azure Service Bus 名前空間を使用すると、クライアントは TLS 1.0 以上でデータを送受信できます。より厳格なセキュリティ対策を適用するために、クライアントが新しいバージョンの TLS を使用してデータを送受信することを要求するように Service Bus 名前空間を構成できます。",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
+ "severity": "中程度",
+ "text": "要求に対して最低限必要なバージョンの Transport Layer Security (TLS) を適用する",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "RBAC を使用して、Azure OpenAI サービスへのアクセスを管理します。ユーザーに適切な権限を割り当て、ユーザーの役割と責任に基づいてアクセスを制限します",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Service Bus 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前の SAS ルールが自動的に作成されます。このポリシーには、名前空間全体に対する Manage アクセス許可があります。このルールは管理ルート アカウントのように扱い、アプリケーションで使用しないことをお勧めします。 RBAC を使用した認証プロバイダーとして AAD を使用することをお勧めします。",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
+ "severity": "中程度",
+ "text": "必要のないときに root アカウントを使用することは避けてください",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure App Service アプリケーション内、または Azure リソースのサポートに対して有効なマネージド エンティティを持つ仮想マシンで実行されている Service Bus クライアント アプリは、SAS のルールとキー、またはその他のアクセス トークンを処理する必要はありません。クライアント アプリに必要なのは、Service Bus メッセージング名前空間のエンドポイント アドレスのみです。",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
"severity": "中程度",
- "text": "データの暗号化、マスキング、または編集技術を実装して、機密データを非表示にしたり、非本番環境で難読化された値に置き換えたり、テストやトラブルシューティングの目的でデータを共有する場合",
+ "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Service Bus に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに持つことを検討してください",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus のアクセス許可は、キュー、トピック、サブスクリプションなどの個々のリソース レベルにスコープを設定でき、またそうする必要があります。",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
"severity": "高い",
- "text": "Azure Defender を利用して、セキュリティの脅威を検出して対応し、監視とアラートのメカニズムを設定して、疑わしいアクティビティや侵害を特定します。Azure Sentinel を活用して高度な脅威の検出と対応を実現",
+ "text": "最小特権データ プレーン RBAC を使用する",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus リソース ログには、操作ログ、仮想ネットワーク、IP フィルタリング ログが含まれます。ランタイム監査ログは、Service Bus でのさまざまなデータ プレーン アクセス操作 (メッセージの送受信など) の集計された診断情報をキャプチャします。",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"severity": "中程度",
- "text": "コンプライアンス規制を遵守するためのデータ保持および廃棄ポリシーを確立します。不要になったデータに対して安全な削除方法を実装し、データの保持と廃棄活動の監査証跡を維持します",
+ "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用してリソース ログとランタイム監査ログをトレースする (現在は Premium レベルでのみ使用できます)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "Content Safety を使用した Prompt シールドと接地検出の実装",
- "waf": "オペレーショナルエクセレンス"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "GDPRやHIPAAなどの関連するデータ保護規制への準拠を確保するには、プライバシー制御を実装し、データ処理活動に必要な同意または許可を取得します。",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Service Bus の間のトラフィックは、Microsoft のバックボーン ネットワークを経由します。それに加えて、パブリックエンドポイントが使用されていない場合は無効にする必要があります。",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
+ "severity": "中程度",
+ "text": "プライベート エンドポイントを使用して Azure Service Bus にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを IPv4 アドレスのセットのみ、または CIDR (Classless Inter-Domain Routing) 表記の IPv4 アドレス範囲のみにさらに制限できます。",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"severity": "中程度",
- "text": "データセキュリティのベストプラクティス、データの安全な取り扱いの重要性、データ侵害に関連する潜在的なリスクについて、従業員を教育します。データセキュリティプロトコルに熱心に従うように促します。",
+ "text": "特定の IP アドレスまたは範囲からのみ Azure Service Bus 名前空間へのアクセスを許可することを検討してください",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "運用データを開発データやテストデータから分離します。本番環境では実際の機密データのみを使用し、開発環境やテスト環境では匿名化されたデータや合成データを利用します。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "データの機密性のレベルが異なる場合は、レベルごとに個別のインデックスを作成することを検討してください。たとえば、一般的なデータ用に 1 つのインデックスを作成し、機密データ用に別のインデックスを作成し、それぞれ異なるアクセス プロトコルで管理することができます",
- "waf": "安全"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "低い",
+ "text": "ベスト プラクティスについては、「ベースラインの高可用性ゾーン冗長 Web アプリケーション アーキテクチャ」を参照してください",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "中程度",
- "text": "分離をさらに一歩進めて、機密性の高いデータセットをサービスの異なるインスタンスに配置します。各インスタンスは、独自のRBACポリシーのセットで制御できます",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "機密情報から生成された埋め込みとベクトルは、それ自体が機密性が高いことを認識します。このデータには、ソースマテリアルと同じ保護対策を提供する必要があります",
- "waf": "安全"
+ "text": "Premium レベルと Standard レベルを使用します。これらの層では、ステージング スロットと自動バックアップがサポートされています。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
"severity": "高い",
- "text": "埋め込みとベクトルを持つデータストアに RBAC を適用し、ロールのアクセス要件に基づいてアクセスのスコープを設定します",
- "waf": "安全"
+ "text": "リージョンで適用可能な場合は Availability Zones を活用します (Premium v2 または v3 レベルが必要)",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "AI サービスのプライベート エンドポイントを構成して、ネットワーク内のサービス アクセスを制限します",
- "waf": "安全"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "ヘルスチェックの実装",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
"severity": "高い",
- "text": "Azure Firewall と UDR を使用して受信と送信のトラフィック制御を厳密に適用し、外部統合ポイントを制限します",
- "waf": "安全"
+ "text": "「Azure App Service のバックアップと復元のベスト プラクティス」を参照してください",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
"severity": "高い",
- "text": "ネットワークのセグメンテーションとアクセス制御を実装して、LLMアプリケーションへのアクセスを許可されたユーザーとシステムのみに制限し、横方向の移動を防ぎます",
- "waf": "安全"
+ "text": "Azure App Service の信頼性に関するベスト プラクティスを実装する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "LLMLingua や gprtrim などのプロンプト圧縮ツールを使用します",
- "waf": "コストの最適化"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "severity": "低い",
+ "text": "災害時に App Service アプリを別のリージョンに移動する方法を理解する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
"severity": "高い",
- "text": "LLM アプリケーションで使用される API とエンドポイントが、マネージド ID、API キー、OAuth などの認証および承認メカニズムで適切に保護され、不正アクセスを防止します。",
- "waf": "安全"
+ "text": "Azure App Service の信頼性サポートについて理解する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
"severity": "中程度",
- "text": "多要素認証などの強力なエンドユーザー認証メカニズムを適用して、LLMアプリケーションおよび関連するネットワークリソースへの不正アクセスを防止します",
- "waf": "安全"
+ "text": "App Service プランで実行されている Function Apps に対して \"Always On\" が有効になっていることを確認する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"severity": "中程度",
- "text": "ネットワーク監視ツールを実装して、疑わしいアクティビティや悪意のあるアクティビティのネットワークトラフィックを検出および分析します。ロギングを有効にしてネットワークイベントをキャプチャし、セキュリティインシデントが発生した場合のフォレンジック分析を容易にします",
- "waf": "安全"
+ "text": "正常性チェックを使用した App Service インスタンスの監視",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
"severity": "中程度",
- "text": "セキュリティ監査と侵入テストを実施して、LLMアプリケーションのネットワークインフラストラクチャのネットワークセキュリティの弱点または脆弱性を特定して対処します",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "severity": "低い",
- "text": "Azure AI Services は、管理を改善するために適切にタグ付けされています",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Application Insights の可用性テストを使用して Web アプリまたは Web サイトの可用性と応答性を監視する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"severity": "低い",
- "text": "Azure AI Service アカウントは、組織の名前付け規則に従います",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Application Insights Standard テストを使用して、Web アプリまたは Web サイトの可用性と応答性を監視する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Key Vault を使用して、アプリケーションに必要なシークレットを格納します。 Key Vault は、シークレットを格納するための安全で監査された環境を提供し、Key Vault SDK または App Service Key Vault リファレンスを通じて App Service と適切に統合されています。",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"severity": "高い",
- "text": "Azure AI サービス リソースの診断ログを有効にする必要がある",
- "waf": "オペレーショナルエクセレンス"
+ "text": "Key Vault を使用してシークレットを格納する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "マネージド ID を使用して、Key Vault SDK または App Service Key Vault 参照を使用して Key Vault に接続します。",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"severity": "高い",
- "text": "セキュリティのため、キーアクセス(ローカル認証)を無効にすることをお勧めします。 キーベースのアクセスを無効にすると、Microsoft Entra IDが唯一のアクセス方法になり、最小限の特権原則ときめ細かな制御を維持できます。",
+ "text": "マネージド ID を使用して Key Vault に接続する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service TLS 証明書を Key Vault に格納します。",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
"severity": "高い",
- "text": "Azure Key Vault を使用して、キーを安全に保存および管理します。LLM アプリケーションのコード内で機密性の高いキーをハードコーディングしたり埋め込んだりすることを避け、マネージド ID を使用して Azure Key Vault から安全に取得します",
+ "text": "Key Vault を使用して TLS 証明書を格納します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "Azure Key Vault に格納されているキーを定期的にローテーションして期限切れにすることで、不正アクセスのリスクを最小限に抑えます。",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "機密情報を処理するシステムは分離する必要があります。 そのためには、個別の App Service プランまたは App Service Environment を使用し、異なるサブスクリプションまたは管理グループの使用を検討してください。",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "機密情報を処理するシステムを分離する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "tiktokenを使用して、会話モードでのトークン最適化のためのトークンサイズを理解します",
- "waf": "コストの最適化"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service のローカル ディスクは暗号化されていないため、機密データを格納しないでください。 (例: D:\\\\Local and %TMP%)。",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "機密データをローカルディスクに保存しない",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "安全なコーディング手法に従って、インジェクション攻撃、クロスサイトスクリプティング(XSS)、セキュリティ設定の誤りなどの一般的な脆弱性を防止します",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "認証された Web アプリケーションの場合は、Azure AD や Azure AD B2C などの確立された ID プロバイダーを使用します。 選択したアプリケーション フレームワークを利用して、このプロバイダーと統合するか、App Service の認証/承認機能を使用します。",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "認証に確立された ID プロバイダーを使用する",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "適切に管理され、セキュリティで保護された DevOps デプロイ パイプラインなど、制御された信頼できる環境から App Service にコードをデプロイします。これにより、バージョン管理されておらず、悪意のあるホストからデプロイされることが確認されていないコードが回避されます。",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"severity": "高い",
- "text": "LLM ライブラリとその他のシステム コンポーネントを定期的に更新し、パッチを適用するプロセスを設定します",
+ "text": "信頼できる環境からのデプロイ",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "FTP/FTPS と WebDeploy/SCM の両方の基本認証を無効にします。 これにより、これらのサービスへのアクセスが無効になり、デプロイに Azure AD で保護されたエンドポイントの使用が強制されます。 SCM サイトは、Azure AD 資格情報を使用して開くこともできます。",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"severity": "高い",
- "text": "Azure OpenAI またはその他の LLM の利用規約、ポリシー、ガイダンス、および許可されたユース ケースを順守する",
- "waf": "オペレーショナルエクセレンス"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "基本モデルと微調整されたモデルおよびトークンのステップサイズのコストの違いを理解する",
- "waf": "コストの最適化"
+ "text": "基本認証の無効化",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "可能な場合は、マネージド ID を使用して Azure AD のセキュリティで保護されたリソースに接続します。 これが不可能な場合は、Key Vault にシークレットを格納し、代わりにマネージド ID を使用して Key Vault に接続します。",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"severity": "高い",
- "text": "可能であれば、呼び出しごとのオーバーヘッドを最小限に抑え、全体的なコストを削減できるバッチ要求。バッチサイズを確実に最適化する",
- "waf": "コストの最適化"
+ "text": "マネージド ID を使用してリソースに接続する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "モデルの使用状況を監視するコスト追跡システムを設定し、その情報を使用してモデルの選択とプロンプトのサイズを通知します",
- "waf": "コストの最適化"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Container Registry に格納されているイメージを使用する場合は、マネージド ID を使用してこれらをプルします。",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "マネージド ID を使用してコンテナーをプルするPull containers using a Managed Identity",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service の診断設定を構成することで、ログ記録と監視の中央の宛先として、すべてのテレメトリを Log Analytics に送信できます。これにより、HTTP ログ、アプリケーション ログ、プラットフォーム ログなどの App Service のランタイム アクティビティを監視できます。",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "中程度",
- "text": "モデル応答あたりのトークン数に上限を設定します。サイズを最適化して、有効な応答に十分な大きさになるようにします",
- "waf": "コストの最適化"
+ "text": "App Service ランタイム ログを Log Analytics に送信する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "ログ記録と監視の中央の宛先としてアクティビティ ログを Log Analytics に送信するための診断設定を設定します。これにより、App Service リソース自体のコントロール プレーンのアクティビティを監視できます。",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "中程度",
- "text": "信頼性のための AI 検索の設定に関するガイダンスを確認します",
- "waf": "オペレーショナルエクセレンス"
+ "text": "App Service アクティビティ ログを Log Analytics に送信する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "リージョンの VNet 統合、ネットワーク セキュリティ グループ、および UDR の組み合わせを使用して、送信ネットワーク アクセスを制御します。 トラフィックは、Azure Firewall などの NVA にルーティングする必要があります。 ファイアウォールのログを必ず監視してください。",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"severity": "中程度",
- "text": "AI Search Vector ストレージの計画と管理",
- "waf": "オペレーショナルエクセレンス"
+ "text": "送信ネットワーク アクセスを制御する必要がある",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "LLMOpsプラクティスを適用して、GenAIアプリケーションのライフサイクル管理を自動化します",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "VNet 統合を使用し、VNet NAT ゲートウェイまたは Azure Firewall などの NVA を使用することで、安定した送信 IP を提供できます。 これにより、受信側は必要に応じて IP に基づいて許可リストに登録できます。 多くの場合、Azure サービスへの通信では、IP アドレスに依存する必要はなく、代わりにサービス エンドポイントなどのメカニズムを使用する必要があります。 (また、受信側でプライベート エンドポイントを使用すると、SNAT の発生が回避され、安定した送信 IP 範囲が提供されます)。",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
+ "severity": "低い",
+ "text": "インターネットアドレスへの送信通信のIPを安定させる",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service のアクセス制限、サービス エンドポイント、またはプライベート エンドポイントの組み合わせを使用して、受信ネットワーク アクセスを制御します。Web アプリ自体と SCM サイトに対して異なるアクセス制限を要求し、構成できます。",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "高い",
- "text": "請求モデルの使用状況の評価 - PAYG と PTU の比較",
- "waf": "コストの最適化"
+ "text": "受信ネットワーク アクセスを制御する必要がある",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "モデルバージョンを切り替える際のプロンプトとアプリケーションの品質を評価する",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Application Gateway や Azure Front Door などの Web アプリケーション ファイアウォールを使用して、悪意のある受信トラフィックから保護します。 WAFのログを必ず監視してください。",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "App Service の前で WAF を使用するUse a WAF in Front of App Service",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "GenAIアプリを評価、監視、改良して、接地性、関連性、精度、一貫性、流暢さなどの機能を確認します。",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "WAFのみへのアクセスをロックダウンすることで、WAFをバイパスできないようにします。 アクセス制限、サービス・エンドポイントおよびプライベート・エンドポイントを組み合わせて使用します。",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "WAFをバイパスすることは避けてください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service の構成で最小 TLS ポリシーを 1.2 に設定します。",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"severity": "中程度",
- "text": "さまざまな検索パラメーターに基づいて Azure AI Search の結果を評価する",
- "waf": "オペレーショナルエクセレンス"
+ "text": "最小 TLS ポリシーを 1.2 に設定します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "精度を向上させる方法としてモデルの微調整を検討するのは、データを使用してプロンプトエンジニアリングやRAGなどの他の基本的なアプローチを試した場合のみです",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "HTTPS のみを使用するように App Service を構成します。 これにより、App Service は HTTP から HTTPS にリダイレクトされます。 HTTP Strict Transport Security (HSTS) をコード内または WAF から使用して、サイトに HTTPS を使用してのみアクセスする必要があることをブラウザーに通知することを強く検討してください。",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "HTTPS のみを使用",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
- "severity": "中程度",
- "text": "プロンプトエンジニアリング手法を使用して、LLM応答の精度を向上させる",
- "waf": "オペレーショナルエクセレンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "CORS 構成では、すべての配信元がサービスにアクセスできるため、ワイルドカードを使用しないでください (これにより、CORS の目的が損なわれます)。具体的には、サービスにアクセスできると予想される配信元のみを許可します。",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "ワイルドカードは CORS に使用しないでください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "リモート デバッグは、サービスに追加のポートが開き、攻撃対象領域が増加するため、運用環境でオンにしないでください。このサービスは、48 時間後に自動的にリモート デバッグをオフにすることに注意してください。",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "リモートデバッグをオフにする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Defender for App Service を有効にします。 これは(他の脅威の中でも)既知の悪意のあるIPアドレスへの通信を検出します。 操作の一環として、Defender for App Service からの推奨事項を確認します。",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"severity": "中程度",
- "text": "GenAIアプリケーションをレッドチーム化",
+ "text": "Defender for Cloud を有効にする - Defender for App Service",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure は、ネットワーク上で DDoS Basic 保護を提供しており、通常のトラフィック パターンを学習し、異常な動作を検出できるインテリジェントな DDoS Standard 機能によって改善できます。DDoS Standard は仮想ネットワークに適用されるため、Application Gateway や NVA など、アプリの前にあるネットワーク リソース用に構成する必要があります。",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"severity": "中程度",
- "text": "エンドユーザーにLLM応答のスコアリングオプションを提供し、これらのスコアを追跡します。",
- "waf": "オペレーショナルエクセレンス"
+ "text": "WAF VNet で DDoS Protection Standard を有効にするEnable DDOS Protection Standard on the WAF VNet",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
- "severity": "高い",
- "text": "クォータ管理の実践を検討する",
- "waf": "コストの最適化"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Container Registry に格納されているイメージを使用する場合は、プライベート エンドポイントとアプリ設定 \"WEBSITE_PULL_IMAGE_OVER_VNET\" を使用して、Azure Container Registry から仮想ネットワーク経由でイメージをプルします。",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "Virtual Network 経由でコンテナーをプルする",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "ペネトレーションテストのルールに従って、Webアプリケーションでペネトレーションテストを実施します。",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"severity": "中程度",
- "text": "APIM ベースのゲートウェイなどのロード バランサー ソリューションを使用して、サービスやリージョン間で負荷と容量を分散します",
- "waf": "オペレーショナルエクセレンス"
+ "text": "ペネトレーションテストの実施",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "低い",
- "text": "AKS Windows ワークロードで必要な場合は、HostProcess コンテナーを使用できます",
- "waf": "確実"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
+ "severity": "中程度",
+ "text": "検証済みコードのデプロイ",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
- "severity": "低い",
- "text": "イベント ドリブン ワークロードを実行する場合は KEDA を使用します",
- "waf": "パフォーマンス"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "高い",
+ "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "低い",
- "text": "Dapr を使用してマイクロサービス開発を容易にする",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Center for SAP solutions (ACSS) は、SAP を Azure 上の最上位のワークロードにする Azure オファリングです。ACSS は、Azure 上の統合ワークロードとして SAP システムを作成および実行し、イノベーションのためのよりシームレスな基盤を提供するエンドツーエンドのソリューションです。新しい Azure ベースの SAP システムと既存の SAP システムの両方の管理機能を利用できます。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
- "severity": "高い",
- "text": "SLA でサポートされる AKS オファリングを使用する",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure では、Linux と Windows での SAP デプロイの自動化がサポートされています。SAP Deployment Automation Framework は、SAP 環境をデプロイ、インストール、保守できるオープンソースのオーケストレーションツールです。",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "オペレーションズ"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "運用データベースのポイントインタイムリカバリを、RTOを満たす任意の時点と時間枠で実行します。ポイントインタイムリカバリには、通常、DBMSレイヤーまたはSAPを介してデータを削除するオペレーターのエラーが含まれます",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "低い",
- "text": "ポッドとデプロイ定義でのディスラプション バジェットの使用",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "バックアップ時間とリカバリ時間をテストして、災害後にすべてのシステムを同時にリストアするための RTO 要件を満たしていることを確認します。",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"severity": "高い",
- "text": "プライベート レジストリを使用する場合は、複数のリージョンにイメージを格納するようにリージョン レプリケーションを構成します",
+ "text": "ペアになっているリージョン間で標準ストレージをレプリケートすることはできますが、データベースや仮想ハード ディスクの保存に標準ストレージを使用することはできません。バックアップをレプリケートできるのは、使用するペアのリージョン間でのみです。他のすべてのデータについては、SQL Server Always On や SAP HANA システム レプリケーションなどのネイティブ DBMS 機能を使用してレプリケーションを実行します。SAP アプリケーション層には、Site Recovery、rsync または robocopy、およびその他のサードパーティ ソフトウェアを組み合わせて使用します。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "低い",
- "text": "kubecost などの外部アプリケーションを使用して、さまざまなユーザーにコストを割り当てます",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Availability Zones を使用して高可用性を実現する場合は、SAP アプリケーション サーバーとデータベース サーバー間の待機時間を考慮する必要があります。レイテンシーの高いゾーンでは、SAP アプリケーション・サーバーとデータベース・サーバーが常に同じゾーンで実行されていることを確認するための運用手順を整備する必要があります。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "オンプレミスからプライマリおよびセカンダリの Azure ディザスター リカバリー リージョンへの ExpressRoute 接続を設定します。また、ExpressRoute を使用する代わりに、オンプレミスからプライマリおよびセカンダリの Azure ディザスター リカバリー リージョンへの VPN 接続を設定することを検討してください。",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "確実"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"severity": "低い",
- "text": "スケールダウンモードを使用してノードを削除/割り当て解除する",
- "waf": "費用"
+ "text": "証明書、シークレット、キーなどのキー コンテナーの内容をリージョン間でレプリケートして、DR リージョンのデータを復号化できるようにします。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"severity": "中程度",
- "text": "必要に応じて、AKS クラスターで複数インスタンスの分割 GPU を使用する",
- "waf": "費用"
+ "text": "プライマリ仮想ネットワークとディザスター リカバリー仮想ネットワークをピアリングします。たとえば、HANA システム レプリケーションの場合、SAP HANA DB 仮想ネットワークをディザスター リカバリー サイトの SAP HANA DB 仮想ネットワークにピアリングする必要があります。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
"severity": "低い",
- "text": "Dev/Test クラスターを実行している場合は、NodePool Start/Stop を使用します。",
- "waf": "費用"
+ "text": "SAP デプロイに Azure NetApp Files ストレージを使用する場合は、少なくとも Premium レベルの 2 つのリージョンに 2 つの Azure NetApp Files アカウントを作成します。",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
- "severity": "中程度",
- "text": "Azure Policy for Kubernetes を使用してクラスターのコンプライアンスを確保する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "ネイティブ・データベース・レプリケーション・テクノロジーを使用して、HAペアのデータベースを同期する必要があります。",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "中程度",
- "text": "ユーザー/システムノードプールを使用してコントロールプレーンからアプリケーションを分離する",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "低い",
- "text": "システム ノードプールにテイントを追加して専用にする",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "プライマリ仮想ネットワーク (VNet) の CIDR は、DR サイトの VNet の CIDR と競合したり、重複したりしないようにする必要があります",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
- "severity": "中程度",
- "text": "イメージにはプライベート レジストリ (ACR など) を使用する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Site Recovery を使用して、アプリケーション サーバーを DR サイトにレプリケートします。Site Recovery は、セントラル サービス クラスター VM を DR サイトにレプリケートするのにも役立ちます。DR を呼び出すときは、DR サイトで Linux Pacemaker クラスターを再構成する必要があります (たとえば、VIP または SBD の置き換え、corosync.conf の実行など)。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
- "severity": "中程度",
- "text": "イメージをスキャンして脆弱性を検出する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "単一障害点に対する SAP ソフトウェアの可用性を検討します。これには、SAP NetWeaver や SAP S/4HANA アーキテクチャ、SAP ABAP や ASCS + SCS で使用される DBMS などのアプリケーション内の単一障害点が含まれます。また、SAP Web Dispatcher などの他のツールも含みます。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"severity": "高い",
- "text": "アプリの分離要件を定義する (名前空間/ノードプール/クラスター)",
- "waf": "安全"
+ "text": "SAP および SAP データベースの場合は、自動フェールオーバー クラスターの実装を検討してください。Windows では、Windows Server フェールオーバー クラスタリングはフェールオーバーをサポートします。Linux では、Linux Pacemaker や SIOS Protection Suite や Veritas InfoScale などのサードパーティツールがフェイルオーバーをサポートしています。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
- "severity": "中程度",
- "text": "CSI シークレット ストア ドライバーを使用して Azure Key Vault にシークレットを格納する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure では、プライマリ VM とセカンダリ VM が DBMS データのストレージを共有するアーキテクチャはサポートされていません。DBMS レイヤーの一般的なアーキテクチャ パターンは、プライマリ VM とセカンダリ VM が使用するものとは異なるストレージ スタックを使用して、データベースを同時にレプリケートすることです。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"severity": "高い",
- "text": "クラスターにサービス プリンシパルを使用する場合は、資格情報を定期的に (四半期ごとなど) 更新します",
- "waf": "安全"
+ "text": "DBMS データとトランザクション/再実行ログ ファイルは、Azure でサポートされているブロック ストレージまたは Azure NetApp Files に格納されます。Azure Files または Azure Premium Files は、SAP ワークロードでの DBMS データや再実行ログ ファイルのストレージとしてサポートされていません。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
- "severity": "中程度",
- "text": "必要に応じて、キー管理サービスの etcd 暗号化を追加します",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Windows の Azure 共有ディスクは、ASCS + SCS コンポーネントと特定の高可用性シナリオに使用できます。フェールオーバー クラスターは、SAP アプリケーション レイヤー コンポーネントと DBMS レイヤー用に別々に設定します。Azure では現在、SAP アプリケーション レイヤー コンポーネントと DBMS レイヤーを 1 つのフェールオーバー クラスターに結合する高可用性アーキテクチャはサポートされていません。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、Confidential Compute for AKS の使用を検討してください",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP アプリケーション レイヤー コンポーネント (ASCS) と DBMS レイヤーのほとんどのフェールオーバー クラスターには、フェールオーバー クラスターの仮想 IP アドレスが必要です。 Azure Load Balancer は、他のすべてのケースで仮想 IP アドレスを処理する必要があります。設計原則の 1 つは、クラスター構成ごとに 1 つのロード バランサーを使用することです。ロード バランサーの Standard バージョン (Standard Load Balancer SKU) を使用することをお勧めします。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
- "severity": "中程度",
- "text": "Defender for Containers の使用を検討する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "フローティング IP がロードバランサーで有効になっていることを確認します",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"severity": "高い",
- "text": "サービス プリンシパルの代わりにマネージド ID を使用するUse managed identities instead of Service Principals",
- "waf": "安全"
+ "text": "高可用性インフラストラクチャをデプロイする前に、選択したリージョンに応じて、Azure 可用性セットと可用性ゾーンのどちらを使用してデプロイするかを決定します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
- "severity": "中程度",
- "text": "認証と AAD の統合 (マネージド統合を使用)",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP コンポーネント (セントラル サービス、アプリケーション サーバー、データベース) のアプリケーションのインフラストラクチャ SLA を満たす場合は、すべてのコンポーネントに対して同じ高可用性オプション (VM、可用性セット、可用性ゾーン) を選択する必要があります。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
- "severity": "中程度",
- "text": "管理者 kubeconfig へのアクセスを制限する (get-credentials --admin)",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "同じ可用性セットに異なる役割のサーバーを混在させないでください。中央サービス VM、データベース VM、アプリケーション VM を独自の可用性セットに保持します",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "中程度",
- "text": "承認と AAD RBAC の統合",
- "waf": "安全"
+ "text": "近接配置グループを使用しない限り、Azure 可用性ゾーン内に Azure 可用性セットをデプロイすることはできません。",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"severity": "高い",
- "text": "Kubernetes で RBAC 特権を制限するために名前空間を使用する",
- "waf": "安全"
+ "text": "可用性セットを作成するときは、使用可能な障害ドメインと更新ドメインの最大数を使用します。たとえば、1 つの可用性セットに 2 つ以上の VM をデプロイする場合は、Azure の計画メンテナンスに加えて、潜在的な物理ハードウェア障害、ネットワーク停止、または電源中断の影響を制限するために、最大数の障害ドメイン (3) と十分な更新ドメインを使用します。障害ドメインのデフォルトの数は 2 で、後でオンラインで変更することはできません。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
- "severity": "中程度",
- "text": "ポッド ID アクセス管理の場合は、Azure AD ワークロード ID (プレビュー) を使用します",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "可用性セットのデプロイで Azure 近接配置グループを使用する場合、3 つの SAP コンポーネント (中央サービス、アプリケーション サーバー、データベース) すべてが同じ近接配置グループに存在する必要があります。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
- "severity": "中程度",
- "text": "AKS 非対話型ログインの場合は、kubelogin (プレビュー) を使用します",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP SID ごとに 1 つの近接配置グループを使用します。グループは Availability Zones または Azure リージョンにまたがっていません",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
- "severity": "中程度",
- "text": "AKS ローカル アカウントを無効にする",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて Just-In-Time クラスター アクセスを構成する",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて AKS の AAD 条件付きアクセスを構成する",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "次のいずれかのサービスを使用して、オペレーティング システムに応じて SAP セントラル サービス クラスターを実行します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
- "severity": "低い",
- "text": "Windows AKS ワークロードで必要な場合は、gMSA を構成します",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "現在、Azure では、同じ Linux Pacemaker クラスターでの ASCS と DB HA の組み合わせはサポートされていません。それらを個々のクラスターに分割します。ただし、最大 5 つの複数の中央サービス クラスターを 1 つの VM のペアに結合できます。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "中程度",
- "text": "より細かく制御するには、マネージドKubelet Identityの使用を検討してください",
- "waf": "安全"
+ "text": "両方の VM を高可用性ペア、可用性セット、または可用性ゾーンにデプロイします。これらの VM は、同じサイズで、同じストレージ構成である必要があります。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
"severity": "中程度",
- "text": "AGIC を使用している場合は、クラスター間で AppGW を共有しないでください",
+ "text": "Azure では、Red Hat Enterprise Linux (RHEL) で実行されている同じ高可用性クラスター上での SAP HANA インスタンスと ASCS/SCS インスタンスと ERS インスタンスのインストールと構成がサポートされています。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "高い",
- "text": "AKS HTTP ルーティング アドオンを使用せず、代わりにアプリケーション ルーティング アドオンでマネージド NGINX イングレスを使用します。",
+ "text": "すべての運用システムを Premium マネージド SSD で実行し、Azure NetApp Files または Ultra Disk Storage を使用します。少なくとも、OS ディスクは Premium レベルにある必要があるため、パフォーマンスの向上と最高の SLA を実現できます。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
- "severity": "中程度",
- "text": "Windows ワークロードの場合は、高速ネットワークを使用します",
- "waf": "パフォーマンス"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"severity": "高い",
- "text": "標準のALBを使用する(基本的なALBとは対照的)",
+ "text": "Azure で SAP HANA を実行するのは、SAP によって認定されたストレージの種類のみにしてください。特定のボリュームは、該当する場合、特定のディスク構成で実行する必要があることに注意してください。これらの構成には、書き込みアクセラレータの有効化と Premium ストレージの使用が含まれます。また、ストレージ上で実行されるファイルシステムが、マシン上で実行される DBMS と互換性があることを確認する必要があります。",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
- "severity": "中程度",
- "text": "Azure CNI を使用する場合は、NodePool に異なるサブネットを使用することを検討してください",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
- "severity": "中程度",
- "text": "プライベート エンドポイント (推奨) または Virtual Network サービス エンドポイントを使用して、クラスターから PaaS サービスにアクセスする",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP ワークロードに使用するストレージのタイプに応じて、高可用性を構成することを検討してください。Azure で使用できる一部のストレージ サービスは Azure Site Recovery でサポートされていないため、高可用性の構成が異なる場合があります。",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "高い",
- "text": "要件に最適な CNI ネットワーク プラグインを選択する (Azure CNI を推奨)",
+ "text": "さまざまなネイティブ Azure ストレージ サービス (Azure Files、Azure NetApp Files、Azure Shared Disk など) は、すべてのリージョンで使用できるとは限りません。そのため、フェールオーバー後に DR リージョンで同様の SAP を設定するには、それぞれのストレージ サービスが DR サイトで提供されていることを確認します。",
"waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "高い",
- "text": "Azure CNI を使用する場合は、ノードあたりのポッドの最大数を考慮して、サブネットのサイズを適切に設定します",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAPシステムのStart-Stopを自動化してコストを管理します。",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "高い",
- "text": "Azure CNI を使用している場合は、最大ポッド数/ノード (既定値は 30) を確認します",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "Azure Premium Storage を SAP HANA と共に使用する場合、Azure Standard SSD ストレージを使用して、コストを意識したストレージ ソリューションを選択できます。ただし、Standard SSD または Standard HDD Azure ストレージを選択すると、個々の VM の SLA に影響することに注意してください。また、非本番環境など、I/O スループットが低く、レイテンシが低いシステムでは、下位シリーズの VM を使用できます。",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "内部アプリの場合、組織は多くの場合、ファイアウォールで AKS サブネット全体を開きます。これにより、ノードへのネットワーク アクセスも開かれ、場合によってはポッドへのネットワーク アクセスも開かれます (Azure CNI を使用している場合)。LoadBalancer の IP が別のサブネットにある場合は、この IP のみをアプリ クライアントで使用できる必要があります。もう 1 つの理由は、AKS サブネット内の IP アドレスが希少なリソースである場合、その IP アドレスをサービスに使用すると、クラスターの最大スケーラビリティが低下することです。",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "低い",
- "text": "プライベート IP LoadBalancer サービスを使用する場合は、(AKS サブネットではなく) 専用サブネットを使用します",
- "waf": "安全"
+ "text": "低コストの代替構成 (多目的) として、非運用 HANA データベース サーバー VM に低パフォーマンスの SKU を選択できます。ただし、E シリーズなどの一部の VM タイプは、HANA 認定 (SAP HANA ハードウェア ディレクトリ) されていないか、1 ミリ秒未満のストレージ待機時間を実現できないことに注意してください。",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"severity": "高い",
- "text": "それに応じて、サービスの IP アドレス範囲のサイズを設定します (クラスターのスケーラビリティが制限されます)。",
- "waf": "確実"
+ "text": "管理グループ、サブスクリプション、リソース グループ、リソースに RBAC モデルを適用する",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、独自のCNIプラグインを追加します",
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "クラウド コネクタを介して SAP クラウド アプリケーションから SAP オンプレミス (IaaS を含む) に ID を転送するためのプリンシパル伝達の強制",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、AKS でノードごとにパブリック IP を構成する",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAML を使用して、SAP Analytics Cloud、SAP Cloud Platform、Business by Design、SAP Qualtrics、SAP C4C with Azure AD などの SAP SaaS アプリケーションに SSO を実装します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "中程度",
- "text": "イングレス コントローラーを使用して、LoadBalancer タイプのサービスで公開する代わりに、Web ベースのアプリを公開します",
- "waf": "確実"
+ "text": "SAML を使用して、SAP Fiori や SAP Web GUI などの SAP NetWeaver ベースの Web アプリケーションに SSO を実装します。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "severity": "低い",
- "text": "エグレス トラフィックをスケーリングするために Azure NAT Gateway を outboundType として使用する",
- "waf": "確実"
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAML を使用して、SAP Fiori や SAP Web GUI などの SAP NetWeaver ベースの Web アプリケーションに SSO を実装します。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "中程度",
- "text": "Azure CNI IP の枯渇を回避するために IP の動的割り当てを使用する",
- "waf": "確実"
+ "text": "SAP NetWeaver SSO またはパートナソリューションを使用して、SAP GUI への SSO を実装することができます。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
- "severity": "高い",
- "text": "セキュリティ要件で義務付けられている場合は、AzFW/NVA を使用してエグレス トラフィックをフィルター処理します",
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP GUIおよびWebブラウザアクセスのSSOには、構成と保守が容易なSNC / Kerberos / SPNEGO(シンプルで保護されたGSSAPIネゴシエーションメカニズム)を実装します。X.509 クライアント証明書を使用した SSO の場合は、SAP SSO ソリューションのコンポーネントである SAP Secure Login Server を検討してください。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"severity": "中程度",
- "text": "パブリック API エンドポイントを使用している場合は、アクセスできる IP アドレスを制限します",
+ "text": "SAP GUIおよびWebブラウザアクセスのSSOには、構成と保守が容易なSNC / Kerberos / SPNEGO(シンプルで保護されたGSSAPIネゴシエーションメカニズム)を実装します。X.509 クライアント証明書を使用した SSO の場合は、SAP SSO ソリューションのコンポーネントである SAP Secure Login Server を検討してください。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
- "severity": "高い",
- "text": "要件で必要な場合は、プライベート クラスターを使用します",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP NetWeaver の OAuth を使用して SSO を実装し、サードパーティまたはカスタムアプリケーションが SAP NetWeaver OData サービスにアクセスできるようにします。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"severity": "中程度",
- "text": "Windows 2019 および 2022 AKS ノードでは、Calico ネットワーク ポリシーを使用できます",
+ "text": "SAP HANA への SSO の実装",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "高い",
- "text": "Kubernetes ネットワーク ポリシー オプションを有効にする (Calico/Azure)",
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure AD は、RISE でホストされている SAP システムの ID プロバイダーと考えてください。詳細については、「サービスと Azure AD の統合」を参照してください。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "高い",
- "text": "Kubernetesネットワークポリシーを使用してクラスタ内のセキュリティを強化",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP にアクセスするアプリケーションの場合は、プリンシパル伝搬を使用して SSO を確立することができます。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
- "severity": "高い",
- "text": "Web ワークロード (UI または API) に WAF を使用するUse a WAF for a web workloads (UI or API)",
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP Identity Authentication Service (IAS) を必要とする SAP BTP サービスまたは SaaS ソリューションを使用している場合は、SAP Cloud Identity Authentication サービスと Azure AD の間に SSO を実装して、それらの SAP サービスにアクセスすることを検討してください。この統合により、SAP IAS はプロキシ ID プロバイダーとして機能し、認証要求を中央ユーザー ストアおよび ID プロバイダーとして Azure AD に転送できます。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
"severity": "中程度",
- "text": "AKS Virtual Network で DDoS Standard を使用するUse DDoS Standard in the AKS Virtual Network",
+ "text": "SAP BTP への SSO の実装",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、会社の HTTP プロキシを追加します",
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP SuccessFactors を使用している場合は、Azure AD 自動ユーザー プロビジョニングの使用を検討してください。この統合により、新しい従業員を SAP SuccessFactors に追加すると、Azure AD でそのユーザー アカウントを自動的に作成できます。必要に応じて、Microsoft 365 または Azure AD でサポートされている他の SaaS アプリケーションでユーザー アカウントを作成できます。メール アドレスを SAP SuccessFactors に書き戻します。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "description": "管理グループの階層を適度にフラットに保ちます (4 つ以下)。",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"severity": "中程度",
- "text": "高度なマイクロサービス通信管理にサービスメッシュの使用を検討する",
- "waf": "安全"
+ "text": "既存の管理グループポリシーをSAPサブスクリプションに適用",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"severity": "高い",
- "text": "最も重要なメトリックに関するアラートを構成します (推奨事項については、「Container Insights」を参照してください)",
+ "text": "緊密に結合されたアプリケーションを同じSAPサブスクリプションに統合して、ルーティングと管理の複雑さを回避",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "低い",
- "text": "Azure Advisor でクラスターの推奨事項を定期的に確認する",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "サブスクリプションをスケールユニットとして活用し、リソースをスケーリングし、環境ごとにサブスクリプションをデプロイすることを検討してください。サンドボックス、非製品、製品",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
- "severity": "低い",
- "text": "AKS 自動証明書のローテーションを有効にする",
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "サブスクリプションのプロビジョニングの一部としてクォータの増加を確認する (例: サブスクリプション内の使用可能な VM コアの合計)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
- "severity": "高い",
- "text": "kubernetes のバージョンを定期的に (四半期ごとなど) アップグレードする定期的なプロセスを行うか、AKS 自動アップグレード機能を使用します",
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "Quota API は、Azure サービスのクォータを表示および管理するために使用できる REST API です。必要に応じて使用を検討してください。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
"severity": "高い",
- "text": "ノードイメージのアップグレードを使用していない場合は、Linuxノードのアップグレードにkuredを使用します",
+ "text": "可用性ゾーンにデプロイする場合は、クォータが承認されたら、VM のゾーン デプロイが使用可能であることを確認してください。サブスクリプション、VM シリーズ、CPU の数、必要な可用性ゾーンを含むサポート リクエストを送信します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "高い",
- "text": "クラスタノードイメージを定期的に(毎週など)アップグレードする定期的なプロセスを用意します",
+ "text": "必要なサービスと機能が、選択したデプロイ リージョン内で使用できることを確認します。ANF、ゾーンなど",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "低い",
- "text": "アプリケーションまたはクラスター構成を複数のクラスターにデプロイするために gitop を検討してください",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "コストの分類とリソースのグループ化に Azure リソース タグを活用します (: BillTo、部門 (または部署)、環境 (運用、ステージ、開発)、階層 (Web 層、アプリケーション層)、アプリケーション所有者、ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
- "severity": "低い",
- "text": "プライベート クラスターで AKS コマンド呼び出しを使用することを検討する",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure Backup サービスを使用して HANA データベースを保護します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "低い",
- "text": "計画されたイベントの場合は、ノードの自動ドレインの使用を検討してください",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "HANA 、 Oracle 、または DB2 データベースに Azure NetApp Files をデプロイする場合は、 Azure アプリケーション整合性スナップショット ツール (AzAcSnap) を使用して、アプリケーション整合性スナップショットを作成します。AzAcSnap は Oracle データベースもサポートしています。AzAcSnap は、個々の VM ではなく、中央の VM で使用することを検討してください。",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "高い",
- "text": "独自のガバナンスプラクティスを開発して、ノードRG(別名「インフラRG」)のオペレーターによって変更が実行されないようにします",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "低い",
- "text": "カスタムノードRG(別名「インフラRG」)名を使用",
+ "text": "オペレーティングシステムと SAP システムの間でタイムゾーンが一致していることを確認します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"severity": "中程度",
- "text": "非推奨の Kubernetes API を YAML マニフェストで使用しないでください",
- "waf": "オペレーションズ"
+ "text": "同じクラスター内で異なるアプリケーション サービスをグループ化しないでください。たとえば、DRBDと中央サービスクラスタを同じクラスタに組み合わせないでください。ただし、同じ Pacemaker クラスターを使用して、約 5 つの異なる中央サービス (マルチ SID クラスター) を管理できます。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
"severity": "低い",
- "text": "Windows ノードのテイント",
- "waf": "オペレーションズ"
+ "text": "Azure の実行コストを節約して最適化するために、スヌーズ モデルで開発/テスト システムを実行することを検討してください。",
+ "waf": "費用"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "低い",
- "text": "Windows コンテナーのパッチ レベルをホストのパッチ レベルと同期させる",
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "お客様の SAP 資産を管理することでお客様と提携する場合は、Azure Lighthouse をご検討ください。Azure Lighthouse を使用すると、マネージド サービス プロバイダーは Azure ネイティブ ID サービスを使用して、顧客の環境に対して認証を行うことができます。これにより、顧客はいつでもアクセスを取り消し、サービスプロバイダーの行動を監査できるため、制御が顧客の手に委ねられます。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "クラスタレベルでの診断設定経由",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
- "severity": "低い",
- "text": "マスター ログ (API ログ) を Azure Monitor または任意のログ管理ソリューションに送信する",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Update Manager を使用して、1 つまたは複数の VM で利用可能な更新プログラムの状態を確認し、定期的な修正プログラムの適用をスケジュールすることを検討してください。",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、nodePool スナップショットを使用します",
- "waf": "費用"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"severity": "低い",
- "text": "時間的制約のないワークロードのスポット ノード プールを検討する",
+ "text": "SAP Landscape Management (LaMa) を使用して、SAP Basis の運用を最適化および管理します。Azure 用の SAP LaMa コネクタを使用して、SAP システムの再配置、コピー、複製、更新を行います。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
- "severity": "低い",
- "text": "クイック バーストのために AKS 仮想ノードを検討する",
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Monitor for SAP solutions を使用して、Azure 上の SAP ワークロード (SAP HANA、高可用性 SUSE クラスター、SQL システム) を監視します。SAP Solution Manager を使用して Azure Monitor for SAP solutions を補完することを検討してください。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"severity": "高い",
- "text": "Container Insights (または Prometheus などの他のツール) を使用してクラスター メトリックを監視する",
+ "text": "SAP の VM 拡張機能チェックを実行します。VM Extension for SAP は、仮想マシン (VM) の割り当てられたマネージド ID を使用して、VM の監視データと構成データにアクセスします。このチェックにより、SAP アプリケーションのすべてのパフォーマンス メトリックが、基になる Azure Extension for SAP からのものであることが保証されます。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
- "severity": "高い",
- "text": "Container Insights(またはTelegraf/ElasticSearchなどの他のツール)を使用してクラスターログを保存および分析します",
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Policy を使用して、アクセス制御とコンプライアンス レポートを作成します。Azure Policy には、組織全体の設定を適用して、一貫したポリシーの遵守と迅速な違反検出を確保する機能があります。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"severity": "中程度",
- "text": "ノードの CPU とメモリの使用率を監視する",
+ "text": "Azure Network Watcher の接続モニターを使用して、SAP データベースとアプリケーション サーバーの待機時間メトリックを監視します。または、Azure Monitor を使用してネットワーク待機時間の測定値を収集して表示します。",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"severity": "中程度",
- "text": "Azure CNI を使用している場合は、ノードごとに消費されるポッド IP の割合を監視します",
+ "text": "プロビジョニングされた Azure インフラストラクチャで SAP HANA の品質チェックを実行し、プロビジョニングされた VM が SAP HANA on Azure のベスト プラクティスに準拠していることを確認します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "OS ディスクの I/O は重要なリソースです。ノード内の OS が I/O で調整されると、予期しない動作が発生し、通常はノードが NotReady と宣言される可能性があります",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
- "severity": "中程度",
- "text": "ノード内の OS ディスク キューの深さを監視する",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure サブスクリプションごとに、ゾーン デプロイの前に Azure 可用性ゾーンで待機時間テストを実行して、Azure 上の SAP のデプロイに待機時間の短いゾーンを選択します。",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"severity": "中程度",
- "text": "AzFW/NVA でエグレス フィルター処理を使用しない場合は、標準の ALB によって割り当てられた SNAT ポートを監視します",
- "waf": "オペレーションズ"
+ "text": "回復性レポートを実行して、プロビジョニングされた Azure インフラストラクチャ全体 (コンピューティング、データベース、ネットワーク、ストレージ、Site Recovery) の構成が、Cloud Adaption Framework for Azure で定義された構成に準拠していることを確認します。",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
"severity": "中程度",
- "text": "AKS クラスターのリソース正常性通知をサブスクライブするSubscribe to resource health notifications for your AKS cluster",
- "waf": "オペレーションズ"
+ "text": "SAP 用の Microsoft Sentinel ソリューションを使用して脅威保護を実装します。このソリューションを使用して、SAPシステムを監視し、ビジネスロジックとアプリケーションレイヤー全体で高度な脅威を検出します。",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "高い",
- "text": "ポッド仕様で要求と制限を構成する",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure のタグ付けを活用すると、リソースを論理的にグループ化して追跡し、デプロイを自動化し、最も重要なこととして、発生したコストを可視化できます。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
"waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "中程度",
- "text": "名前空間のリソースクォータを適用する",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "レイテンシの影響を受けやすいアプリケーションには、VM 間のレイテンシ監視を使用します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
- "severity": "高い",
- "text": "サブスクリプションにノードプールをスケールアウトするのに十分なクォータがあることを確認する",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Site Recovery の監視を使用して、SAP アプリケーション サーバーのディザスター リカバリー サービスの正常性を維持します。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "中程度",
- "text": "Cluster Autoscaler を使用する",
+ "text": "すべてのデータベース・ファイル・システムと実行可能プログラムをアンチウィルス・スキャンから除外します。それらを含めると、パフォーマンスの問題が発生する可能性があります。除外リストに関する規定の詳細については、データベースベンダーに確認してください。たとえば、Oracle では、ウイルス対策スキャンから /oracle//sapdata を除外することをお薦めします。",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"severity": "低い",
- "text": "AKS ノード プールのノード構成をカスタマイズする",
+ "text": "移行後に、HANA 以外のデータベースの完全なデータベース統計を収集することを検討してください。たとえば、SAP ノート 1020260 - Oracle 統計の配信を実装します。",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"severity": "中程度",
- "text": "必要に応じてHorizontal Pod Autoscalerを使用します",
+ "text": "SAP on Azure を使用するすべての Oracle デプロイに Oracle Automatic Storage Management (ASM) を使用することを検討してください。",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "ノードが大きくなると、パフォーマンスが向上し、エフェメラル ディスクや高速ネットワークなどの機能が提供されますが、爆発半径が大きくなり、スケーリングの粒度が低下します",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
- "severity": "高い",
- "text": "大きすぎず小さすぎない適切なノードサイズを検討してください",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Oracle を実行している SAP on Azure の場合、SQL スクリプトのコレクションはパフォーマンスの問題の診断に役立ちます。 自動ワークロード・リポジトリ(AWR)レポートには、Oracleシステムの問題を診断するための貴重な情報が含まれています。AWR レポートは、複数のセッションで実行し、ピーク時間を選択して、分析の範囲を広く設定することをお勧めします。",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "低い",
- "text": "スケーラビリティのために 5,000 を超えるノードが必要な場合は、追加の AKS クラスターの使用を検討してください",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure Site Recovery の監視を使用して、SAP アプリケーション サーバーのディザスター リカバリー サービスの正常性を維持します。",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "低い",
- "text": "AKS 自動化のために EventGrid イベントをサブスクライブすることを検討する",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "HTTP/S アプリを安全に配信するには、Application Gateway v2 を使用し、WAF の保護とポリシーが有効になっていることを確認します。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "低い",
- "text": "AKS クラスターで実行時間の長い操作を行う場合は、イベントの終了を検討してください",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure への移行中に仮想マシンの DNS または仮想名が変更されない場合、バックグラウンド DNS と仮想名は SAP ランドスケープ内の多くのシステム インターフェイスに接続され、開発者は時間の経過と共に定義するインターフェイスをお客様が認識することがよくあります。移行後に仮想名やDNS名が変更されると、さまざまなシステム間で接続の問題が発生するため、この種の問題を防ぐためにDNSエイリアスを保持することをお勧めします。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
- "severity": "低い",
- "text": "必要に応じて、AKS ノードに Azure Dedicated Hosts を使用することを検討してください",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "異なるDNSゾーンを使用して、各環境(サンドボックス、開発、プリプロダクション、およびプロダクション)を相互に区別します。例外は、独自の VNet を持つ SAP デプロイです。ここでは、プライベート DNS ゾーンは必要ないかもしれません。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "高い",
- "text": "エフェメラル OS ディスクを使用する",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "description": "VNet ピアリングを構成する場合は、 [リモート仮想ネットワークへのトラフィックを許可する] 設定を使用します。",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "ローカルおよびグローバル VNet ピアリングは接続を提供し、複数の Azure リージョンにまたがる SAP デプロイのランディング ゾーン間の接続を確保するための推奨されるアプローチです",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "確実"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "高い",
- "text": "非エフェメラル ディスクの場合、複数のポッドを実行するには高いパフォーマンスが必要であり、既定の AKS ログ ローテーションしきい値で巨大なログが生成されるため、多くのポッド/ノードを実行する場合は、ノードに高い IOPS とより大きな OS ディスクを使用します",
+ "text": "SAP アプリケーションと SAP データベース サーバー間の NVA のデプロイはサポートされていません",
+ "training": "https://me.sap.com/notes/2731110",
"waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "低い",
- "text": "ハイパー パフォーマンス ストレージ オプションの場合は、AKS 上の Ultra Disks を使用します",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Virtual WAN は、Azure リージョンとオンプレミスの場所間でグローバルなトランジット接続が必要な新しいネットワーク、大規模ネットワーク、またはグローバル ネットワークでの Azure デプロイに使用します。このアプローチでは、Azure ネットワークの推移的なルーティングを手動で設定する必要がなく、SAP on Azure デプロイの標準に従うことができます。",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"severity": "中程度",
- "text": "クラスター内に状態を保持することは避け、外部 (AzStorage、AzSQL、Cosmos など) にデータを格納します",
- "waf": "パフォーマンス"
+ "text": "リージョン間でネットワーク仮想アプライアンス (NVA) をデプロイするのは、パートナーの NVA が使用されている場合にのみ検討してください。ネイティブ NVA が存在する場合、リージョン間または VNet 間の NVA は必要ありません。パートナー ネットワーク テクノロジと NVA をデプロイする場合は、ベンダーのガイダンスに従って、Azure ネットワークと競合する構成を確認します。",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"severity": "中程度",
- "text": "AzFiles Standard を使用する場合は、パフォーマンス上の理由から AzFiles Premium や ANF を検討してください",
- "waf": "パフォーマンス"
+ "text": "Virtual WAN は、Virtual WAN ベースのトポロジのスポーク VNet 間の接続を管理し (ユーザー定義ルーティング (UDR) や NVA を設定する必要はありません)、同じ仮想ハブ内の VNet 間トラフィックの最大ネットワーク スループットは 50 ギガビット/秒です。必要に応じて、SAP ランディング ゾーンでは VNet ピアリングを使用して他のランディング ゾーンに接続し、この帯域幅の制限を克服できます。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
- "severity": "中程度",
- "text": "Azure ディスクと AZ を使用する場合は、適切なゾーンにストレージをプロビジョニングするために VolumeBindingMode:WaitForFirstConsumer を使用して LRS ディスクのゾーン内にノードプールを配置するか、複数のゾーンにまたがるノードプールに ZRS ディスクを使用することを検討してください",
- "waf": "パフォーマンス"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP ワークロードを実行している VM へのパブリック IP の割り当てはお勧めしません。",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
- "text": "Azure Monitor のデータ収集ルール - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "ASR を設定するときは、DR 側で IP アドレスを予約することを検討してください",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
- "text": "基になるデータソースが見つからないバックアップインスタンスを確認する",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "text": "関連づけられていないサービス(ディスク、NIC、IPアドレスなど)を削除またはアーカイブする",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "運用サイトと DR サイトで重複する IP アドレス範囲を使用しないでください。",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
- "text": "ミッション クリティカルでないアプリケーションの Site Recovery ストレージとバックアップのバランスを考慮する",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure では VNet に複数の委任サブネットを作成するのに役立ちますが、Azure NetApp Files の VNet に存在できる委任サブネットは 1 つだけです。Azure NetApp Files に複数の委任されたサブネットを使用すると、新しいボリュームを作成しようとすると失敗します。",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
- "text": "40 の異なるログ分析ワークスペース間で支出と節約の機会を確認する - 非運用ワークスペースに異なる保持とデータ収集を使用する - 認識と階層サイズ設定のための日次上限を作成する - 日次上限を設定する場合は、上限に達したときにアラートを作成するだけでなく、ある割合 (90% など) に達したときに通知されるアラート ルールも作成してください。- 可能であればワークスペースの変革を検討する - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルタリング (組織で必要な場合) を管理します",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
- "text": "ログのパージポリシーと自動化を適用する(必要に応じて、ログをコールドストレージに移動できます)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Application Gateway、SAP Web Dispatcher、およびその他のサードパーティサービスの比較に示すように、Application Gateway が SAP Web アプリのリバースプロキシとして機能する場合、Application Gateway と Web Application Firewall には制限があります。",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
- "text": "ディスクが本当に必要かどうかを確認し、必要でない場合は削除します。必要な場合は、下位のストレージ階層を見つけるか、バックアップを使用します。",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン間でグローバルな保護を提供します。",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
- "text": "未使用のストレージを下位階層に移動し、カスタマイズされたルールを使用することを検討する - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Front Door と Application Gateway を使用して HTTP/S アプリケーションを保護している場合は、Azure Front Door の Web アプリケーション ファイアウォール ポリシーを利用します。Azure Front Door からのトラフィックのみを受信するように Application Gateway をロックダウンします。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
- "text": "advisor が VM の適切なサイズ設定用に構成されていることを確認する",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Web アプリケーション ファイアウォールを使用して、インターネットに公開されているトラフィックをスキャンします。別のオプションは、ロード バランサーで使用するか、Application Gateway やサードパーティ ソリューションなどのファイアウォール機能が組み込まれているリソースで使用することです。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "コスト分析でメーターカテゴリライセンスを検索して確認してください",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "text": "すべての Windows VM でスクリプトを実行する https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM が頻繁に作成される場合は、ポリシーの実装を検討してください",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Virtual WAN は、Azure リージョンとオンプレミスの場所間でグローバルなトランジット接続が必要な新しいネットワーク、大規模ネットワーク、またはグローバル ネットワークでの Azure デプロイに使用します。このアプローチでは、Azure ネットワークの推移的なルーティングを手動で設定する必要がなく、SAP on Azure デプロイの標準に従うことができます。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
- "text": "これは、すでにライセンスを持っている場合は、AHUBの下に置くこともできます https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "データ漏えいを防ぐには、Azure Private Link を使用して、Azure Blob Storage、Azure Files、Azure Data Lake Storage Gen2、Azure Data Factory などのサービスとしてのプラットフォーム リソースに安全にアクセスします。Azure プライベート エンドポイントは、VNet と Azure Storage、Azure Backup などのサービス間のトラフィックをセキュリティで保護するのにも役立ちます。VNet とプライベート エンドポイント対応サービス間のトラフィックは、Microsoft グローバル ネットワークを経由するため、パブリック インターネットに公開されるのを防ぎます。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
- "text": "予約済み VM ファミリを柔軟性オプションで統合する (4 から 5 ファミリ以下)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP アプリケーションと DBMS レイヤーで使用される VM で Azure 高速ネットワークが有効になっていることを確認します。",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
- "text": "Azure 予約インスタンスを利用する: この機能を使用すると、VM を 1 年または 3 年間予約できるため、PAYG 価格と比較して大幅なコスト削減が実現します。",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Load Balancer の内部デプロイが Direct Server Return (DSR) を使用するように設定されていることを確認します。この設定 (フローティング IP の有効化) は、DBMS レイヤーの高可用性構成に内部ロード バランサー構成を使用する場合のレイテンシを短縮します。",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
- "text": "より大きなディスクのみ予約できます => 1 TiB -",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "アプリケーション セキュリティ グループ (ASG) ルールと NSG ルールを使用して、SAP アプリケーションと DBMS レイヤー間のネットワーク セキュリティ アクセス制御リストを定義できます。ASG は、セキュリティの管理に役立つ仮想マシンをグループ化します。",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
- "text": "適切なサイズ最適化の後",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "ピアリングされていない異なる Azure VNet に SAP アプリケーション レイヤーと SAP DBMS を配置することはサポートされていません。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "text": "該当するかどうかを確認し、ポリシー/変更 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations を適用します",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP アプリケーションでのネットワーク待機時間を最適化するには、Azure 近接通信配置グループの使用を検討してください。",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "text": "VM +ライセンス部分の割引(ahub + 3YRI)は約70%の割引です",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "オンプレミスと Azure の間で分割された SAP アプリケーション サーバー レイヤーと DBMS レイヤーの実行はまったくサポートされていません。どちらのレイヤーも、オンプレミスまたは Azure に完全に存在する必要があります。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
- "text": "需要に合わせて、フラットなサイジングではなく、VMSS の使用を検討してください",
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "データベース管理システム (DBMS) と SAP システムのアプリケーション層を異なる VNet でホストし、それらを VNet ピアリングで接続することは、層間の過剰なネットワーク トラフィックによって大きなコストが発生する可能性があるため、お勧めしません。Azure 仮想ネットワーク内のサブネットを使用して、SAP アプリケーション レイヤーと DBMS レイヤーを分離することをお勧めします。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
"waf": "費用"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
- "text": "AKS オートスケーラーを使用してクラスターの使用量に一致させる (ポッドの要件がスケーラーと一致していることを確認する)",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Linux ゲスト・オペレーティング・システムで Load Balancer を使用する場合は、Linux ネットワーク・パラメーター net.ipv4.tcp_timestamps が 0 に設定されていることを確認します。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
- "text": "該当する場合は、復旧ポイントを vault-archive に移動します (検証)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP RISE/ECS デプロイの場合、仮想ピアリングは、お客様の既存の Azure 環境との接続を確立するための推奨される方法です。SAP vnet と顧客 vnet はどちらもネットワーク セキュリティ グループ (NSG) で保護されているため、vnet ピアリングを介して SAP ポートとデータベース ポートで通信できます",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "text": "可能な場合は、フォールバックでスポット VM を使用することを検討してください。クラスターの自動終了を検討してください。",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure VM の SAP HANA データベースのバックアップを確認します。",
"waf": "費用"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
- "text": "関数 - 接続の再利用",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Site Recovery の組み込み監視 (SAP に使用されている場所) を確認します。",
"waf": "費用"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
- "text": "関数 - データをローカルにキャッシュする",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP HANA システムランドスケープの監視のガイダンスを確認します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
- "text": "関数 - コールド スタート - 「パッケージから実行」機能を使用します。このようにして、コードは単一のzipファイルとしてダウンロードされます。これにより、たとえば、多くのノードモジュールを持つJavascript関数が大幅に改善される可能性があります。言語固有のツールを使用してパッケージサイズを縮小します (ツリーを揺るがす Javascript アプリケーションなど)。",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Linux VM のバックアップ戦略で Oracle Database を確認します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
- "text": "関数 - 関数を暖かく保つ",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SQL Server 2016 での Azure Blob Storage の使用を確認します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
- "text": "さまざまな関数で自動スケーリングを使用する場合、すべてのリソースのすべての自動スケーリングを駆動する 1 つが存在する可能性があるため、別の従量課金プランに移行することを検討してください (また、CPU のより高いプランを検討してください)",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure VM の自動バックアップ v2 の使用を確認します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
- "text": "特定のプランの関数アプリはすべて一緒にスケーリングされるため、スケーリングに関する問題はプラン内のすべてのアプリに影響を与える可能性があります。",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Premium ディスク使用時の M シリーズの書き込みアクセラレータの有効化 (V1)",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
- "text": "「待機時間」に対して請求されますか?この質問は、通常、非同期操作を実行して結果を待機する C# 関数のコンテキストで尋ねられます (例: await Task.Delay(1000) や await client)。GetAsync('http://google.com') です。答えはイエスです-GB秒の計算は、関数の開始時刻と終了時刻、およびその期間のメモリ使用量に基づいています。その間に CPU アクティビティに関して実際に何が起こるかは、計算には考慮されません。この規則の 1 つの例外は、永続関数を使用している場合です。オーケストレーター関数で待機に費やされた時間に対しては課金されません。可能な場合は、デマンド シェーピング技術を適用します (開発環境?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "可用性ゾーンの待機時間をテストします。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
- "text": "Frontdoor - 既定のホームページをオフにするアプリのアプリケーション設定で、AzureWebJobsDisableHomepage を true に設定します。これにより、PoPに204(No Content)が返されるため、ヘッダーデータのみが返されます。",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "すべての SAP コンポーネントに対して SAP EarlyWatch Alert を有効化します。",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "text": "Frontdoor - 何も返さないものへのルーティング。関数、関数プロキシを設定するか、200 (OK) を返し、コンテンツを送信しない、または最小限のコンテンツを送信 するルートを Web アプリに追加します。これの利点は、呼び出されたときにログアウトできることです。",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP ABAPMeter レポート /SSA/CAT を使用して、SAP アプリケーション サーバーとデータベース サーバー間の待機時間を確認します。",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
- "text": "使用頻度の低いデータの階層のアーカイブを検討する",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "CCMS を使用した SQL Server パフォーマンス監視を確認します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
- "text": "サイズが階層と一致しない場合は、ディスク サイズを確認します (つまり、513 GiB のディスクは P30 (1TiB) を支払います) と、サイズ変更を検討してください",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP アプリケーション レイヤー VM と DBMS VM 間のネットワーク遅延をテストします (NIPING)。",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "text": "可能な場合は、Premium や Ultra ではなく Standard SSD の使用を検討してください",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP HANA Studio のアラートを確認します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "text": "ストレージ アカウントの場合は、選択したレベルによってトランザクション料金が加算されていないことを確認します (次のレベルに移動する方が安くなる可能性があります)",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "HANA_Configuration_Minichecksを使用して SAP HANA ヘルスチェックを実行します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "text": "ASR の場合、RPO/RTO とレプリケーション スループットで許可されている場合は、Standard SSD ディスクの使用を検討してください",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure、オンプレミス、またはその他のクラウド環境で Windows VM と Linux VM を実行している場合は、Azure Automation の更新管理センターを使用して、セキュリティ パッチを含むオペレーティング システムの更新プログラムを管理できます。",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
- "text": "ストレージ アカウント: 必要なホット層や GRS を確認する",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "SAP は、SAP システムを保護するために即時のアクションが必要な非常に重要なセキュリティパッチ (ホットフィックス) をリリースするため、SAP セキュリティ OSS ノートを定期的に確認してください。",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "text": "ディスク - あらゆる場所で Premium SSD ディスクの使用を検証: たとえば、非運用環境を Standard SSD またはオンデマンド Premium SSD にスワップできます",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
- "text": "予算を作成してコストを管理し、支出の異常や過剰支出のリスクを関係者に自動的に通知するアラートを作成します。",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
- "text": "追加のデータ分析のために、コスト データをストレージ アカウントにエクスポートします。",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "text": "専用 SQL プールのコストを制御するには、リソースが使用されていないときに一時停止します。",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "text": "サーバーレス Apache Spark の自動一時停止機能を有効にし、それに応じてタイムアウト値を設定します。",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
- "text": "さまざまなサイズの複数の Apache Spark プール定義を作成します。",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "text": "Azure Synapse Analytics のコストを節約するために、事前購入プランで Azure Synapse コミット ユニット (SCU) を 1 年間購入します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "text": "中断可能なジョブにスポット VM を使用する: これらは、割引価格で入札および購入できる VM であり、重要でないワークロードにコスト効率の高いソリューションを提供します。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "費用"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "text": "すべての VM の適切なサイズ設定",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "SQL Server 上の SAP システムではアカウントが使用されないため、SQL Server on SQL Server システム管理者アカウントを無効にすることができます。元のシステム管理者アカウントを無効にする前に、システム管理者権限を持つ別のユーザーがサーバーにアクセスできることを確認してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "text": "正規化されたサイズと最新のサイズでサイズをスワップする VM",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "xp_cmdshellを無効にします。SQL Server 機能xp_cmdshellは、SQL Server 内部オペレーティング システム コマンド シェルを有効にします。これは、セキュリティ監査における潜在的なリスクです。",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "VM の適切なサイズ設定 - 使用率を 5% 未満で監視することから始めて、その後 40% まで作業します",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "Azure 上の SAP HANA データベース サーバーの暗号化には、SAP HANA ネイティブの暗号化テクノロジが使用されます。さらに、Azure で SQL Server を使用している場合は、Transparent Data Encryption (TDE) を使用してデータとログ ファイルを保護し、バックアップも暗号化されるようにします。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "アプリケーションをコンテナー化すると、VM の密度が向上し、スケーリングにかかるコストを節約できます",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "費用"
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "Azure Storage の暗号化は、すべての Azure Resource Manager アカウントとクラシック ストレージ アカウントに対して有効になっており、無効にすることはできません。データは既定で暗号化されるため、Azure Storage の暗号化を使用するためにコードやアプリケーションを変更する必要はありません。",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"severity": "高い",
- "text": "ADDS ドメイン コントローラーがネイティブ Azure の ID サブスクリプションにデプロイされていることを確認する",
+ "text": "Azure Key Vault を使用してシークレットと資格情報を格納する",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "中程度",
- "text": "Azure ベースのリソース (Azure VMware Solution を含む) からの認証要求を Azure にローカルに保持するように ADDS サイトとサービスが構成されていることを確認します",
+ "text": "デプロイが成功したら、承認されていない変更から保護するために、Azure リソースをロックすることをお勧めします。また、カスタマイズされた Azure ポリシー (カスタム ロール) を使用して、サブスクリプションごとに LOCK 制約とルールを適用することもできます。",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
- "severity": "高い",
- "text": "vCenterがADDに接続されていることを確認し、「名前付きユーザーアカウント」に基づく認証を有効にします",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
+ "severity": "中程度",
+ "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
- "severity": "中程度",
- "text": "vCenter から ADDS への接続でセキュア プロトコル (LDAPS) が使用されていることを確認します",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "既存の要件、規制、コンプライアンス制御 (内部/外部) に基づいて - 必要な Azure ポリシーと Azure RBAC ロールを決定します",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
- "severity": "中程度",
- "text": "vCenter IdP の CloudAdmin アカウントは、緊急アカウント(非常用アカウント)としてのみ使用されます",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "高い",
+ "text": "SAP 環境でMicrosoft Defender for Endpointを有効にする場合は、すべてのサーバーをターゲットにするのではなく、DBMS サーバー上のデータ ファイルとログ ファイルを除外することをお勧めします。ターゲット ファイルを除外する場合は、DBMS ベンダーの推奨事項に従ってください。",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"severity": "高い",
- "text": "NSX-Manager が外部 ID プロバイダ (LDAPS) と統合されていることを確認します。",
+ "text": "Microsoft Defender for Cloud の Just-In-Time アクセス権を持つ SAP 管理者カスタム ロールを委任します。",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
- "severity": "中程度",
- "text": "VMware vSphere 内で使用するために RBAC モデルが作成されているか",
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "サードパーティのセキュリティ製品を DIAG (SAP GUI)、RFC、HTTPS の SPNEGO の Secure Network Communications (SNC) と統合することで、転送中のデータを暗号化します。",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "中程度",
- "text": "RBAC アクセス許可は、特定のユーザーではなく、ADDS グループに付与する必要があります",
+ "text": "プリンシパル暗号化機能には Microsoft マネージド キーが既定で設定され、必要に応じてカスタマー マネージド キーが使用されます。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
"severity": "高い",
- "text": "Azure の Azure VMware Solution リソースに対する RBAC アクセス許可は、限られた所有者のセットのみに \"ロックダウン\" されます",
+ "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
"severity": "高い",
- "text": "すべてのカスタム ロールのスコープが CloudAdmin で許可された承認で設定されていることを確認する",
+ "text": "HANA 以外の Windows および Windows 以外のオペレーティング システムのディスク暗号化キーとシークレットを制御および管理するには、Azure Key Vault を使用します。SAP HANA は Azure Key Vault ではサポートされていないため、SAP ABAP キーや SSH キーなどの別の方法を使用する必要があります。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
"severity": "高い",
- "text": "お客様のユース ケースに適した Azure VMware Solution 接続モデルが選択されているか",
- "waf": "パフォーマンス"
+ "text": "SAP on Azure スポーク サブスクリプションのロールベースのアクセス制御 (RBAC) ロールをカスタマイズして、ネットワーク関連の偶発的な変更を回避する",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"severity": "高い",
- "text": "オンプレミスから Azure への ExpressRoute または VPN 接続が \"接続モニター\" を使用して監視されていることを確認する",
- "waf": "オペレーションズ"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure VMware Solution バックエンドの ExpressRoute 接続を監視するために、Azure ネイティブ リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します",
- "waf": "オペレーションズ"
+ "text": "DMZ と NVA を他の SAP 資産から分離し、Azure Private Link を構成し、SAP on Azure リソースを安全に管理および制御します",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
- "severity": "中程度",
- "text": "エンド 2 エンドの接続を監視するために、オンプレミス リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "Azure で Microsoft マルウェア対策ソフトウェアを使用して、悪意のあるファイル、アドウェア、その他の脅威から仮想マシンを保護することを検討してください。",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
- "severity": "高い",
- "text": "ルート サーバーを使用する場合は、ルート サーバーから ExR ゲートウェイ、オンプレミスに伝達されるルートが 1000 を超えないようにします (ARS 制限)。",
- "waf": "オペレーションズ"
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "さらに強力な保護を行うには、Microsoft Defender for Endpoint の使用を検討してください。",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"severity": "高い",
- "text": "Azure Portal で Azure VMware Solution リソースを管理するロールに対して Privileged Identity Management が実装されていますか (永続的なアクセス許可は許可されません)",
+ "text": "仮想ネットワーク ピアリングによってスポーク ネットワークに接続されているハブ仮想ネットワークを介してすべてのトラフィックを通過させることにより、SAP アプリケーション サーバーとデータベース サーバーをインターネットまたはオンプレミス ネットワークから分離します。ピアリングされた仮想ネットワークにより、SAP on Azure ソリューションがパブリック インターネットから分離されることが保証されます。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
- "severity": "高い",
- "text": "Privileged Identity Management 監査レポートは、Azure VMware Solution PIM ロールに対して実装する必要がある",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "低い",
+ "text": "SAP Fiori のようなインターネットに接続するアプリケーションの場合は、セキュリティレベルを維持しながら、アプリケーション要件ごとに負荷を分散してください。レイヤー 7 セキュリティのために、Azure Marketplace で入手できるサードパーティの Web アプリケーション ファイアウォール (WAF) を使用できます。",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "中程度",
- "text": "Privileged Identity Management を使用している場合は、Azure VMware Solution のホストの自動置換通知用の有効な SMTP レコードを使用して、有効な Entra ID が有効なアカウントが作成されていることを確認します。(常任許可が必要)",
+ "text": "Azure Monitor for SAP solutions でセキュリティで保護された通信を有効にするには、ルート証明書またはサーバー証明書のどちらを使用するかを選択できます。ルート証明書を使用することを強くお勧めします。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
- "severity": "高い",
- "text": "CloudAdmin アカウントの使用を緊急アクセスのみに制限する",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "低い",
+ "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hubs 名前空間を使用すると、クライアントは TLS 1.0 以降でデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信するように Event Hubs 名前空間を構成できます。Event Hubs 名前空間で TLS の最小バージョンが必要な場合、古いバージョンで行われた要求はすべて失敗します。",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "vCenter Server でカスタム RBAC ロールを作成して、vCenter 内に最小特権モデルを実装します",
+ "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Event Hubs 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前のポリシー規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは、管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。RBAC で認証プロバイダーとして AAD を使用することをお勧めします。",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "cloudadmin (vCenter) と admin (NSX) の資格情報を定期的にローテーションするように定義されたプロセスです。",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
- "severity": "高い",
- "text": "一元化された ID プロバイダーを使用して、Azure VMware Solution で実行されているワークロード (VM) に使用する",
+ "text": "必要のない場合はrootアカウントの使用を避けてください",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure リソースのマネージド ID は、Azure Virtual Machines (VM)、関数アプリ、Virtual Machine Scale Sets、その他のサービスで実行されているアプリケーションから Azure AD 資格情報を使用して、Event Hubs リソースへのアクセスを承認できます。Azure リソースのマネージド ID を Azure AD 認証と共に使用することで、クラウドで実行されるアプリケーションに資格情報を格納することを回避できます。",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "East-West トラフィック フィルタリングは NSX-T 内に実装されていますか",
+ "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Event Hub に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに用意することを検討してください",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "アクセス許可を作成するときは、Azure Event Hub へのクライアントのアクセスをきめ細かく制御します。Azure Event Hub のアクセス許可は、個々のリソース レベル (コンシューマー グループ、イベント ハブ エンティティ、イベント ハブ名前空間など) にスコープを設定する必要があり、またそうする必要があります。",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"severity": "高い",
- "text": "Azure VMware Solution 上のワークロードは、インターネットに直接公開されません。トラフィックは、Azure Application Gateway、Azure Firewall、またはサード パーティのソリューションによってフィルター処理され、検査されます",
+ "text": "最小特権データ プレーン RBAC を使用する",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
- "severity": "高い",
- "text": "監査とログ記録は、Azure VMware Solution および Azure VMware Solution ベースのワークロードへの受信インターネット要求に対して実装されます",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub リソース ログには、操作ログ、仮想ネットワーク、Kafka ログが含まれます。ランタイム監査ログは、Event Hubs のすべてのデータ プレーン アクセス操作 (イベントの送受信など) に関する集計された診断情報をキャプチャします。",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
+ "severity": "中程度",
+ "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用して、リソース ログ、ランタイム監査ログ、Kafka ログなどのメトリックとログをキャプチャします",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "既定では、Azure Event Hub にはパブリック IP アドレスがあり、インターネットに到達できます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Event Hub の間のトラフィックが Microsoft のバックボーン ネットワークを経由するようになります。それに加えて、パブリックエンドポイントを使用しない場合は無効にする必要があります。",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "セッション監視は、疑わしい/悪意のあるアクティビティを特定するために、Azure VMware Solution または Azure VMware Solution ベースのワークロードからの送信インターネット接続に実装されます",
+ "text": "プライベート エンドポイントを使用して Azure Event Hub にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを、CIDR (Classless Inter-Domain Routing) 表記の一連の IPv4 アドレスまたは IPv4 アドレス範囲のみに制限できます。",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "Azure の ExR/VPN Gateway サブネットで DDoS Standard 保護が有効になっているか",
+ "text": "特定の IP アドレスまたは範囲からの Azure Event Hub 名前空間へのアクセスのみを許可することを検討してください",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "専用の特権アクセス ワークステーション (PAW) を使用して、Azure VMware Solution、vCenter、NSX Manager、HCX Manager を管理する",
- "waf": "安全"
+ "text": "FTAレジリエンシーハンドブックの活用",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure VMware Solution で実行されているワークロードに対して Advanced Threat Detection (Microsoft Defender for Cloud 別名 ASC) を有効にする",
- "waf": "安全"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "これは、ゾーン対応リージョンの Premium、Dedicated、または Standard SKU を使用してポータルから作成された新しい EH 名前空間に対して自動的にオンになります。EH メタデータとイベント データ自体の両方がゾーン間でレプリケートされます",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
+ "severity": "高い",
+ "text": "Availability Zones の活用 (地域的に適用可能な場合)",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "中程度",
- "text": "Azure ARC for Servers を使用して、Azure ネイティブ テクノロジを使用して Azure VMware Solution で実行されているワークロードを適切に管理します (Azure ARC for Azure VMware Solution はまだ利用できません)",
- "waf": "安全"
+ "text": "予測可能なパフォーマンスのために Premium または Dedicated SKU を使用する",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
- "severity": "低い",
- "text": "Azure VMware Solution 上のワークロードで、実行時に十分なデータ暗号化 (ゲスト内ディスク暗号化や SQL TDE など) が使用されるようにします。(保存時の vSAN 暗号化がデフォルトです)",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
- "severity": "低い",
- "text": "ゲスト内暗号化を使用する場合は、可能な場合は Azure Key Vault に暗号化キーを格納します",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure VMware Solution で実行されているワークロードには、拡張セキュリティ更新プログラムのサポートの使用を検討してください (Azure VMware Solution は ESU の対象です)",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "組み込みの geo ディザスター リカバリー機能を有効にすると、名前空間の構成全体 (Event Hubs、コンシューマー グループ、設定) がプライマリ名前空間からセカンダリ名前空間に継続的にレプリケートされ、プライマリからセカンダリへのフェールオーバーをいつでも 1 回だけ行うことができます。アクティブ/パッシブ機能は、アプリケーション構成を変更することなく、障害が発生した Azure リージョンからの復旧と破棄を容易にするように設計されています",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"severity": "高い",
- "text": "適切な vSAN データ冗長化方式(RAID 仕様)が使用されていることを確認します。",
+ "text": "アクティブ パッシブ構成を使用した Geo ディザスター リカバリーの計画",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
- "severity": "高い",
- "text": "許容障害ポリシーが vSAN ストレージのニーズを満たすために設定されていることを確認します",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "ダウンしたリージョンでのイベントデータの停止または損失を許容できない DR 構成に使用する必要があります。このような場合は、レプリケーションのガイダンスに従い、組み込みの geo ディザスター リカバリー機能 (アクティブ/パッシブ) を使用しないでください。アクティブ/アクティブでは、異なるリージョンと名前空間で複数の Event Hubs を保持し、イベントはハブ間でレプリケートされます",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
+ "severity": "中程度",
+ "text": "ビジネス クリティカルなアプリケーションの場合は、アクティブ アクティブ構成を使用します",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
- "severity": "高い",
- "text": "十分なクォータを要求し、拡張とディザスタリカバリの要件を考慮していることを確認します",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
+ "severity": "中程度",
+ "text": "回復力のある Event Hubs の設計",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"severity": "中程度",
- "text": "ESXiへのアクセス制限を理解し、サードパーティのソリューションに影響を与える可能性のあるアクセス制限があることを確認してください。",
+ "text": "Azure Front Door でカスタマー マネージド TLS 証明書を使用する場合は、\"最新\" の証明書バージョンを使用します。証明書の手動更新による停止のリスクを軽減します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"severity": "中程度",
- "text": "ESXi ホストの密度と効率に関するポリシーがあることを確認し、新しいノードを要求するためのリード タイムを念頭に置いてください",
- "waf": "オペレーションズ"
+ "text": "Azure Front Door と WAF ポリシーを使用して、複数の Azure リージョンにまたがるグローバル HTTP/S アプリを提供し、保護します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure VMware Solution の適切なコスト管理プロセスが整っていることを確認する - Azure Cost Management を使用できます",
- "waf": "費用"
+ "text": "Front Door と Application Gateway を使用して HTTP/S アプリを保護する場合は、Front Door で WAF ポリシーを使用します。Application Gateway をロックダウンして、Front Door からのトラフィックのみを受信します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
- "severity": "低い",
- "text": "Azure VMware Solution を使用するためのコストを最適化するために Azure 予約インスタンスが使用されているか",
- "waf": "費用"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "Front Door の WAF ポリシーを \"防止\" モードでデプロイし、Web アプリケーション ファイアウォールがトラフィックを許可または拒否するための適切なアクションを実行するようにします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
- "severity": "中程度",
- "text": "他の Azure Native Services を使用する場合は、Azure Private-Link の使用を検討してください",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "Traffic Manager を Front Door の後ろに配置しないでください。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"severity": "高い",
- "text": "必要なすべてのリソースが同じ Azure 可用性ゾーン内に存在することを確認する",
+ "text": "Azure Front Door と配信元で同じドメイン名を使用します。ホスト名が一致しないと、微妙なバグが発生する可能性があります。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "低い",
+ "text": "Azure Front Door の配信元グループに配信元が 1 つしかない場合は、正常性プローブを無効にします。",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure VMware Solution ゲスト VM ワークロードに対して Microsoft Defender for Cloud を有効にする",
- "waf": "安全"
+ "text": "Azure Front Door の適切な正常性プローブ エンドポイントを選択します。アプリケーションのすべての依存関係をチェックする正常性エンドポイントの構築を検討してください。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure Arc 対応サーバーを使用して Azure VMware Solution ゲスト VM のワークロードを管理する",
- "waf": "安全"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
+ "severity": "低い",
+ "text": "Azure Front Door で HEAD 正常性プローブを使用して、Front Door がアプリケーションに送信するトラフィックを減らします。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
"severity": "高い",
- "text": "Azure VMware Solution での診断ログとメトリック ログを有効にするEnable Diagnostic and metric logging on Azure VMware Solution",
+ "text": "Azure Front Door でマネージド TLS 証明書を使用します。運用コストと、証明書の更新による停止のリスクを軽減します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Log Analytics エージェントを Azure VMware Solution ゲスト VM ワークロードにデプロイする",
+ "text": "Azure Front Door WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure VMware Solution VM ワークロードのバックアップ ポリシーとソリューションが文書化され、実装されていることを確認します",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "Azure Front Door でエンド ツー エンド TLS を使用します。クライアントから Front Door への接続、および Front Door から配信元への接続には TLS を使用します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Microsoft Defender for Cloud を使用して、Azure VMware Solution で実行されているワークロードのコンプライアンス監視を行う",
+ "text": "Azure Front Door で HTTP から HTTPS へのリダイレクトを使用します。古いクライアントを自動的に HTTPS リクエストにリダイレクトすることで、クライアントをサポートします。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
- "severity": "中程度",
- "text": "適用可能なコンプライアンス ベースラインは Microsoft Defender for Cloud に追加されていますか",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "Azure Front Door WAF を有効にします。さまざまな攻撃からアプリケーションを保護します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
"severity": "高い",
- "text": "Azure VMware Solution のデプロイに使用する Azure リージョンを選択するときにデータ所在地が評価されましたか",
+ "text": "ワークロードに合わせて Azure Front Door WAF を調整するには、検出モードで WAF を構成して誤検知の検出を減らして修正します。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
"severity": "高い",
- "text": "データ処理への影響 (サービス プロバイダー/サービス コンシューマー モデル) が明確で文書化されているか",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
- "severity": "中程度",
- "text": "コンプライアンス上の理由で必要な場合にのみ、vSAN に CMK (カスタマー マネージド キー) を使用することを検討してください。",
+ "text": "Azure Front Door WAF ポリシーで有効になっている要求本文の検査機能を有効にします。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
"severity": "高い",
- "text": "Azure VMware Solution のコア監視分析情報を有効にするダッシュボードを作成するCreate dashboards to enable a core Azure VMware Solution monitoring insights",
- "waf": "オペレーションズ"
+ "text": "Azure Front Door WAF の既定のルール セットを有効にします。デフォルトのルールセットは、一般的な攻撃を検出してブロックします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
"severity": "高い",
- "text": "Azure VMware Solution のパフォーマンス (CPU >80%、平均メモリ >80%、vSAN >70%) に関する自動アラートの重大しきい値の警告アラートを作成する",
- "waf": "オペレーションズ"
+ "text": "Azure Front Door WAF ボット保護ルール セットを有効にします。ボット ルールは、良いボットと悪いボットを検出します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
- "severity": "高い",
- "text": "vSAN の消費量が 75% を下回っているかどうかを監視するための重要なアラートが作成されていることを確認します (これは VMware からのサポートしきい値です)。",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
+ "severity": "中程度",
+ "text": "最新の Azure Front Door WAF ルール セット バージョンを使用します。ルールセットの更新は、現在の脅威の状況を考慮して定期的に更新されます。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
- "severity": "高い",
- "text": "Azure Service Health のアラートと通知に対してアラートが構成されていることを確認する",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
+ "severity": "中程度",
+ "text": "Azure Front Door WAF にレート制限を追加します。レート制限は、クライアントが誤ってまたは意図的に短時間に大量のトラフィックを送信するのをブロックします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
"severity": "中程度",
- "text": "処理のために Azure Storage アカウントまたは Azure EventHub に送信するように Azure VMware Solution ログを構成する",
- "waf": "オペレーションズ"
+ "text": "Azure Front Door WAF のレート制限には高いしきい値を使用します。レート制限のしきい値を高くすると、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多くのリクエストに対する保護を提供します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
"severity": "低い",
- "text": "VMware vSphere での詳細な分析情報が必要な場合:vRealize Operations や vRealize Network Insights がソリューションで使用されていますか?",
- "waf": "オペレーションズ"
+ "text": "すべての地理的地域からのトラフィックを想定していない場合は、geo フィルタを使用して、想定外の国からのトラフィックをブロックします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
- "severity": "高い",
- "text": "仮想マシンの vSAN ストレージ ポリシーはシック プロビジョニングを適用するため、このポリシーがデフォルトのストレージ ポリシーではないことを確認します",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
+ "severity": "中程度",
+ "text": "Azure Front Door WAF を使用してトラフィックを geo フィルタリングする場合は、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致できない場合に、正当な要求を誤ってブロックしないようにします。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
"severity": "中程度",
- "text": "vSAN は有限のリソースであるため、vSphere コンテンツ ライブラリが vSAN に配置されていないことを確認する",
+ "text": "ログとメトリックをキャプチャするには、診断設定をオンにします。リソース アクティビティ ログ、アクセス ログ、正常性プローブ ログ、WAF ログを含めます。アラートを設定します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"severity": "中程度",
- "text": "バックアップ ソリューションのデータ リポジトリが vSAN ストレージの外部に保存されていることを確認します。Azure ネイティブまたはディスク プールでバックアップされるデータストア上",
+ "text": "Azure Front Door WAF ログを Microsoft Sentinel に送信します。",
"waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure Arc for Servers を使用して Azure VMware Solution で実行されているワークロードがハイブリッド管理されていることを確認する (Arc for Azure VMware Solution はプレビュー段階です)",
- "waf": "オペレーションズ"
+ "text": "デプロイ戦略をサポートするルーティング方法を選択します。設定された重み係数に基づいてトラフィックを分散する加重方式は、アクティブ/アクティブモデルをサポートします。プライマリ リージョンがすべてのトラフィックを受信し、バックアップとしてセカンダリ リージョンにトラフィックを送信するように設定する優先度ベースの値は、アクティブ/パッシブ モデルをサポートします。上記の方法とレイテンシを組み合わせて、レイテンシが最も低いオリジンがトラフィックを受信するようにします。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure VMware Solution で実行されているワークロードが Azure Log Analytics と Azure Monitor を使用して監視されていることを確認する",
- "waf": "オペレーションズ"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "1 つ以上のバックエンド プールに複数の配信元を持つことで冗長性をサポートします。アプリケーションの冗長インスタンスを常に用意し、各インスタンスがエンドポイントまたはオリジンを公開していることを確認します。これらの配信元は、1 つ以上のバックエンド プールに配置できます。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure VMware Solution で実行されているワークロードを、既存の更新プログラム管理ツールまたは Azure Update Management に含める",
- "waf": "オペレーションズ"
+ "text": "バックエンドへの要求の転送にタイムアウトを設定します。エンドポイントのニーズに応じてタイムアウト設定を調整します。そうしないと、配信元が応答を送信する前に Azure Front Door が接続を閉じる可能性があります。また、すべての配信元のタイムアウトが短い場合は、Azure Front Door の既定のタイムアウトを下げることもできます。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure Policy を使用して、Azure の管理、監視、セキュリティ ソリューションに Azure VMware Solution ワークロードをオンボードする",
- "waf": "オペレーションズ"
+ "text": "アプリケーションにセッション アフィニティが必要かどうかを判断します。高い信頼性要件がある場合は、セッション アフィニティを無効にすることをお勧めします。",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
"severity": "中程度",
- "text": "Azure VMware Solution で実行されているワークロードが Microsoft Defender for Cloud にオンボードされていることを確認する",
+ "text": "ホストヘッダーをバックエンドに送信します。バックエンド サービスは、そのホストからのトラフィックのみを受け入れるルールを作成できるように、ホスト名を認識する必要があります。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "中程度",
- "text": "vSAN は有限のリソースであるため、バックアップが vSAN に保存されないようにする",
- "waf": "確実"
+ "text": "キャッシュをサポートするエンドポイントにはキャッシュを使用します。",
+ "waf": "費用"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
- "severity": "中程度",
- "text": "すべてのDRソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[SRM/JetStream/Zerto/Veeam/...]",
- "waf": "確実"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
+ "severity": "低い",
+ "text": "単一のバックエンド・プールのヘルス・チェックを無効にします。Azure Front Door の配信元グループに配信元が 1 つしか構成されていない場合、これらの呼び出しは不要です。これは、エンドポイントに複数のオリジンを持てない場合にのみ推奨されます。",
+ "waf": "費用"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
"severity": "中程度",
- "text": "ディザスター リカバリー テクノロジがネイティブの Azure IaaS の場合は、Azure Site Recovery を使用します",
- "waf": "確実"
+ "text": "セキュリティ レポートを活用するには Premium レベルを使用することをお勧めしますが、Standard Azure Front Door プロファイルでは、組み込みの分析/レポートでトラフィック レポートのみが提供されます。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
- "severity": "高い",
- "text": "いずれかの災害ソリューションで自動復旧計画を使用し、手動タスクを可能な限り回避します",
- "waf": "確実"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
"severity": "中程度",
- "text": "地政学的リージョンのペアをセカンダリディザスタリカバリ環境として使用する",
- "waf": "確実"
+ "text": "可能な場合は、ワイルドカード TLS 証明書を使用します。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
- "severity": "高い",
- "text": "リージョン間で 2 つの異なるアドレス空間を使用します (例: 10.0.0.0/16 と 192.168.0.0/16)。",
- "waf": "確実"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
+ "severity": "中程度",
+ "text": "キャッシュ用にアプリケーションのクエリ文字列を最適化します。純粋に静的なコンテンツの場合は、クエリ文字列を無視して、キャッシュを最大限に活用します。アプリケーションでクエリ文字列を使用する場合は、それらをキャッシュキーに含めることを検討してください。キャッシュ キーにクエリ文字列を含めると、Azure Front Door は、構成に基づいてキャッシュされた応答またはその他の応答を提供できます。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
"severity": "中程度",
- "text": "ExpressRoute Global Reach は、プライマリとセカンダリの Azure VMware Solution プライベート クラウド間の接続に使用されますか、それともネットワーク仮想アプライアンスを介してルーティングされますか?",
- "waf": "確実"
+ "text": "ダウンロード可能なコンテンツにアクセスするときは、ファイル圧縮を使用します。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
- "severity": "中程度",
- "text": "すべてのバックアップソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[ MABS/CommVault/Metallic.io/Veeam/ . ]",
- "waf": "確実"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "現在クラシック Azure Front Door を使用している場合は、クラシック Azure Front Door は 2027 年 3 月までに非推奨になるため、Standard SKU または Premium SKU への移行を検討してください。",
+ "waf": "オペレーションズ"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
"severity": "中程度",
- "text": "バックアップ ソリューションを Azure VMware Solution プライベート クラウドと同じリージョンにデプロイする",
+ "text": "ミッション クリティカルな高可用性シナリオには、Traffic Manager の負荷分散 Azure Front Door とサード パーティの CDN プロバイダー CDN プロファイルの使用を検討してください。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
- "severity": "中程度",
- "text": "バックアップ ソリューションを vSan の外部の Azure ネイティブ コンポーネントにデプロイする",
- "waf": "確実"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
+ "severity": "高い",
+ "text": "配信元を App Services として Front Door を使用する場合は、アクセス制限を使用して Azure Front Door 経由でのみアプリ サービスへのトラフィックをロックダウンすることを検討してください。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "低い",
- "text": "Azure プラットフォームによって管理されている VMware コンポーネントの復元を要求するプロセスは用意されていますか?",
- "waf": "確実"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "共鳴可能なAIのためのメタプロンプトガードレールに従う",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
- "severity": "低い",
- "text": "手動デプロイの場合、すべての構成とデプロイを文書化する必要があります",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "APIM や AI Central などのソリューションを使用したゲートウェイ パターンを検討して、レート制限、負荷分散、認証、ログ記録を改善します",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
- "severity": "低い",
- "text": "手動デプロイの場合は、Azure VMware Solution プライベート クラウドでの偶発的なアクションを防ぐために、リソース ロックの実装を検討してください",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "AOAI インスタンスの監視を有効にする",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
- "severity": "低い",
- "text": "自動デプロイの場合は、最小限のプライベート クラウドをデプロイし、必要に応じてスケーリングします",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "リソースに対して実行されたアクション (サブスクリプション キーの再生成など) によって作成されたアクティビティ ログのエントリや、1 時間に 10 を超えるエラー数などのメトリックしきい値によって作成されたアクティビティ ログのエントリなど、イベントを通知するアラートを作成します",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
- "severity": "低い",
- "text": "自動デプロイの場合は、デプロイを開始する前にクォータを要求または予約します",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "トークンの使用状況を監視して、容量によるサービスの中断を防ぎます",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
- "severity": "低い",
- "text": "自動デプロイの場合は、適切なガバナンスのために、自動化または Azure Policy を使用して関連するリソース ロックが作成されていることを確認します",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "処理された推論トークン、生成された完了トークンなどのメトリックを観察し、レート制限を監視します",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
"severity": "低い",
- "text": "ExR 認証キーに人間が理解できる名前を実装して、キーの目的/用途を簡単に識別できるようにします",
- "waf": "オペレーションズ"
+ "text": "診断が十分でない場合は、Azure OpenAI の前で Azure API Management などのゲートウェイを使用して、受信プロンプトと送信応答の両方をログに記録することを検討してください (許可されている場合)",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
- "severity": "低い",
- "text": "Azure VMware Solution と ExpressRoute のデプロイに個別のサービス プリンシパルを使用する場合は、キー コンテナーを使用してシークレットと承認キーを格納します",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "コードとしてのインフラストラクチャを使用して、Azure OpenAI Service、モデル デプロイ、およびすべての関連リソースをデプロイします",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
- "severity": "低い",
- "text": "Azure VMware Solution では限られた数の並列操作しかサポートされないため、Azure VMware Solution に多くのリソースをデプロイする必要がある場合に、IaC でアクションをシリアル化するためのリソースの依存関係を定義します。",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "API キーの代わりにマネージド ID で Microsoft Entra 認証を使用する",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
- "severity": "低い",
- "text": "単一の Tier-1 ゲートウェイで NSX-T セグメントの自動構成を実行する場合は、NSX-Manager API ではなく Azure Portal API を使用します",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "入力と正しい答えを持つ既知のゴールデンデータセットを使用して、システムのパフォーマンス/精度を評価します。PromptFlowの機能を評価に活用します。",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
- "severity": "中程度",
- "text": "自動スケールアウトを使用する場合は、Azure VMware Solution を実行しているサブスクリプションに対して十分な Azure VMware Solution クォータを申請してください",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "プロビジョニング済みスループットモデルの使用状況の評価",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
- "severity": "中程度",
- "text": "自動スケールインを使用する場合は、そのようなアクションを実行する前に、ストレージ ポリシーの要件を必ず考慮してください",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure AI コンテンツの安全性を確認して実装する",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
- "severity": "中程度",
- "text": "スケーリング操作は、一度に 1 つのスケール操作しか実行できないため、常に 1 つの SDDC 内でシリアル化する必要があります (複数のクラスタが使用されている場合でも)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "トークンと1分あたりのレスポンスに基づいてシステムのスループットを定義および評価し、要件に合わせます",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "アーキテクチャで使用されるサードパーティソリューションでのスケーリング操作を検討および検証します(サポートされているかどうか)",
+ "text": "トークンサイズ、ストリーミングオプションを制限することにより、システムのレイテンシーを改善します",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "自動化で環境のスケールイン/スケールアウトの上限を定義して適用する",
+ "text": "弾力性の要求を見積もり、優先順位に基づいて同期要求とバッチ要求の分離を決定します。優先度が高い場合は同期アプローチを使用し、優先度が低い場合はキューを使用した非同期バッチ処理が推奨されます",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
- "severity": "中程度",
- "text": "監視ルールを実装して、自動スケーリング操作を監視し、成功と失敗を監視して、適切な (自動化された) 応答を有効にします",
- "waf": "オペレーションズ"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "消費者からの推定需要に基づくトークン消費要件のベンチマーク。プロビジョニングされたスループット ユニットのデプロイを使用している場合は、Azure OpenAI ベンチマーク ツールを使用してスループットを検証することを検討してください",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
- "severity": "高い",
- "text": "MONを使用する場合は、同時に構成されたVMの制限(HCXのMON制限[400 - 標準、1000 - 大規模アプライアンス])に注意してください",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "確実"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "プロビジョニングされたスループットユニット (PTU) を使用している場合は、オーバーフローリクエストに対して Token-Per Minute (TPM) デプロイメントをデプロイすることを検討してください。ゲートウェイを使用して、PTU の制限に達したときに要求を TPM デプロイにルーティングします。",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "MON を使用する場合、100 を超えるネットワーク拡張で MON を有効にすることはできません",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "確実"
+ "text": "適切なタスクに適したモデルを選択してください。速度、応答の品質、出力の複雑さの間で適切なトレードオフを持つモデルを選択する",
+ "waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "移行に VPN 接続を使用する場合は、それに応じて MTU サイズを調整します。",
+ "text": "微調整によってモデルのパフォーマンスが向上したかどうかを知るための微調整を行わずに、パフォーマンスのベースラインを設定する",
"waf": "パフォーマンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
- "severity": "中程度",
- "text": "Azure に接続する接続性の低いリージョン (500 Mbps 以下) の場合は、HCX WAN 最適化アプライアンスのデプロイを検討してください",
- "waf": "パフォーマンス"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "低い",
+ "text": "複数のOAIインスタンスを複数のリージョンにデプロイする",
+ "waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
- "severity": "中程度",
- "text": "移行がオンプレミスアプライアンスから開始され、クラウドアプライアンスから開始されていないことを確認します(逆移行は実行しないでください)",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "APIM のようなゲートウェイ パターンを使用した再試行とヘルスチェックの実装",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "Azure NetApp Files を使用して Azure VMware Solution のストレージを拡張する場合は、VM に直接接続するのではなく、これを VMware データストアとして使用することを検討してください。",
+ "text": "ワークロードに対してTPMとRPMの適切なクォータがあることを確認します",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "専用の ExpressRoute ゲートウェイが外部データ ストレージ ソリューションに使用されていることを確認する",
- "waf": "確実"
+ "text": "HAIツールキットガイダンスの考慮事項を確認し、それらの相互作用の実践をslutionに適用します",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "外部データ ストレージ ソリューションに使用されている ExpressRoute ゲートウェイで FastPath が有効になっていることを確認します",
+ "text": "ファインチューニングが採用されている場合は、リージョン間で個別の微調整モデルをデプロイします",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
- "severity": "高い",
- "text": "ストレッチ クラスタを使用している場合は、選択したディザスタ リカバリ ソリューションがベンダーによってサポートされていることを確認します",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "重要なデータを定期的にバックアップおよびレプリケートして、データの損失やシステム障害が発生した場合のデータの可用性と回復性を確保します。Azure のバックアップおよびディザスター リカバリー サービスを活用して、データを保護します。",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "ストレッチ クラスターを使用する場合は、提供される SLA が要件を満たしていることを確認します",
+ "text": "Azure AI Search サービス レベルは、SLA を持つために選択する必要があります",
"waf": "確実"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
- "severity": "高い",
- "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線が接続ハブに接続されていることを確認します。",
- "waf": "確実"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "severity": "低い",
+ "text": "データと機密性を分類し、埋め込みを生成する前に Microsoft Purview でラベル付けし、生成された埋め込みを同じ感度と分類で処理するようにしてください",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線で GlobalReach が有効になっていることを確認します。",
- "waf": "確実"
+ "text": "SSE/ディスク暗号化(オプションのBYOKを使用)を使用してRAGに使用されるデータを暗号化",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "サイトの耐障害性の設定を適切に検討し、必要に応じてビジネスに合わせて変更しましたか?",
- "waf": "確実"
+ "text": "データソース間で転送されるデータ、Retrieval-Augmented Generation(RAG)およびLLM通信に使用されるAI検索にTLSが適用されていることを確認します",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する",
- "waf": "確実"
+ "text": "RBAC を使用して、Azure OpenAI サービスへのアクセスを管理します。ユーザーに適切な権限を割り当て、ユーザーの役割と責任に基づいてアクセスを制限します",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "データの暗号化、マスキング、または編集技術を実装して、機密データを非表示にしたり、非本番環境で難読化された値に置き換えたり、テストやトラブルシューティングの目的でデータを共有する場合",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する",
- "waf": "確実"
+ "text": "Azure Defender を利用して、セキュリティの脅威を検出して対応し、監視とアラートのメカニズムを設定して、疑わしいアクティビティや侵害を特定します。Azure Sentinel を活用して高度な脅威の検出と対応を実現",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "コンプライアンス規制を遵守するためのデータ保持および廃棄ポリシーを確立します。不要になったデータに対して安全な削除方法を実装し、データの保持と廃棄活動の監査証跡を維持します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する",
- "waf": "確実"
+ "text": "Content Safety を使用した Prompt シールドと接地検出の実装",
+ "waf": "オペレーショナルエクセレンス"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します",
- "waf": "確実"
+ "text": "GDPRやHIPAAなどの関連するデータ保護規制への準拠を確保するには、プライバシー制御を実装し、データ処理活動に必要な同意または許可を取得します。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護",
- "waf": "オペレーションズ"
+ "text": "データセキュリティのベストプラクティス、データの安全な取り扱いの重要性、データ侵害に関連する潜在的なリスクについて、従業員を教育します。データセキュリティプロトコルに熱心に従うように促します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"severity": "高い",
- "text": "Azure Cache for Redis のゾーン冗長を有効にします。Azure Cache for Redis では、Premium レベルと Enterprise レベルでゾーン冗長構成がサポートされています。ゾーン冗長キャッシュでは、同じリージョン内の異なる Azure Availability Zones にノードを配置できます。これにより、データセンターや AZ の停止が単一障害点として排除され、キャッシュの全体的な可用性が向上します。",
- "waf": "確実"
+ "text": "運用データを開発データやテストデータから分離します。本番環境では実際の機密データのみを使用し、開発環境やテスト環境では匿名化されたデータや合成データを利用します。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "Azure Cache for Redis インスタンスのデータ永続化を構成します。キャッシュ データはメモリに格納されるため、まれに複数のノードで計画外の障害が発生すると、すべてのデータがドロップされる可能性があります。データの完全な損失を回避するために、Redis 永続化では、メモリ内データのスナップショットを定期的に取得し、ストレージ アカウントに格納できます。",
- "waf": "確実"
+ "text": "データの機密性のレベルが異なる場合は、レベルごとに個別のインデックスを作成することを検討してください。たとえば、一般的なデータ用に 1 つのインデックスを作成し、機密データ用に別のインデックスを作成し、それぞれ異なるアクセス プロトコルで管理することができます",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "geo 冗長ストレージ アカウントを使用して Azure Cache for Redis データを保持するか、geo 冗長性を使用できない場合はゾーン冗長を使用します",
- "waf": "確実"
+ "text": "分離をさらに一歩進めて、機密性の高いデータセットをサービスの異なるインスタンスに配置します。各インスタンスは、独自のRBACポリシーのセットで制御できます",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "機密情報から生成された埋め込みとベクトルは、それ自体が機密性が高いことを認識します。このデータには、ソースマテリアルと同じ保護対策を提供する必要があります",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "埋め込みとベクトルを持つデータストアに RBAC を適用し、ロールのアクセス要件に基づいてアクセスのスコープを設定します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "AI サービスのプライベート エンドポイントを構成して、ネットワーク内のサービス アクセスを制限します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure Firewall と UDR を使用して受信と送信のトラフィック制御を厳密に適用し、外部統合ポイントを制限します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "ネットワークのセグメンテーションとアクセス制御を実装して、LLMアプリケーションへのアクセスを許可されたユーザーとシステムのみに制限し、横方向の移動を防ぎます",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"severity": "中程度",
- "text": "Premium Azure Cache for Redis インスタンスのパッシブ geo レプリケーションを構成します。geo レプリケーションは、2 つ以上の Azure Cache for Redis インスタンス (通常は 2 つの Azure リージョンにまたがる) をリンクするためのメカニズムです。geo レプリケーションは、主にリージョン間のディザスター リカバリー用に設計されています。2 つの Premium レベルのキャッシュ インスタンスは、プライマリ キャッシュへの読み取りと書き込みを提供する方法で geo レプリケーションを介して接続され、そのデータはセカンダリ キャッシュにレプリケートされます。",
- "waf": "確実"
+ "text": "LLMLingua や gprtrim などのプロンプト圧縮ツールを使用します",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "LLM アプリケーションで使用される API とエンドポイントが、マネージド ID、API キー、OAuth などの認証および承認メカニズムで適切に保護され、不正アクセスを防止します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "多要素認証などの強力なエンドユーザー認証メカニズムを適用して、LLMアプリケーションおよび関連するネットワークリソースへの不正アクセスを防止します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "ネットワーク監視ツールを実装して、疑わしいアクティビティや悪意のあるアクティビティのネットワークトラフィックを検出および分析します。ロギングを有効にしてネットワークイベントをキャプチャし、セキュリティインシデントが発生した場合のフォレンジック分析を容易にします",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "セキュリティ監査と侵入テストを実施して、LLMアプリケーションのネットワークインフラストラクチャのネットワークセキュリティの弱点または脆弱性を特定して対処します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "severity": "低い",
+ "text": "Azure AI Services は、管理を改善するために適切にタグ付けされています",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "低い",
+ "text": "Azure AI Service アカウントは、組織の名前付け規則に従います",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure AI サービス リソースの診断ログを有効にする必要がある",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "セキュリティのため、キーアクセス(ローカル認証)を無効にすることをお勧めします。 キーベースのアクセスを無効にすると、Microsoft Entra IDが唯一のアクセス方法になり、最小限の特権原則ときめ細かな制御を維持できます。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure Key Vault を使用して、キーを安全に保存および管理します。LLM アプリケーションのコード内で機密性の高いキーをハードコーディングしたり埋め込んだりすることを避け、マネージド ID を使用して Azure Key Vault から安全に取得します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure Key Vault に格納されているキーを定期的にローテーションして期限切れにすることで、不正アクセスのリスクを最小限に抑えます。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "tiktokenを使用して、会話モードでのトークン最適化のためのトークンサイズを理解します",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "安全なコーディング手法に従って、インジェクション攻撃、クロスサイトスクリプティング(XSS)、セキュリティ設定の誤りなどの一般的な脆弱性を防止します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "LLM ライブラリとその他のシステム コンポーネントを定期的に更新し、パッチを適用するプロセスを設定します",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "Azure OpenAI またはその他の LLM の利用規約、ポリシー、ガイダンス、および許可されたユース ケースを順守する",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "基本モデルと微調整されたモデルおよびトークンのステップサイズのコストの違いを理解する",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "可能であれば、呼び出しごとのオーバーヘッドを最小限に抑え、全体的なコストを削減できるバッチ要求。バッチサイズを確実に最適化する",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "モデルの使用状況を監視するコスト追跡システムを設定し、その情報を使用してモデルの選択とプロンプトのサイズを通知します",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "モデル応答あたりのトークン数に上限を設定します。サイズを最適化して、有効な応答に十分な大きさになるようにします",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "信頼性のための AI 検索の設定に関するガイダンスを確認します",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "AI Search Vector ストレージの計画と管理",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "LLMOpsプラクティスを適用して、GenAIアプリケーションのライフサイクル管理を自動化します",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "請求モデルの使用状況の評価 - PAYG と PTU の比較",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "モデルバージョンを切り替える際のプロンプトとアプリケーションの品質を評価する",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "GenAIアプリを評価、監視、改良して、接地性、関連性、精度、一貫性、流暢さなどの機能を確認します。",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "さまざまな検索パラメーターに基づいて Azure AI Search の結果を評価する",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "精度を向上させる方法としてモデルの微調整を検討するのは、データを使用してプロンプトエンジニアリングやRAGなどの他の基本的なアプローチを試した場合のみです",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "プロンプトエンジニアリング手法を使用して、LLM応答の精度を向上させる",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "GenAIアプリケーションをレッドチーム化",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "エンドユーザーにLLM応答のスコアリングオプションを提供し、これらのスコアを追跡します。",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "severity": "高い",
+ "text": "クォータ管理の実践を検討する",
+ "waf": "コストの最適化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
+ "severity": "中程度",
+ "text": "APIM ベースのゲートウェイなどのロード バランサー ソリューションを使用して、サービスやリージョン間で負荷と容量を分散します",
+ "waf": "オペレーショナルエクセレンス"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "text": "Azure Monitor のデータ収集ルール - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
+ "text": "基になるデータソースが見つからないバックアップインスタンスを確認する",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
+ "text": "関連づけられていないサービス(ディスク、NIC、IPアドレスなど)を削除またはアーカイブする",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
+ "text": "ミッション クリティカルでないアプリケーションの Site Recovery ストレージとバックアップのバランスを考慮する",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
+ "text": "40 の異なるログ分析ワークスペース間で支出と節約の機会を確認する - 非運用ワークスペースに異なる保持とデータ収集を使用する - 認識と階層サイズ設定のための日次上限を作成する - 日次上限を設定する場合は、上限に達したときにアラートを作成するだけでなく、ある割合 (90% など) に達したときに通知されるアラート ルールも作成してください。- 可能であればワークスペースの変革を検討する - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
+ "text": "ログのパージポリシーと自動化を適用する(必要に応じて、ログをコールドストレージに移動できます)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
+ "text": "ディスクが本当に必要かどうかを確認し、必要でない場合は削除します。必要な場合は、下位のストレージ階層を見つけるか、バックアップを使用します。",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "text": "未使用のストレージを下位階層に移動し、カスタマイズされたルールを使用することを検討する - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "text": "advisor が VM の適切なサイズ設定用に構成されていることを確認する",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "コスト分析でメーターカテゴリライセンスを検索して確認してください",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "text": "すべての Windows VM でスクリプトを実行する https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM が頻繁に作成される場合は、ポリシーの実装を検討してください",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "text": "これは、すでにライセンスを持っている場合は、AHUBの下に置くこともできます https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
+ "text": "予約済み VM ファミリを柔軟性オプションで統合する (4 から 5 ファミリ以下)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "text": "Azure 予約インスタンスを利用する: この機能を使用すると、VM を 1 年または 3 年間予約できるため、PAYG 価格と比較して大幅なコスト削減が実現します。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "text": "より大きなディスクのみ予約できます => 1 TiB -",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
+ "text": "適切なサイズ最適化の後",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "text": "該当するかどうかを確認し、ポリシー/変更 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations を適用します",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
+ "text": "VM +ライセンス部分の割引(ahub + 3YRI)は約70%の割引です",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
+ "text": "需要に合わせて、フラットなサイジングではなく、VMSS の使用を検討してください",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
+ "text": "AKS オートスケーラーを使用してクラスターの使用量に一致させる (ポッドの要件がスケーラーと一致していることを確認する)",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "text": "該当する場合は、復旧ポイントを vault-archive に移動します (検証)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "text": "可能な場合は、フォールバックでスポット VM を使用することを検討してください。クラスターの自動終了を検討してください。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
+ "text": "関数 - 接続の再利用",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
+ "text": "関数 - データをローカルにキャッシュする",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
+ "text": "関数 - コールド スタート - 「パッケージから実行」機能を使用します。このようにして、コードは単一のzipファイルとしてダウンロードされます。これにより、たとえば、多くのノードモジュールを持つJavascript関数が大幅に改善される可能性があります。言語固有のツールを使用してパッケージサイズを縮小します (ツリーを揺るがす Javascript アプリケーションなど)。",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "text": "関数 - 関数を暖かく保つ",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
+ "text": "さまざまな関数で自動スケーリングを使用する場合、すべてのリソースのすべての自動スケーリングを駆動する 1 つが存在する可能性があるため、別の従量課金プランに移行することを検討してください (また、CPU のより高いプランを検討してください)",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
+ "text": "特定のプランの関数アプリはすべて一緒にスケーリングされるため、スケーリングに関する問題はプラン内のすべてのアプリに影響を与える可能性があります。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
+ "text": "「待機時間」に対して請求されますか?この質問は、通常、非同期操作を実行して結果を待機する C# 関数のコンテキストで尋ねられます (例: await Task.Delay(1000) や await client)。GetAsync('http://google.com') です。答えはイエスです-GB秒の計算は、関数の開始時刻と終了時刻、およびその期間のメモリ使用量に基づいています。その間に CPU アクティビティに関して実際に何が起こるかは、計算には考慮されません。この規則の 1 つの例外は、永続関数を使用している場合です。オーケストレーター関数で待機に費やされた時間に対しては課金されません。可能な場合は、デマンド シェーピング技術を適用します (開発環境?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "text": "Frontdoor - 既定のホームページをオフにするアプリのアプリケーション設定で、AzureWebJobsDisableHomepage を true に設定します。これにより、PoPに204(No Content)が返されるため、ヘッダーデータのみが返されます。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "text": "Frontdoor - 何も返さないものへのルーティング。関数、関数プロキシを設定するか、200 (OK) を返し、コンテンツを送信しない、または最小限のコンテンツを送信 するルートを Web アプリに追加します。これの利点は、呼び出されたときにログアウトできることです。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "text": "使用頻度の低いデータの階層のアーカイブを検討する",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "text": "サイズが階層と一致しない場合は、ディスク サイズを確認します (つまり、513 GiB のディスクは P30 (1TiB) を支払います) と、サイズ変更を検討してください",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "text": "可能な場合は、Premium や Ultra ではなく Standard SSD の使用を検討してください",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "text": "ストレージ アカウントの場合は、選択したレベルによってトランザクション料金が加算されていないことを確認します (次のレベルに移動する方が安くなる可能性があります)",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "text": "ASR の場合、RPO/RTO とレプリケーション スループットで許可されている場合は、Standard SSD ディスクの使用を検討してください",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "text": "ストレージ アカウント: 必要なホット層や GRS を確認する",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "text": "ディスク - あらゆる場所で Premium SSD ディスクの使用を検証: たとえば、非運用環境を Standard SSD またはオンデマンド Premium SSD にスワップできます",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "text": "予算を作成してコストを管理し、支出の異常や過剰支出のリスクを関係者に自動的に通知するアラートを作成します。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "text": "追加のデータ分析のために、コスト データをストレージ アカウントにエクスポートします。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "text": "専用 SQL プールのコストを制御するには、リソースが使用されていないときに一時停止します。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "text": "サーバーレス Apache Spark の自動一時停止機能を有効にし、それに応じてタイムアウト値を設定します。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "text": "さまざまなサイズの複数の Apache Spark プール定義を作成します。",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "text": "Azure Synapse Analytics のコストを節約するために、事前購入プランで Azure Synapse コミット ユニット (SCU) を 1 年間購入します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
+ "text": "中断可能なジョブにスポット VM を使用する: これらは、割引価格で入札および購入できる VM であり、重要でないワークロードにコスト効率の高いソリューションを提供します。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "text": "すべての VM の適切なサイズ設定",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "text": "正規化されたサイズと最新のサイズでサイズをスワップする VM",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "VM の適切なサイズ設定 - 使用率を 5% 未満で監視することから始めて、その後 40% まで作業します",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "費用"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "アプリケーションをコンテナー化すると、VM の密度が向上し、スケーリングにかかるコストを節約できます",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "費用"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.ko.json b/checklists/waf_checklist.ko.json
index 3727c709f..e6a8f2357 100644
--- a/checklists/waf_checklist.ko.json
+++ b/checklists/waf_checklist.ko.json
@@ -40,56 +40,6 @@
"text": "프리미엄 Azure Cache for Redis 인스턴스에 대한 수동 지역 복제를 구성합니다. 지역에서 복제는 일반적으로 두 개의 Azure 지역에 걸쳐 있는 둘 이상의 Azure Cache for Redis 인스턴스를 연결하는 메커니즘입니다. 지역에서 복제는 주로 지역 간 재해 복구를 위해 설계되었습니다. 두 개의 프리미엄 계층 캐시 인스턴스는 주 캐시에 대한 읽기 및 쓰기를 제공하는 방식으로 지역 복제를 통해 연결되며, 해당 데이터는 보조 캐시에 복제됩니다.",
"waf": "신뢰도"
},
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
- "severity": "높다",
- "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "severity": "높다",
- "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
- "severity": "높다",
- "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
- "severity": "높다",
- "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
- "severity": "보통",
- "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.",
- "waf": "작업"
- },
{
"arm-service": "Microsoft.AVS/privateClouds",
"checklist": "Azure VMware Solution Design Review",
@@ -1049,5154 +999,4833 @@
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
"severity": "보통",
- "text": "'스토리지에 대한 Azure 보안 기준' 고려",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
- "waf": "안전"
+ "text": "다중 지역 애플리케이션 랜딩 존 및 재해 복구 시나리오를 신속하게 지원할 수 있도록 여러 지역에 Azure 랜딩 존 연결 리소스를 배포합니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "새로 만든 저장소 계정은 ARM 배포 모델을 사용하여 만들어지므로 RBAC, 감사 등을 모두 사용할 수 있습니다. 구독에 클래식 배포 모델이 있는 이전 저장소 계정이 없는지 확인합니다.",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"severity": "보통",
- "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
- "waf": "안전"
+ "text": "다중 테넌트에 대한 명확한 규정 또는 비즈니스 요구 사항이 없는 한 Azure 리소스를 관리하기 위해 하나의 Entra 테넌트를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아봅니다.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
- "waf": "안전"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "낮다",
+ "text": "다중 테넌트 자동화 접근 방식을 사용하여 Microsoft Entra ID 테넌트를 관리합니다.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
- "waf": "안전"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "높다",
+ "text": "동일한 ID로 다중 테넌트 관리에 Azure Lighthouse를 사용합니다.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "Blob에 대해 '일시 삭제' 사용 안 함",
- "waf": "안전"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
+ "severity": "높다",
+ "text": "파트너에게 테넌트를 관리할 수 있는 액세스 권한을 부여하는 경우 Azure Lighthouse를 사용합니다.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 컨테이너를 복구할 수 있습니다(예: 실수로 인한 삭제 작업에서 복구).",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
"severity": "높다",
- "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
+ "text": "클라우드 운영 모델에 맞는 RBAC 모델을 적용합니다. 관리 그룹 및 구독에서 범위를 지정하고 할당합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"severity": "보통",
- "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
+ "text": "모든 계정 유형에 대해 회사 또는 학교 계정 인증 유형만 사용합니다. Microsoft 계정을 사용하지 마십시오.",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 저장소 계정이 실수로 삭제되는 것을 방지합니다.",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "그룹만 사용하여 사용 권한을 할당합니다. 그룹 관리 시스템이 이미 있는 경우 Entra ID 전용 그룹에 온-프레미스 그룹을 추가합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능'은 실제로 '불가능'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함된 경우 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"severity": "높다",
- "text": "변경할 수 없는 Blob 고려",
+ "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 Microsoft Entra ID 조건부 액세스 정책을 적용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "모든 데이터 전송이 암호화되고, 무결성이 보호되고, 서버가 인증되도록 스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하는 것이 좋습니다. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
"severity": "높다",
- "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
+ "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 다단계 인증을 적용합니다.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 여부를 확인합니다. 이 경우 저장소 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "HTTPS를 적용할 때(HTTP 사용 안 함) 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "Microsoft Entra ID PIM(Privileged Identity Management)을 적용하여 제로 스탠딩 액세스 및 최소 권한을 설정합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "보통",
- "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
+ "text": "Active Directory Domain Services에서 Entra Domain Services로 전환하려는 경우 모든 워크로드의 호환성을 평가합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "AAD 토큰은 가능한 경우 공유 액세스 서명보다 우선해야 합니다",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "Blob 액세스에 Azure AD(Azure Active Directory) 토큰 사용Use Azure Active Directory (Azure AD) tokens for blob access",
- "waf": "안전"
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "Microsoft Entra Domain Services를 사용하는 경우 복제본 세트를 사용합니다. 복제본 세트는 관리되는 도메인의 복원력을 향상시키고 추가 지역에 배포할 수 있도록 합니다. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"severity": "보통",
- "text": "IaM 권한의 최소 권한",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 사본을 가져왔는지 모니터링할 수 있지만, 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시키는 것은 불가능합니다. AAD 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "AAD 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "text": "Microsoft Entra ID 로그를 플랫폼 중앙 Azure Monitor와 통합합니다. Azure Monitor는 Azure의 로그 및 모니터링 데이터에 대한 단일 정보 소스를 허용하여 조직에 로그 수집 및 보존에 대한 요구 사항을 충족할 수 있는 클라우드 네이티브 옵션을 제공합니다.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 보거나 변경하는 '시기', '누가', '무엇을' 및 '방법'(예: 스토리지 계정 키, 액세스 정책 등)을 식별합니다.",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
"severity": "높다",
- "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다.",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "키 만료 정책을 사용하면 계정 액세스 키 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다",
+ "text": "응급 액세스 또는 비상 계정을 구현하여 테넌트 전체 계정 잠금을 방지합니다. MFA는 2024년 10월에 모든 사용자에 대해 기본적으로 설정됩니다. 암호 키(FIDO2)를 사용하거나 MFA에 대한 인증서 기반 인증을 구성하도록 이러한 계정을 업데이트하는 것이 좋습니다. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효 간격을 사용하여 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"severity": "보통",
- "text": "SAS 만료 정책 구성 고려",
+ "text": "특별히 필요한 시나리오가 없는 한 Microsoft Entra ID 역할 할당에 온-프레미스 동기화 계정을 사용하지 마세요.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 권한을 취소하는 옵션을 제공합니다. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"severity": "보통",
- "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
+ "text": "Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 애플리케이션에 대한 액세스 권한을 부여하는 경우 테넌트당 하나의 인스턴스만 가질 수 있으므로 플랫폼 리소스로 관리합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"severity": "보통",
- "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
+ "text": "최대한의 유연성이 필요한 네트워크 시나리오에는 허브 및 스포크(hub-and-spoke) 네트워크 토폴로지를 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 이렇게 할 수 없는 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"severity": "높다",
- "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
- "waf": "안전"
+ "text": "ExpressRoute 게이트웨이, VPN 게이트웨이 및 Azure Firewall 또는 파트너 NVA를 포함한 공유 네트워킹 서비스를 중앙 허브 가상 네트워크에 배포합니다. 필요한 경우 DNS 서비스도 배포합니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 단기 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 업로드에 사용할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"severity": "높다",
- "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "SAS에 좁은 범위 적용",
+ "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"severity": "보통",
- "text": "가능한 경우 SAS의 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
- "waf": "안전"
+ "text": "파트너 네트워킹 기술 또는 NVA를 배포할 때 파트너 공급업체의 지침을 따릅니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 고려할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
"severity": "낮다",
- "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
+ "text": "허브 및 스포크 시나리오에서 ExpressRoute와 VPN 게이트웨이 간의 전송이 필요한 경우 Azure Route Server를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "SFTP: SFTP 액세스에 대한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "낮다",
+ "text": "Route Server를 사용하는 경우 Route Server 서브넷에 /27 접두사를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"severity": "보통",
- "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
- "waf": "안전"
+ "text": "Azure 지역 간에 여러 허브 및 스포크 토폴로지가 있는 네트워크 아키텍처의 경우 허브 VNet 간의 글로벌 가상 네트워크 피어링을 사용하여 지역을 서로 연결합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정할 때 CorsRules를 최소 권한으로 유지합니다.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "지나치게 광범위한 CORS 정책 방지",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
+ "severity": "보통",
+ "text": "네트워크용 Azure Monitor를 사용하여 Azure에서 네트워크의 엔드투엔드 상태를 모니터링합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀성 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "보통",
+ "text": "한 지역에 400개 이상의 스포크 네트워크가 있는 경우 VNet 피어링 제한(500) 및 ExpressRoute를 통해 보급할 수 있는 최대 접두사 수(1000)를 우회하기 위해 추가 허브를 배포합니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "보통",
- "text": "사용해야 하는 플랫폼 암호화를 결정합니다.",
- "waf": "안전"
+ "text": "경로 테이블당 경로 수를 400개로 제한합니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "사용해야 하는 클라이언트 쪽 암호화를 결정합니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "VNet 피어링을 구성할 때 '원격 가상 네트워크에 대한 트래픽 허용' 설정을 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Resource Graph Explorer(resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"severity": "높다",
- "text": "공용 Blob 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
- "waf": "안전"
+ "text": "영역 중복 배포와 함께 표준 Load Balancer SKU를 사용하는 경우 표준 SKU Load Balancer를 선택하면 가용성 영역 및 영역 복원력을 통해 안정성이 향상되어 배포가 영역 및 지역 오류를 견딜 수 있습니다. Basic과 달리 전역 부하 분산을 지원하고 SLA를 제공합니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
- "severity": "보통",
- "text": "장기 취소 가능 토큰을 사용하고, 토큰을 캐시하고, Microsoft ID 라이브러리를 사용하여 자동으로 획득합니다.",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "높다",
+ "text": "부하 분산 장치 백 엔드 풀에 두 개 이상의 인스턴스가 포함되어 있는지 확인하고, 백 엔드에 두 개 이상의 인스턴스를 사용하여 Azure Load Balancer를 배포하면 단일 실패 지점을 방지하고 확장성을 지원할 수 있습니다.",
"waf": "신뢰도"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "로그인 사용자 흐름이 백업되고 복원력이 있는지 확인합니다. 사용자를 로그인하는 데 사용하는 코드가 백업되고 복구 가능한지 확인합니다. 외부 프로세스와의 복원력 있는 인터페이스",
- "waf": "신뢰도"
+ "text": "ExpressRoute Direct를 사용하는 경우 조직의 라우터와 MSEE 간의 계층 2 수준에서 트래픽을 암호화하도록 MACsec을 구성합니다. 다이어그램은 흐름에서 이 암호화를 보여 줍니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "안전"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "사용자 지정 브랜드 자산은 CDN에서 호스팅되어야 합니다.",
- "waf": "공연"
+ "text": "MACsec을 사용할 수 없는 시나리오(예: ExpressRoute Direct를 사용하지 않음)의 경우 VPN Gateway를 사용하여 ExpressRoute 개인 피어링을 통해 IPsec 터널을 설정합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "안전"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "낮다",
- "text": "여러 ID 공급자가 있어야 합니다(예: Microsoft, Google, Facebook 계정으로 로그인).",
- "waf": "신뢰도"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "높다",
+ "text": "Azure 지역 및 온-프레미스 위치에서 겹치는 IP 주소 공간이 사용되지 않는지 확인합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "안전"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "보통",
- "text": "VM 수준에서 고가용성을 위한 VM 규칙(프리미엄 디스크, 서로 다른 가용성 영역에 있는 지역에 두 개 이상)을 따릅니다.",
- "waf": "신뢰도"
+ "text": "개인 인터넷(RFC 1918)에 대한 주소 할당 범위의 IP 주소를 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "안전"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "보통",
- "text": "복제하지 마세요! 복제로 인해 디렉터리 동기화에 문제가 발생할 수 있습니다",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "IP 주소 공간이 낭비되지 않는지 확인하고 불필요하게 큰 가상 네트워크(예: /16)를 만들지 마세요.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "공연"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "보통",
- "text": "다중 지역에 대해 활성-활성 상태 보유",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "프로덕션 및 재해 복구 사이트에 대해 겹치는 IP 주소 범위를 사용하지 마세요.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "신뢰도"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
- "severity": "보통",
- "text": "추가 지역 및 위치에 Azure AD 도메인 서비스 스탬프 추가Add Azure AD Domain service stamps to additional regions and locations",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
+ "severity": "높다",
+ "text": "해당하는 경우 표준 SKU 및 영역 중복 IP를 사용하며, Azure의 공용 IP 주소는 비영역, 영역 또는 영역 중복으로 사용할 수 있는 표준 SKU일 수 있습니다. 영역 중복 IP는 모든 영역에서 액세스할 수 있으므로 단일 영역 오류에 저항하여 더 높은 복원력을 제공합니다. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
"waf": "신뢰도"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"severity": "보통",
- "text": "DR에 복제본 세트 사용",
- "waf": "신뢰도"
+ "text": "Azure의 이름 확인만 필요한 환경의 경우 이름 확인을 위해 위임된 영역(예: 'azure.contoso.com')을 사용하여 Azure 프라이빗 DNS를 확인합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
"severity": "보통",
- "text": "전역 수준에서 오류 처리 정책 구현",
- "waf": "작업"
+ "text": "Azure 및 온-프레미스에서 이름 확인이 필요하고 Active Directory와 같은 기존 엔터프라이즈 DNS 서비스가 없는 환경의 경우 Azure DNS Private Resolver를 사용하여 DNS 요청을 Azure 또는 온-프레미스 DNS 서버로 라우팅합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
- "severity": "보통",
- "text": "모든 API 정책에 요소가 포함되어 있는지 확인합니다.",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "낮다",
+ "text": "자체 DNS(예: Red Hat OpenShift)를 요구하고 배포하는 특수 워크로드는 선호하는 DNS 솔루션을 사용해야 합니다.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
"waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
- "severity": "보통",
- "text": "정책 조각을 사용하여 여러 API에서 동일한 정책 정의를 반복하지 않도록 합니다.",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "높다",
+ "text": "Azure DNS에 대한 자동 등록을 사용하도록 설정하여 가상 네트워크 내에 배포된 가상 머신에 대한 DNS 레코드의 수명 주기를 자동으로 관리합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
"severity": "보통",
- "text": "API로 수익을 창출할 계획이라면 '수익 창출 지원' 도움말에서 권장사항을 확인하세요",
- "waf": "작업"
+ "text": "여러 Azure 지역 간의 DNS 확인을 관리하기 위한 계획과 서비스가 다른 지역으로 장애 조치(failover)되는 경우 계획 구현",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
- "severity": "높다",
- "text": "진단 설정을 사용하도록 설정하여 로그를 Azure Monitor로 내보내기",
- "waf": "작업"
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "보통",
+ "text": "Azure Bastion을 사용하여 네트워크에 안전하게 연결합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"severity": "보통",
- "text": "더 자세한 원격 분석을 위해 Application Insights 사용",
- "waf": "작업"
+ "text": "서브넷 /26 이상에서 Azure Bastion을 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
- "severity": "높다",
- "text": "가장 중요한 메트릭에 대한 경고 구성",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "보통",
+ "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역 전체에서 글로벌 보호를 제공합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
- "severity": "높다",
- "text": "사용자 지정 SSL 인증서가 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되어 있는지 확인합니다",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "낮다",
+ "text": "Azure Front Door 및 Azure Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure Front Door에서만 트래픽을 수신하도록 Azure Application Gateway를 잠급니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"severity": "높다",
- "text": "Azure AD를 사용하여 API(데이터 평면)에 들어오는 요청 보호",
+ "text": "인바운드 HTTP/S 연결에 WAF 및 기타 역방향 프록시가 필요한 경우 랜딩 존 가상 네트워크 내에 배포하고 보호하고 인터넷에 노출하는 앱과 함께 배포합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
- "severity": "보통",
- "text": "Microsoft Entra ID를 사용하여 개발자 포털에서 사용자 인증",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "Azure DDoS 네트워크 또는 IP 보호 계획을 사용하여 가상 네트워크 내의 공용 IP 주소 엔드포인트를 보호할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
- "severity": "보통",
- "text": "제품의 가시성을 제어하기 위해 적절한 그룹을 만듭니다",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "예정된 호환성이 손상되는 변경 전에 네트워크 아웃바운드 트래픽 구성 및 전략을 관리하는 방법을 계획합니다. 2025년 9월 30일에 새 배포에 대한 기본 아웃바운드 액세스가 사용 중지되고 명시적 액세스 구성만 허용됩니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "보호된 모든 공용 IP 주소(DDoS IP 또는 네트워크 보호)에 대한 DDoS 관련 로그를 저장하는 진단 설정을 추가합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
- "severity": "보통",
- "text": "백엔드 기능을 사용하여 중복 API 백엔드 구성 제거",
- "waf": "작업"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "severity": "높다",
+ "text": "Virtual Machines에 직접 연결된 공용 IP 주소를 거부하는 정책 할당이 있는지 확인합니다. 특정 VM에서 공용 IP가 필요한 경우 제외를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "명명된 값을 사용하여 정책에서 사용할 수 있는 공통 값 저장",
- "waf": "작업"
+ "text": "ExpressRoute를 Azure에 대한 기본 연결로 사용합니다. VPN을 백업 연결의 소스로 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "AS-path 접두사 및 연결 가중치를 사용하여 Azure에서 온-프레미스로의 트래픽에 영향을 주고, 자체 라우터의 전체 BGP 특성 범위를 사용하여 온-프레미스에서 Azure로의 트래픽에 영향을 줄 수 있습니다.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "DR의 경우 99.99% SLA를 위해 둘 이상의 지역에 걸쳐 확장된 배포와 함께 프리미엄 계층을 활용합니다",
+ "text": "여러 ExpressRoute 회로 또는 여러 온-프레미스 위치를 사용하는 경우 BGP 특성을 사용하여 라우팅을 최적화합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "99.99%의 SLA 증가를 위해 둘 이상의 가용성 영역에 하나 이상의 단위를 배포합니다.",
- "waf": "신뢰도"
+ "text": "대역폭 및 성능 요구 사항에 따라 ExpressRoute/VPN 게이트웨이에 적합한 SKU를 선택합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"severity": "높다",
- "text": "자동화된 백업 루틴이 있는지 확인",
- "waf": "신뢰도"
+ "text": "비용을 정당화하는 대역폭에 도달하는 경우에만 무제한 데이터 ExpressRoute 회로를 사용하고 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
- "severity": "보통",
- "text": "정책을 사용하여 장애 조치 백엔드 URL 및 캐싱을 추가하여 실패한 호출을 줄입니다.",
- "waf": "신뢰도"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "높다",
+ "text": "회로 피어링 위치가 로컬 SKU에 대한 Azure 지역을 지원하는 경우 ExpressRoute의 로컬 SKU를 활용하여 회로 비용을 줄입니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "낮다",
- "text": "고성능 수준에서 기록해야 하는 경우 Event Hubs 정책을 고려합니다",
- "waf": "작업"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
+ "severity": "보통",
+ "text": "지원되는 Azure 지역에 영역 중복 ExpressRoute 게이트웨이를 배포합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "제한 정책을 적용하여 초당 요청 수 제어Apply throttling policies to control the number of requests per second",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "text": "10Gbps보다 높은 대역폭 또는 전용 10/100Gbps 포트가 필요한 시나리오의 경우 ExpressRoute Direct를 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "공연"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "부하가 증가할 때 인스턴스 수를 확장하도록 자동 크기 조정 구성Configure autoscaling to scale out the number of instances when the load increases",
+ "text": "짧은 대기 시간이 필요하거나 온-프레미스에서 Azure로의 처리량이 10Gbps보다 커야 하는 경우 FastPath를 사용하여 데이터 경로에서 ExpressRoute 게이트웨이를 우회할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "공연"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"severity": "보통",
- "text": "Azure에 백 엔드 API에 가까운 지역이 없는 자체 호스팅 게이트웨이를 배포합니다.",
- "waf": "공연"
+ "text": "영역 중복 VPN 게이트웨이를 사용하여 분기 또는 원격 위치를 Azure(사용 가능한 경우)에 연결합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"severity": "보통",
- "text": "프로덕션 워크로드에 프리미엄 계층을 사용합니다.",
+ "text": "온-프레미스에서 중복 VPN 어플라이언스(활성/활성 또는 활성/수동)를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
- "severity": "보통",
- "text": "다중 리전 모델에서는 Policies를 사용하여 가용성 또는 지연 시간에 따라 리전 백엔드로 요청을 라우팅합니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
"severity": "높다",
- "text": "APIM의 제한에 유의해야 합니다.",
- "waf": "신뢰도"
+ "text": "ExpressRoute Direct를 사용하는 경우 비용을 절감하기 위해 로컬 Azure 지역에 대한 ExpressRoute 로컬 회로를 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
- "severity": "높다",
- "text": "자체 호스팅 게이트웨이 배포가 복원력이 있는지 확인합니다.",
- "waf": "신뢰도"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "보통",
+ "text": "트래픽 격리 또는 전용 대역폭이 필요한 경우(예: 프로덕션 환경과 비프로덕션 환경을 분리하기 위해) 다른 ExpressRoute 회로를 사용합니다. 이는 격리된 라우팅 도메인을 보장하고 시끄러운 이웃 위험을 완화하는 데 도움이 됩니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "다중 지역 배포를 위해 APIM 앞에서 Azure Front Door 사용Use Azure Front Door in front of APIM for multi-region deployment",
- "waf": "공연"
+ "text": "기본 제공 Express Route Insights를 사용하여 ExpressRoute 가용성 및 사용률을 모니터링합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "VNet(Virtual Network) 내에 서비스 배포Deploy the service within a Virtual Network (VNet)",
- "waf": "안전"
+ "text": "네트워크를 통한 연결, 특히 온-프레미스와 Azure 간의 연결을 모니터링하기 위해 연결 모니터를 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "서브넷에 NSG(네트워크 보안 그룹)를 배포하여 APIM에서 들어오고 나가는 트래픽을 제한하거나 모니터링합니다.",
- "waf": "안전"
+ "text": "중복성을 위해 서로 다른 피어링 위치의 ExpressRoute 회로를 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "프라이빗 엔드포인트를 배포하여 APIM이 VNet에 배포되지 않은 경우 들어오는 트래픽을 필터링합니다.",
- "waf": "안전"
+ "text": "단일 ExpressRoute 회로만 사용하는 경우 사이트 간 VPN을 ExpressRoute의 장애 조치(failover)로 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
"severity": "높다",
- "text": "공용 네트워크 액세스 사용 안 함",
- "waf": "안전"
+ "text": "GatewaySubnet에서 경로 테이블을 사용하는 경우 게이트웨이 경로가 전파되었는지 확인합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
- "severity": "보통",
- "text": "PowerShell 자동화 스크립트로 관리 간소화",
- "waf": "작업"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "severity": "높다",
+ "text": "ExpressRoute를 사용하는 경우 온-프레미스 라우팅은 동적이어야 하며, 연결 오류가 발생할 경우 회로의 나머지 연결로 수렴해야 합니다. 로드는 두 연결 모두에서 액티브/액티브로 이상적으로 공유되어야 하지만 액티브/패시브도 지원됩니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "Infrastructure-as-code를 통해 APIM을 구성합니다. Cloud Adaption Framework APIM 랜딩 존 가속기에서 DevOps 모범 사례 검토",
- "waf": "작업"
+ "text": "ExpressRoute 회로의 두 물리적 링크가 네트워크에 있는 두 개의 고유한 에지 디바이스에 연결되어 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "더 빠른 API 개발을 위해 Visual Studio Code APIM 확장 사용 촉진",
- "waf": "작업"
+ "text": "BFD(Bidirectional Forwarding Detection)가 고객 또는 프로바이더 에지 라우팅 디바이스에서 활성화되고 구성되도록 보장합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "높다",
+ "text": "복원력을 높이기 위해 ExpressRoute 게이트웨이를 서로 다른 피어링 위치에서 둘 이상의 회로에 연결합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "워크플로에서 DevOps 및 CI/CD 구현",
+ "text": "ExpressRoute 가상 네트워크 게이트웨이에 대한 진단 로그 및 경고를 구성합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "작업"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "클라이언트 인증서 인증을 사용하여 API 보안",
- "waf": "안전"
+ "text": "VNet 간 통신에 ExpressRoute 회로를 사용하지 마세요.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
- "severity": "보통",
- "text": "클라이언트 인증서 인증을 사용한 보안 백엔드 서비스",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "낮다",
+ "text": "검사를 위해 Azure 트래픽을 하이브리드 위치로 보내지 마세요. 대신 'Azure의 트래픽이 Azure에 유지' 원칙을 따라 Azure의 리소스 간 통신이 Microsoft 백본 네트워크를 통해 발생하도록 합니다.",
+ "waf": "공연"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "severity": "높다",
+ "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "보통",
- "text": "'OWASP API 보안 상위 10개 위협을 완화하기 위한 권장 사항' 문서를 검토하고 API에 적용할 수 있는 항목을 확인합니다.",
+ "text": "글로벌 Azure Firewall 정책을 만들어 글로벌 네트워크 환경에서 보안 태세를 제어하고 모든 Azure Firewall 인스턴스에 할당합니다. Azure 역할 기반 액세스 제어를 통해 증분 방화벽 정책을 로컬 보안 팀에 위임하여 특정 지역의 요구 사항을 충족하는 세분화된 정책을 허용합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
- "severity": "보통",
- "text": "권한 부여 기능을 사용하여 백엔드 API에 대한 OAuth 2.0 토큰 관리 간소화",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "낮다",
+ "text": "조직에서 아웃바운드 연결을 보호하기 위해 이러한 솔루션을 사용하려는 경우 Firewall Manager 내에서 지원되는 파트너 SaaS 보안 공급자를 구성합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
"severity": "높다",
- "text": "전송 중인 정보를 암호화할 때 최신 TLS 버전을 사용합니다. 가능한 경우 오래되고 불필요한 프로토콜과 암호를 사용하지 않도록 설정합니다.",
+ "text": "응용 프로그램 규칙을 사용하여 지원되는 프로토콜에 대한 대상 호스트 이름에서 아웃바운드 트래픽을 필터링합니다. FQDN 기반 네트워크 규칙 및 DNS 프록시와 함께 Azure Firewall을 사용하여 다른 프로토콜을 통해 인터넷으로의 송신 트래픽을 필터링합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
"severity": "높다",
- "text": "비밀(명명된 값)이 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되었는지 확인합니다.",
+ "text": "Azure Firewall 프리미엄을 사용하여 추가 보안 기능을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
- "severity": "보통",
- "text": "가능할 때마다 관리 ID를 사용하여 다른 Azure 리소스에 인증",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "severity": "높다",
+ "text": "추가 보호를 위해 Azure Firewall 위협 인텔리전스 모드를 경고 및 거부로 구성합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
"severity": "높다",
- "text": "APIM 앞에 Application Gateway를 배포하여 WAF(웹 애플리케이션 방화벽) 사용Use Web Application Firewall (WAF) by deploying Application Gateway in of APIM",
+ "text": "추가 보호를 위해 Azure Firewall IDPS 모드를 거부로 구성합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
- "severity": "보통",
- "text": "Azure Front Door에서 고객 관리형 TLS 인증서를 사용하는 경우 '최신' 인증서 버전을 사용합니다. 수동 인증서 갱신으로 인한 중단 위험을 줄입니다.",
- "waf": "작업"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
- "severity": "보통",
- "text": "WAF 정책과 함께 Azure Front Door를 사용하여 여러 Azure 지역에 걸쳐 있는 글로벌 HTTP/S 앱을 제공하고 보호할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "높다",
+ "text": "Virtual WAN에 연결되지 않은 VNet의 서브넷의 경우 인터넷 트래픽이 Azure Firewall 또는 네트워크 가상 어플라이언스로 리디렉션되도록 경로 테이블을 연결합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"severity": "보통",
- "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "text": "모든 Azure Firewall 배포에 대해 리소스별 대상 테이블을 사용하여 로그를 저장하는 진단 설정을 추가합니다.",
"training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
"severity": "높다",
- "text": "Web Application Firewall이 트래픽을 허용하거나 거부하기 위해 적절한 조치를 취할 수 있도록 Front Door에 대한 WAF 정책을 '방지' 모드'에 배포합니다.",
- "waf": "안전"
+ "text": "Azure Firewall 클래식 규칙(있는 경우)에서 방화벽 정책으로 마이그레이션합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "높다",
- "text": "Traffic Manager를 Front Door 뒤에 배치하지 마세요.",
+ "text": "Azure Firewall 서브넷에 /26 접두사를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
- "severity": "높다",
- "text": "Azure Front Door 및 원본에서 동일한 도메인 이름을 사용합니다. 호스트 이름이 일치하지 않으면 미묘한 버그가 발생할 수 있습니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "severity": "보통",
+ "text": "방화벽 정책 내의 규칙을 Rule Collection Groups(규칙 수집 그룹) 및 Rule Collections(규칙 컬렉션)로 정렬하고 사용 빈도에 따라 정렬합니다.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "낮다",
- "text": "Azure Front Door 원본 그룹에 원본이 하나만 있는 경우 상태 프로브를 사용하지 않도록 설정합니다.",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "보통",
+ "text": "IP 그룹 또는 IP 접두사를 사용하여 IP 테이블 규칙의 수를 줄입니다.",
"waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
"severity": "보통",
- "text": "Azure Front Door에 대한 양호한 상태 프로브 엔드포인트를 선택합니다. 애플리케이션의 모든 종속성을 확인하는 상태 엔드포인트를 구축하는 것이 좋습니다.",
- "waf": "신뢰도"
+ "text": "와일드카드를 DNAT의 소스 IP로 사용하지 마십시오(예: * 또는 any). 들어오는 DNAT에 대한 소스 IP를 지정해야 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
- "severity": "낮다",
- "text": "Azure Front Door와 함께 HEAD 상태 프로브를 사용하여 Front Door가 애플리케이션으로 보내는 트래픽을 줄입니다.",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "severity": "보통",
+ "text": "SNAT 포트 사용량을 모니터링하고, NAT 게이트웨이 설정을 평가하고, 원활한 장애 조치(failover)를 보장하여 SNAT 포트 고갈을 방지합니다. 포트 수가 제한에 가까워지면 SNAT 고갈이 임박했을 수 있다는 신호입니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
"waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"severity": "높다",
- "text": "Azure Front Door에서 관리형 TLS 인증서를 사용합니다. 운영 비용을 줄이고 인증서 갱신으로 인한 중단 위험을 줄입니다.",
- "waf": "작업"
+ "text": "Azure Firewall 프리미엄을 사용하는 경우 TLS 검사를 사용하도록 설정합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
- "severity": "보통",
- "text": "Azure Front Door WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.",
- "waf": "작업"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "낮다",
+ "text": "웹 범주를 사용하여 특정 주제에 대한 아웃바운드 액세스를 허용하거나 거부할 수 있습니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
- "severity": "높다",
- "text": "Azure Front Door에서 엔드투엔드 TLS를 사용합니다. 클라이언트에서 Front Door로, Front Door에서 원본으로의 연결에 TLS를 사용합니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "보통",
+ "text": "TLS 검사의 일환으로 검사를 위해 Azure App Gateway에서 트래픽 수신을 계획합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
"severity": "보통",
- "text": "Azure Front Door에서 HTTP를 HTTPS로 리디렉션을 사용합니다. 이전 클라이언트를 HTTPS 요청으로 자동으로 리디렉션하여 지원합니다.",
+ "text": "Azure Firewall DNS 프록시 구성을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "높다",
- "text": "Azure Front Door WAF를 사용하도록 설정합니다. 다양한 공격으로부터 애플리케이션을 보호합니다.",
- "waf": "안전"
+ "text": "Azure Firewall을 Azure Monitor와 통합하고 진단 로깅을 사용하도록 설정하여 방화벽 로그 및 메트릭을 저장하고 분석합니다.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
- "severity": "높다",
- "text": "검색 모드에서 WAF를 구성하여 워크로드에 맞게 Azure Front Door WAF를 조정하여 가양성 검색을 줄이고 수정합니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "낮다",
+ "text": "방화벽 규칙에 대한 백업 구현Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"severity": "높다",
- "text": "Azure Front Door WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.",
- "waf": "안전"
+ "text": "여러 가용성 영역에 Azure Firewall을 배포합니다. Azure Firewall은 배포에 따라 다른 SLA를 제공합니다. 단일 가용 영역 또는 여러 가용 영역에서 작동하여 안정성과 성능을 향상시킬 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "높다",
- "text": "Azure Front Door WAF 기본 규칙 집합을 사용하도록 설정합니다. 기본 규칙 집합은 일반적인 공격을 탐지하고 차단합니다.",
- "waf": "안전"
+ "text": "Azure Firewall VNet에서 DDoS Protection을 구성하고, DDoS 보호 계획을 Azure Firewall을 호스트하는 가상 네트워크와 연결하여 DDoS 공격에 대한 향상된 완화를 제공합니다. Azure Firewall Manager는 방화벽 인프라 및 DDoS 보호 계획 생성을 통합합니다. ",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"severity": "높다",
- "text": "Azure Front Door WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.",
+ "text": "컨트롤 플레인 트래픽을 차단하는 0.0.0.0/0 경로 또는 NSG 규칙과 같이 가상 네트워크에 삽입된 Azure PaaS 서비스에 대한 컨트롤 플레인 통신을 중단하지 마세요.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "보통",
- "text": "최신 Azure Front Door WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.",
+ "text": "프라이빗 엔드포인트 및 ExpressRoute 프라이빗 피어링을 통해 온-프레미스에서 Azure PaaS 서비스에 액세스하세요. 이 방법을 사용하면 공용 인터넷을 통해 전송하지 않아도 됩니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
- "severity": "보통",
- "text": "Azure Front Door WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 단기간에 많은 양의 트래픽을 보내는 것을 차단합니다.",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "severity": "높다",
+ "text": "모든 서브넷에서 기본적으로 가상 네트워크 서비스 엔드포인트를 사용하도록 설정하지 마세요.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
"severity": "보통",
- "text": "Azure Front Door WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호를 제공합니다.",
+ "text": "Azure Firewall 또는 NVA의 IP 주소 대신 FQDN을 사용하여 Azure PaaS 서비스에 대한 송신 트래픽을 필터링하여 데이터 반출을 방지합니다. Private Link를 사용하는 경우 모든 FQDN을 차단할 수 있으며, 그렇지 않으면 필요한 PaaS 서비스만 허용할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
- "severity": "낮다",
- "text": "모든 지역에서 트래픽이 발생할 것으로 예상되지 않는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "severity": "높다",
+ "text": "게이트웨이 서브넷에 /27 접두사 이상을 사용합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
- "severity": "보통",
- "text": "Azure Front Door WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 마세요.",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
+ "severity": "높다",
+ "text": "VirtualNetwork 서비스 태그를 사용하여 연결을 제한하는 NSG 인바운드 기본 규칙에 의존하지 마세요.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
"severity": "보통",
- "text": "Diagnostic Settings(진단 설정)를 켜서 로그 및 메트릭을 캡처합니다. 리소스 활동 로그, 액세스 로그, 상태 프로브 로그 및 WAF 로그를 포함합니다. 알림을 설정합니다.",
- "waf": "작업"
+ "text": "NSG를 사용하여 서브넷 전체의 트래픽과 플랫폼 전체의 동쪽/서쪽 트래픽(랜딩 존 간 트래픽)을 보호할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
"severity": "보통",
- "text": "Azure Front Door WAF 로그를 Microsoft Sentinel로 보냅니다.",
- "waf": "작업"
+ "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 랜딩 존 내의 트래픽을 마이크로 세그먼트화하고 중앙 NVA를 사용하여 트래픽 흐름을 필터링하지 않도록 합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"severity": "보통",
- "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 보조 지역으로 트래픽을 백업으로 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 앞의 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
- "waf": "신뢰도"
+ "text": "VNet 흐름 로그를 사용하도록 설정하고 트래픽 분석에 제공하여 내부 및 외부 트래픽 흐름에 대한 인사이트를 얻을 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
- "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
- "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
- "service": "Front Door",
- "severity": "높다",
- "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 가지고 있으며 각 인스턴스가 끝점 또는 원본을 노출하는지 확인하십시오. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "severity": "보통",
+ "text": "1,000개의 규칙 제한으로 인해 NSG당 900개 이상의 NSG 규칙을 구현하지 마세요.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
- "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
"severity": "보통",
- "text": "백 엔드에 대한 요청 전달에 대한 시간 제한을 설정합니다. 엔드포인트의 필요에 따라 시간 제한 설정을 조정합니다. 그렇지 않으면 원본이 응답을 보내기 전에 Azure Front Door가 연결을 닫을 수 있습니다. 모든 원본의 시간 제한이 더 짧은 경우 Azure Front Door의 기본 시간 제한을 낮출 수도 있습니다.",
- "waf": "신뢰도"
+ "text": "시나리오가 Virtual WAN 라우팅 디자인 목록에 명시적으로 설명된 경우 Virtual WAN을 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
- "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
"severity": "보통",
- "text": "응용 프로그램에 세션 선호도가 필요한지 여부를 결정합니다. 높은 안정성 요구 사항이 있는 경우 세션 선호도를 사용하지 않도록 설정하는 것이 좋습니다.",
- "waf": "신뢰도"
+ "text": "Azure 지역당 Virtual WAN 허브를 사용하여 공통 글로벌 Azure Virtual WAN을 통해 Azure 지역 간에 여러 랜딩 존을 함께 연결합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
"severity": "보통",
- "text": "호스트 헤더를 백 엔드로 보냅니다. 백 엔드 서비스는 해당 호스트의 트래픽만 허용하는 규칙을 만들 수 있도록 호스트 이름을 인식해야 합니다.",
+ "text": "아웃바운드 인터넷 트래픽 보호 및 필터링을 위해 보안 허브에 Azure Firewall을 배포합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
"severity": "보통",
- "text": "캐싱을 지원하는 엔드포인트에 대해 캐싱을 사용합니다.",
- "waf": "비용"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
- "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
- "severity": "낮다",
- "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성된 경우 이러한 호출이 필요하지 않습니다. 이는 엔드포인트에 여러 원본을 가질 수 없는 경우에만 권장됩니다.",
- "waf": "비용"
+ "text": "Virtual WAN 네트워크 아키텍처가 식별된 아키텍처 시나리오에 맞는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
"severity": "보통",
- "text": "보안 보고서를 활용하기 위해 프리미엄 계층을 사용하는 것이 좋지만 표준 Azure Front Door 프로필은 기본 제공 분석/보고서에서 트래픽 보고서만 제공합니다.",
+ "text": "Virtual WAN용 Azure Monitor Insights를 사용하여 Virtual WAN의 엔드투엔드 토폴로지, 상태 및 주요 메트릭을 모니터링합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
"severity": "보통",
- "text": "가능한 경우 와일드카드 TLS 인증서를 사용합니다.",
- "waf": "작업"
+ "text": "이러한 흐름을 명시적으로 차단해야 하는 경우가 아니면 Virtual WAN에서 분기 간 트래픽을 사용하지 않도록 설정하지 마세요.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
"severity": "보통",
- "text": "캐싱을 위해 응용 프로그램 쿼리 문자열을 최적화합니다. 순전히 정적인 콘텐츠의 경우 쿼리 문자열을 무시하여 캐시 사용을 최대화합니다. 응용 프로그램에서 쿼리 문자열을 사용하는 경우 캐시 키에 포함하는 것이 좋습니다. 캐시 키에 쿼리 문자열을 포함하면 Azure Front Door가 구성에 따라 캐시된 응답 또는 기타 응답을 제공할 수 있습니다.",
- "waf": "공연"
+ "text": "AS-Path는 ExpressRoute 또는 VPN보다 유연하므로 허브 라우팅 기본 설정으로 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
- "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
"severity": "보통",
- "text": "다운로드 가능한 콘텐츠에 액세스할 때 파일 압축을 사용합니다.",
- "waf": "공연"
+ "text": "Virtual WAN에서 레이블 기반 전파를 구성하지 않으면 가상 허브 간의 연결이 손상됩니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
- "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
- "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
- "service": "Front Door",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
"severity": "높다",
- "text": "클래식 Azure Front Door는 2027년 3월까지 더 이상 사용되지 않으므로 현재 클래식 Azure Front Door를 사용하는 경우 표준 또는 프리미엄 SKU로 마이그레이션하는 것이 좋습니다.",
- "waf": "작업"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
- "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
- "service": "Front Door",
- "severity": "보통",
- "text": "중요 업무용 고가용성 시나리오의 경우 Traffic Manager 부하 분산 Azure Front Door 및 타사 CDN 공급자 CDN 프로필을 사용하는 것이 좋습니다. ",
+ "text": "가상 허브에 /23 이상의 접두사를 할당하여 충분한 IP 공간을 사용할 수 있도록 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
- "service": "Front Door",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "높다",
- "text": "원본과 함께 Front Door를 App Services로 사용하는 경우 액세스 제한을 사용하여 Azure Front Door를 통해서만 앱 서비스에 대한 트래픽을 잠그는 것이 좋습니다. ",
+ "text": "Azure Policy를 전략적으로 활용하고, 정책 이니셔티브를 사용하여 관련 정책을 그룹화하여 환경에 대한 컨트롤을 정의합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
- "severity": "높다",
- "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "보통",
+ "text": "규정 및 규정 준수 요구 사항을 Azure Policy 정의 및 Azure 역할 할당에 매핑합니다.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "severity": "높다",
- "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "보통",
+ "text": "상속된 범위에서 할당할 수 있도록 중간 루트 관리 그룹에서 Azure Policy 정의를 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "높다",
- "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
- "waf": "신뢰도"
+ "text": "필요한 경우 최하위 수준에서 제외를 사용하여 가장 적절한 수준에서 정책 할당을 관리합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "severity": "높다",
- "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "낮다",
+ "text": "Azure Policy를 사용하여 사용자가 구독/관리 그룹 수준에서 프로비전할 수 있는 서비스를 제어합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
- "severity": "보통",
- "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.",
- "waf": "작업"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "높다",
+ "text": "가능한 경우 기본 제공 정책을 사용하여 운영 오버헤드를 최소화합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Resource Policy Contributor 역할을 특정 범위에 할당하면 정책 관리를 관련 팀에 위임할 수 있습니다. 예를 들어 중앙 IT 팀은 관리 그룹 수준 정책을 감독할 수 있고, 응용 프로그램 팀은 구독에 대한 정책을 처리하여 조직 표준을 준수하는 분산 거버넌스를 가능하게 할 수 있습니다.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "보통",
- "text": "유연한 서버 활용",
- "waf": "신뢰도"
+ "text": "특정 범위에서 기본 제공 Resource Policy Contributor 역할을 할당하여 응용 프로그램 수준 거버넌스를 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
- "severity": "높다",
- "text": "지역적으로 적용 가능한 경우 가용 영역 활용Leverage Availability Zones where regionally applicable",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "보통",
+ "text": "상속된 범위에서 제외를 통해 관리하지 않도록 루트 관리 그룹 범위에서 수행된 Azure Policy 할당 수를 제한합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
"severity": "보통",
- "text": "지역 간 DR 시나리오에 입력 데이터 복제 활용",
- "waf": "신뢰도"
+ "text": "데이터 주권 요구 사항이 있는 경우 이를 적용하기 위해 Azure 정책을 배포해야 합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
"severity": "보통",
- "text": "ACSS(Azure Center for SAP solutions)는 SAP를 Azure의 최상위 워크로드로 만드는 Azure 제품입니다. ACSS는 Azure에서 SAP 시스템을 통합 워크로드로 만들고 실행할 수 있도록 하는 엔드투엔드 솔루션으로, 혁신을 위한 보다 원활한 기반을 제공합니다. 새 Azure 기반 SAP 시스템과 기존 Azure 기반 SAP 시스템 모두에 대한 관리 기능을 활용할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "작업"
+ "text": "Sovereign Landing Zone의 경우 주권 정책 기준을 배포하고 올바른 관리 그룹 수준에서 할당합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
"severity": "보통",
- "text": "Azure는 Linux 및 Windows에서 SAP 배포 자동화를 지원합니다. SAP Deployment Automation Framework는 SAP 환경을 배포, 설치 및 유지 관리할 수 있는 오픈 소스 오케스트레이션 툴입니다.",
- "training": "https://github.com/Azure/sap-automation",
- "waf": "작업"
+ "text": "Sovereign Landing Zone의 경우 정책 매핑에 대한 Sovereign Control 목표를 문서화합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
"severity": "보통",
- "text": "RTO를 충족하는 언제든지 특정 시점과 시간 프레임에서 프로덕션 데이터베이스에 대한 특정 시점 복구를 수행합니다. 특정 시점 복구에는 일반적으로 DBMS 계층 또는 SAP를 통해 데이터를 삭제하는 운영자 오류가 포함됩니다",
- "waf": "신뢰도"
+ "text": "Sovereign Landing Zone의 경우 'Sovereign Control 목표를 정책 매핑에 적용'을 관리하기 위한 프로세스가 마련되어 있는지 확인합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
"severity": "보통",
- "text": "백업 및 복구 시간을 테스트하여 재해 발생 후 모든 시스템을 동시에 복원하기 위한 RTO 요구 사항을 충족하는지 확인합니다.",
- "waf": "신뢰도"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
- "severity": "높다",
- "text": "쌍을 이루는 지역 간에 표준 스토리지를 복제할 수 있지만 표준 스토리지를 사용하여 데이터베이스 또는 가상 하드 디스크를 저장할 수는 없습니다. 사용하는 쌍을 이루는 지역 간에만 백업을 복제할 수 있습니다. 다른 모든 데이터의 경우 SQL Server Always On 또는 SAP HANA 시스템 복제와 같은 기본 DBMS 기능을 사용하여 복제를 실행합니다. SAP 애플리케이션 계층에 Site Recovery, rsync 또는 robocopy 및 기타 타사 소프트웨어를 조합하여 사용합니다.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "신뢰도"
+ "text": "Azure RBAC(Azure 역할 기반 액세스 제어), 데이터 주권 요구 사항 또는 데이터 보존 정책에 따라 별도의 작업 영역이 필요한 경우를 제외하고 단일 모니터 로그 작업 영역을 사용하여 플랫폼을 중앙에서 관리합니다.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "보통",
- "text": "고가용성을 달성하기 위해 Azure 가용성 영역을 사용하는 경우 SAP 애플리케이션 서버와 데이터베이스 서버 간의 대기 시간을 고려해야 합니다. 대기 시간이 긴 영역의 경우 SAP 애플리케이션 서버와 데이터베이스 서버가 항상 동일한 영역에서 실행되도록 운영 절차를 마련해야 합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "text": "모든 지역에 대해 단일 Azure Monitor 로그 작업 영역을 사용할지 또는 다양한 지리적 지역을 포괄하는 여러 작업 영역을 만들지 여부를 결정합니다. 각 접근 방식에는 잠재적인 지역 간 네트워킹 요금을 포함하여 장점과 단점이 있습니다",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "높다",
- "text": "온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로의 ExpressRoute 연결을 설정합니다. 또한 ExpressRoute를 사용하는 대신 온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로 VPN 연결을 설정하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "신뢰도"
+ "text": "로그 보존 요구 사항이 12년을 초과하는 경우 로그를 Azure Storage로 내보냅니다. Write-Once, Read-Many 정책과 함께 변경할 수 없는 스토리지를 사용하여 사용자가 지정한 간격 동안 데이터를 지우거나 수정할 수 없도록 합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
- "severity": "낮다",
- "text": "DR 지역에서 데이터의 암호를 해독할 수 있도록 인증서, 비밀 또는 키와 같은 키 자격 증명 모음 콘텐츠를 지역 간에 복제합니다.",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "보통",
+ "text": "Azure Policy를 사용하여 OS 수준 VM(가상 머신) 구성 드리프트를 모니터링합니다. 정책을 통해 Azure Automanage Machine Configuration 감사 기능을 사용하도록 설정하면 애플리케이션 팀 워크로드가 적은 노력으로 기능 기능을 즉시 사용할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
"severity": "보통",
- "text": "기본 및 재해 복구 가상 네트워크를 피어링합니다. 예를 들어 HANA 시스템 복제의 경우 SAP HANA DB 가상 네트워크를 재해 복구 사이트의 SAP HANA DB 가상 네트워크에 피어링해야 합니다.",
- "waf": "신뢰도"
+ "text": "Azure에서 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure 업데이트 관리자를 사용합니다.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
- "severity": "낮다",
- "text": "SAP 배포에 Azure NetApp Files 스토리지를 사용하는 경우 최소한 두 지역의 프리미엄 계층에 두 개의 Azure NetApp Files 계정을 만듭니다.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "severity": "보통",
+ "text": "Azure Arc를 사용하여 Azure 외부의 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure 업데이트 관리자를 사용합니다.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "높다",
- "text": "기본 데이터베이스 복제 기술을 사용하여 HA 쌍의 데이터베이스를 동기화해야 합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "보통",
+ "text": "Network Watcher를 사용하여 트래픽 흐름을 사전에 모니터링합니다.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "높다",
- "text": "기본 VNet(가상 네트워크)의 CIDR은 DR 사이트 VNet의 CIDR과 충돌하거나 겹치지 않아야 합니다",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "보통",
+ "text": "인사이트 및 보고를 위해 Azure Monitor 로그를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
- "severity": "높다",
- "text": "Site Recovery를 사용하여 응용 프로그램 서버를 DR 사이트에 복제합니다. Site Recovery는 중앙 서비스 클러스터 VM을 DR 사이트에 복제하는 데도 도움이 될 수 있습니다. DR을 호출할 때 DR 사이트에서 Linux Pacemaker 클러스터를 다시 구성해야 합니다(예: VIP 또는 SBD 바꾸기, corosync.conf 실행 등).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "보통",
+ "text": "Azure Monitor 경고를 사용하여 운영 경고를 생성합니다.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "높다",
- "text": "단일 장애 지점에 대한 SAP 소프트웨어의 가용성을 고려합니다. 여기에는 SAP NetWeaver 및 SAP S/4HANA 아키텍처, SAP ABAP 및 ASCS + SCS에서 사용되는 DBMS와 같은 애플리케이션 내의 단일 실패 지점이 포함됩니다. 또한 SAP Web Dispatcher와 같은 다른 도구도 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "보통",
+ "text": "Azure Automation 계정을 통해 변경 및 인벤토리 추적을 사용하는 경우 Log Analytics 작업 영역과 자동화 계정을 함께 연결하는 데 지원되는 지역을 선택했는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP 및 SAP 데이터베이스의 경우 자동 장애 조치(failover) 클러스터를 구현하는 것이 좋습니다. Windows에서 Windows Server 장애 조치(failover) 클러스터링은 장애 조치(failover)를 지원합니다. Linux에서 Linux Pacemaker 또는 SIOS Protection Suite 및 Veritas InfoScale과 같은 타사 도구는 장애 조치를 지원합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "낮다",
+ "text": "Azure Backup을 사용하는 경우 기본 설정은 GRS이므로 백업에 올바른 백업 유형(GRS, ZRS & LRS)을 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
"waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "높다",
- "text": "Azure는 기본 및 보조 VM이 DBMS 데이터에 대한 스토리지를 공유하는 아키텍처를 지원하지 않습니다. DBMS 계층의 경우 일반적인 아키텍처 패턴은 기본 및 보조 VM에서 사용하는 것과 다른 스토리지 스택을 사용하여 동시에 데이터베이스를 복제하는 것입니다.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "severity": "보통",
+ "text": "Azure 게스트 정책을 사용하여 VM 확장을 통해 소프트웨어 구성을 자동으로 배포하고 규격 기준 VM 구성을 적용합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
- "severity": "높다",
- "text": "DBMS 데이터 및 트랜잭션/다시 실행 로그 파일은 Azure 지원 블록 스토리지 또는 Azure NetApp Files에 저장됩니다. Azure Files 또는 Azure Premium Files는 SAP 워크로드를 사용하여 DBMS 데이터 및/또는 다시 실행 로그 파일에 대한 스토리지로 지원되지 않습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Azure Policy의 게스트 구성 기능을 사용하여 컴퓨터 설정(예: OS, 애플리케이션, 환경)을 감사하고 수정하여 리소스가 예상 구성에 맞는지 확인하고, 업데이트 관리는 VM에 대한 패치 관리를 적용할 수 있습니다.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "severity": "보통",
+ "text": "Azure Policy를 통해 VM 보안 구성 드리프트를 모니터링합니다.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
- "severity": "높다",
- "text": "ASCS + SCS 구성 요소 및 특정 고가용성 시나리오에 대해 Windows에서 Azure 공유 디스크를 사용할 수 있습니다. SAP 애플리케이션 계층 구성 요소 및 DBMS 계층에 대해 장애 조치(failover) 클러스터를 별도로 설정합니다. Azure는 현재 SAP 애플리케이션 계층 구성 요소와 DBMS 계층을 하나의 장애 조치(failover) 클러스터로 결합하는 고가용성 아키텍처를 지원하지 않습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "신뢰도"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP ASCS(애플리케이션 계층 구성 요소) 및 DBMS 계층에 대한 대부분의 장애 조치(failover) 클러스터에는 장애 조치(failover) 클러스터에 대한 가상 IP 주소가 필요합니다. Azure Load Balancer는 다른 모든 경우에 대해 가상 IP 주소를 처리해야 합니다. 한 가지 설계 원칙은 클러스터 구성당 하나의 부하 분산 장치를 사용하는 것입니다. 부하 분산 장치의 표준 버전(표준 Load Balancer SKU)을 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "보통",
+ "text": "Azure-to-Azure Virtual Machines 재해 복구 시나리오에는 Azure Site Recovery를 사용합니다. 이렇게 하면 지역 간에 워크로드를 복제할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
- "severity": "높다",
- "text": "로드 밸런서에서 부동 IP가 활성화되어 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "보통",
+ "text": "Azure 네이티브 백업 기능 또는 Azure 호환 타사 백업 솔루션을 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"severity": "높다",
- "text": "고가용성 인프라를 배포하기 전에 선택한 지역에 따라 Azure 가용성 집합을 사용하여 배포할지 또는 가용성 영역을 사용하여 배포할지를 결정합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "신뢰도"
+ "text": "진단 설정을 추가하여 Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 WAF 로그를 저장합니다. 로그를 정기적으로 검토하여 공격 및 가양성 탐지를 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)용 애플리케이션에 대한 인프라 SLA를 충족하려면 모든 구성 요소에 대해 동일한 고가용성 옵션(VM, 가용성 집합, 가용성 영역)을 선택해야 합니다.",
- "waf": "신뢰도"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
+ "severity": "보통",
+ "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 Microsoft Sentinel로 WAF 로그를 보냅니다. 공격을 탐지하고 WAF 텔레메트리를 전체 Azure 환경에 통합합니다.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"severity": "높다",
- "text": "동일한 가용성 집합에서 서로 다른 역할의 서버를 혼합하지 마십시오. 중앙 서비스 VM, 데이터베이스 VM, 애플리케이션 VM을 자체 가용성 집합으로 유지",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "신뢰도"
+ "text": "Azure Key Vault를 사용하여 비밀과 자격 증명을 저장합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"severity": "보통",
- "text": "근접 배치 그룹을 사용하지 않는 한 Azure 가용성 영역 내에 Azure 가용성 집합을 배포할 수 없습니다.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "신뢰도"
+ "text": "서로 다른 애플리케이션 및 지역에 대해 서로 다른 Azure Key Vault를 사용하여 트랜잭션 규모 제한을 방지하고 비밀에 대한 액세스를 제한합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "높다",
- "text": "가용성 집합을 만들 때 사용 가능한 최대 장애 도메인 및 업데이트 도메인 수를 사용합니다. 예를 들어 하나의 가용성 집합에 두 개 이상의 VM을 배포하는 경우 Azure 계획된 유지 관리 외에도 잠재적인 물리적 하드웨어 오류, 네트워크 중단 또는 전원 중단의 영향을 제한할 수 있는 최대 장애 도메인 수(3개)와 충분한 업데이트 도메인을 사용합니다. 장애 도메인의 기본 수는 2개이며 나중에 온라인으로 변경할 수 없습니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "높다",
- "text": "가용성 집합 배포에서 Azure 근접 배치 그룹을 사용하는 경우 세 가지 SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)가 모두 동일한 근접 배치 그룹에 있어야 합니다.",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "키, 비밀 및 인증서를 영구적으로 삭제할 수 있는 권한 부여를 특수 사용자 지정 Microsoft Entra ID 역할로 제한하여 최소 권한 모델을 따릅니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP SID당 하나의 근접 배치 그룹을 사용합니다. 그룹은 가용성 영역 또는 Azure 지역에 걸쳐 있지 않습니다.",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "공용 인증 기관을 통해 인증서 관리 및 갱신 프로세스를 자동화하여 관리를 용이하게 합니다.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "높다",
- "text": "운영 체제에 따라 다음 서비스 중 하나를 사용하여 SAP 중앙 서비스 클러스터를 실행합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "키 및 인증서 교체를 위한 자동화된 프로세스를 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "보통",
- "text": "Azure는 현재 동일한 Linux Pacemaker 클러스터에서 ASCS와 DB HA를 결합하는 것을 지원하지 않습니다. 개별 클러스터로 분리합니다. 그러나 최대 5개의 여러 중앙 서비스 클러스터를 한 쌍의 VM으로 결합할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "신뢰도"
+ "text": "자격 증명 모음에서 방화벽 및 가상 네트워크 서비스 엔드포인트 또는 프라이빗 엔드포인트를 사용하도록 설정하여 키 자격 증명 모음에 대한 액세스를 제어합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"severity": "보통",
- "text": "가용성 집합 또는 가용성 영역의 고가용성 쌍에 두 VM을 모두 배포합니다. 이러한 VM은 크기가 동일해야 하며 스토리지 구성이 동일해야 합니다.",
- "waf": "신뢰도"
+ "text": "플랫폼 중앙 Azure Monitor Log Analytics 작업 영역을 사용하여 Key Vault의 각 인스턴스 내에서 키, 인증서 및 비밀 사용을 감사합니다.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "보통",
- "text": "Azure는 RHEL(Red Hat Enterprise Linux)에서 실행되는 동일한 고가용성 클러스터에서 SAP HANA와 ASCS/SCS 및 ERS 인스턴스의 설치 및 구성을 지원합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "신뢰도"
+ "text": "Key Vault 인스턴스화 및 권한 있는 액세스를 위임하고 Azure Policy를 사용하여 일관된 규정 준수 구성을 적용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
- "severity": "높다",
- "text": "프리미엄 관리형 SSD에서 모든 프로덕션 시스템을 실행하고 Azure NetApp Files 또는 Ultra Disk Storage를 사용합니다. 적어도 OS 디스크는 더 나은 성능과 최상의 SLA를 달성할 수 있도록 프리미엄 계층에 있어야 합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "애플리케이션당 환경, 지역별 Azure Key Vault를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
- "severity": "높다",
- "text": null,
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "보통",
+ "text": "사용자 고유의 키를 가져오려는 경우 고려되는 모든 서비스에서 지원되지 않을 수 있습니다. 불일치가 원하는 결과를 방해하지 않도록 관련 완화를 구현합니다. 대기 시간을 최소화하는 적절한 지역 쌍 및 재해 복구 지역을 선택합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP 워크로드에 사용하는 스토리지 유형에 따라 고가용성을 구성하는 것이 좋습니다. Azure에서 사용할 수 있는 일부 스토리지 서비스는 Azure Site Recovery에서 지원되지 않으므로 고가용성 구성이 다를 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "신뢰도"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
- "severity": "높다",
- "text": null,
- "waf": "신뢰도"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"severity": "보통",
- "text": "SAP System Start-Stop을 자동화하여 비용을 관리합니다.",
- "waf": "비용"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "낮다",
- "text": "SAP HANA와 함께 Azure Premium Storage를 사용하는 경우 Azure Standard SSD Storage를 사용하여 비용에 민감한 스토리지 솔루션을 선택할 수 있습니다. 그러나 표준 SSD 또는 표준 HDD Azure Storage를 선택하면 개별 VM의 SLA에 영향을 줍니다. 또한 비프로덕션 환경과 같이 I/O 처리량이 낮고 대기 시간이 짧은 시스템의 경우 더 낮은 시리즈 VM을 사용할 수 있습니다.",
- "waf": "비용"
+ "text": "Sovereign Landing Zone의 경우 Azure Key Vault 관리형 HSM을 사용하여 비밀과 자격 증명을 저장합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "낮다",
- "text": "저렴한 대체 구성(다목적)으로 비프로덕션 HANA 데이터베이스 서버 VM에 대해 저성능 SKU를 선택할 수 있습니다. 그러나 E 시리즈와 같은 일부 VM 유형은 HANA 인증(SAP HANA 하드웨어 디렉터리)되지 않았거나 1ms 미만의 스토리지 대기 시간을 달성할 수 없다는 점에 유의해야 합니다.",
- "waf": "비용"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "Microsoft Entra ID 보고 기능을 사용하여 액세스 제어 감사 보고서를 생성합니다.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
- "severity": null,
- "text": null,
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "severity": "높다",
+ "text": "모든 구독에 대해 Defender 클라우드 보안 태세 관리를 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "보통",
- "text": "클라우드 커넥터를 통해 SAP 클라우드 애플리케이션에서 SAP 온-프레미스(IaaS 포함)로 ID를 전달하기 위한 주체 전파 적용",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "높다",
+ "text": "모든 구독의 서버에 대해 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "보통",
- "text": "SAML을 사용하여 Azure AD를 사용하여 SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics 및 SAP C4C와 같은 SAP SaaS 애플리케이션에 SSO를 구현합니다.",
- "waf": null
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "높다",
+ "text": "모든 구독에서 Azure 리소스에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": null,
- "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": null
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "높다",
+ "text": "IaaS 서버에서 Endpoint Protection을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "보통",
- "text": null,
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "text": "Azure Monitor 로그 및 클라우드용 Defender를 통해 기본 운영 체제 패치 드리프트를 모니터링합니다.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "보통",
- "text": "SAP NetWeaver SSO 또는 파트너 솔루션을 사용하여 SAP GUI에 SSO를 구현할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "기본 리소스 구성을 중앙 집중식 Azure Monitor Log Analytics 작업 영역에 연결합니다.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
- "severity": "보통",
- "text": "SAP GUI 및 웹 브라우저 액세스용 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP Secure Login Server를 고려합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
+ "severity": "높다",
+ "text": "상관 관계가 있는 로그를 통한 중앙 집중식 위협 탐지 - SIEM(보안 정보 및 이벤트 관리)을 통해 다양한 서비스 간에 상관 관계를 파악할 수 있는 중앙 위치에 보안 데이터를 통합합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"severity": "보통",
- "text": null,
+ "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 투명 로그를 사용하도록 설정합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"severity": "보통",
- "text": "SAP NetWeaver용 OAuth를 사용하여 SSO를 구현하여 타사 또는 사용자 지정 애플리케이션이 SAP NetWeaver OData 서비스에 액세스할 수 있도록 합니다.",
+ "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 고객 Lockbox를 사용하도록 설정합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
- "severity": "보통",
- "text": "SAP HANA에 대한 SSO 구현",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대한 보안 전송을 사용하도록 설정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure AD를 RISE에서 호스트되는 SAP 시스템의 ID 공급자로 간주합니다. 자세한 내용은 Azure AD와 서비스 통합을 참조하세요.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대해 컨테이너 일시 삭제를 사용하도록 설정하여 삭제된 컨테이너와 해당 콘텐츠를 복구합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
- "severity": "보통",
- "text": "SAP에 액세스하는 애플리케이션의 경우 주체 전파를 사용하여 SSO를 설정할 수 있습니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "severity": "높다",
+ "text": "Key Vault 비밀을 사용하여 자격 증명(가상 머신 사용자 암호), 인증서 또는 키와 같은 중요한 정보를 하드 코딩하지 않도록 합니다.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.Cdn/profiles/secrets' | extend frontDoorId = substring(id, 0, indexof(id, '/secrets')) | where properties.parameters.type =~ 'CustomerCertificate' | extend compliant = properties.parameters.useLatestVersion == true | project compliant, id=frontDoorId, certificateName = name | distinct id, certificateName, compliant",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"severity": "보통",
- "text": "SAP IAS(Identity Authentication Service)가 필요한 SAP BTP 서비스 또는 SaaS 솔루션을 사용하는 경우 SAP Cloud Identity Authentication Services와 Azure AD 간에 SSO를 구현하여 해당 SAP 서비스에 액세스하는 것이 좋습니다. 이 통합을 통해 SAP IAS는 프록시 ID 공급자 역할을 하고 중앙 사용자 저장소 및 ID 공급자로 Azure AD에 인증 요청을 전달할 수 있습니다.",
- "waf": "안전"
+ "text": "Azure Front Door에서 고객 관리형 TLS 인증서를 사용하는 경우 '최신' 인증서 버전을 사용합니다. 수동 인증서 갱신으로 인한 중단 위험을 줄입니다.",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.cdn/profiles' and sku has 'AzureFrontDoor' | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | join kind= fullouter ( cdnresources | where type == 'microsoft.cdn/profiles/securitypolicies' | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | extend splitid=split(id, '/') | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), '/')) | project secpolname=name, cdnprofileid, wafpolicyid ) on cdnprofileid | project name, cdnprofileid, secpolname, wafpolicyid,skuname | join kind = fullouter ( resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | extend managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != '[]', true, false), enabledState = tostring(properties.policySettings.enabledState) | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) ) on wafpolicyid | where name != '' | summarize associatedsecuritypolicies=countif(secpolname != ''), wafswithmanagedrules=countif(managedrulesenabled == 1) by name, id=cdnprofileid, tags,skuname | extend compliant = (associatedsecuritypolicies > 0 and wafswithmanagedrules > 0) | project id, compliant",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"severity": "보통",
- "text": "SAP BTP에 대한 SSO 구현",
+ "text": "WAF 정책과 함께 Azure Front Door를 사용하여 여러 Azure 지역에 걸쳐 있는 글로벌 HTTP/S 앱을 제공하고 보호할 수 있습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=application-gateway&pivots=front-door-standard-premium#example-configuration",
+ "service": "Front Door",
"severity": "보통",
- "text": "SAP SuccessFactors를 사용하는 경우 Azure AD 자동화된 사용자 프로비저닝을 사용하는 것이 좋습니다. 이 통합을 통해 SAP SuccessFactors에 신입 사원을 추가할 때 Azure AD에서 해당 사용자 계정을 자동으로 생성할 수 있습니다. 필요에 따라 Microsoft 365 또는 Azure AD에서 지원하는 기타 SaaS 애플리케이션에서 사용자 계정을 만들 수 있습니다. SAP SuccessFactors에 이메일 주소의 쓰기 저장을 사용합니다.",
+ "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "description": "관리 그룹 계층 구조를 4개 이하로 합리적으로 평평하게 유지합니다.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
- "severity": "보통",
- "text": "SAP 구독에 기존 관리 그룹 정책 적용",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "작업"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"severity": "높다",
- "text": "긴밀하게 결합된 애플리케이션을 동일한 SAP 구독에 통합하여 추가적인 라우팅 및 관리 복잡성 방지",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "작업"
+ "text": "Web Application Firewall이 트래픽을 허용하거나 거부하기 위해 적절한 조치를 취할 수 있도록 Front Door에 대한 WAF 정책을 '방지' 모드'에 배포합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend compliant = properties['hostName'] !endswith '.trafficmanager.net' | project compliant, id=frontDoorId",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
"severity": "높다",
- "text": "구독을 배율 단위로 활용하고 리소스를 확장하려면 환경별로 구독을 배포하는 것이 좋습니다. 샌드박스, 비프로덕션, 프로덕션 ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "작업"
+ "text": "Traffic Manager를 Front Door 뒤에 배치하지 마세요.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origins')) | extend compliant = isempty(properties.originHostHeader) or (tostring(properties.hostName) =~ tostring(properties.originHostHeader)) | project id=frontDoorId, originName = name, compliant",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"severity": "높다",
- "text": "구독 프로비저닝의 일부로 할당량 증가를 보장(예: 구독 내에서 사용 가능한 총 VM 코어 수)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "작업"
+ "text": "Azure Front Door 및 원본에서 동일한 도메인 이름을 사용합니다. 호스트 이름이 일치하지 않으면 미묘한 버그가 발생할 수 있습니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"severity": "낮다",
- "text": "할당량 API는 Azure 서비스에 대한 할당량을 보고 관리하는 데 사용할 수 있는 REST API입니다. 필요한 경우 사용을 고려하십시오.",
- "waf": "작업"
+ "text": "Azure Front Door 원본 그룹에 원본이 하나만 있는 경우 상태 프로브를 사용하지 않도록 설정합니다.",
+ "waf": "공연"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
- "severity": "높다",
- "text": "가용성 영역에 배포하는 경우 할당량이 승인되면 VM의 영역 배포를 사용할 수 있는지 확인합니다. 필요한 구독, VM 시리즈, CPU 수 및 가용성 영역을 포함한 지원 요청을 제출합니다.",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
+ "severity": "보통",
+ "text": "Azure Front Door에 대한 양호한 상태 프로브 엔드포인트를 선택합니다. 애플리케이션의 모든 종속성을 확인하는 상태 엔드포인트를 구축하는 것이 좋습니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
+ "severity": "낮다",
+ "text": "Azure Front Door와 함께 HEAD 상태 프로브를 사용하여 Front Door가 애플리케이션으로 보내는 트래픽을 줄입니다.",
+ "waf": "공연"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
"severity": "높다",
- "text": "필요한 서비스 및 기능이 선택한 배포 지역 내에서 사용할 수 있는지 확인합니다(예: ). ANF, 지역 등.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "text": "Azure Front Door에서 관리형 TLS 인증서를 사용합니다. 운영 비용을 줄이고 인증서 갱신으로 인한 중단 위험을 줄입니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"severity": "보통",
- "text": "비용 분류 및 리소스 그룹화를 위해 Azure 리소스 태그 활용(BillTo, 부서(또는 사업부), 환경(프로덕션, 스테이지, 개발), 계층(웹 계층, 응용 프로그램 계층), 응용 프로그램 소유자, 프로젝트 이름)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Azure Front Door WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = forwardingProtocol =~ 'httpsonly' and (supportedProtocols has 'https' or httpsRedirect =~ 'enabled') | project id = frontDoorId, compliant",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"severity": "높다",
- "text": "Azure Backup 서비스를 사용하여 HANA 데이터베이스를 보호할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "신뢰도"
+ "text": "Azure Front Door에서 엔드투엔드 TLS를 사용합니다. 클라이언트에서 Front Door로, Front Door에서 원본으로의 연결에 TLS를 사용합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type == 'microsoft.cdn/profiles/afdendpoints/routes' | extend frontDoorId = substring(id, 0, indexof(id, '/afdendpoints')) | extend forwardingProtocol=tostring(properties.forwardingProtocol),supportedProtocols=properties.supportedProtocols,httpsRedirect=properties.httpsRedirect | extend compliant = httpsRedirect =~ 'enabled' | project id = frontDoorId, compliant",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"severity": "보통",
- "text": "HANA, Oracle 또는 DB2 데이터베이스에 Azure NetApp Files를 배포하는 경우 Azure 애플리케이션 일치 스냅샷 도구(AzAcSnap)를 사용하여 애플리케이션 일치 스냅샷을 만듭니다. AzAcSnap은 Oracle 데이터베이스도 지원합니다. 개별 VM이 아닌 중앙 VM에서 AzAcSnap을 사용하는 것이 좋습니다.",
- "waf": "신뢰도"
+ "text": "Azure Front Door에서 HTTP를 HTTPS로 리디렉션을 사용합니다. 이전 클라이언트를 HTTPS 요청으로 자동으로 리디렉션하여 지원합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
"severity": "높다",
- "text": "운영 체제와 SAP 시스템 간의 표준 시간대 일치를 확인합니다.",
- "waf": "작업"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
- "severity": "보통",
- "text": "동일한 클러스터에서 서로 다른 애플리케이션 서비스를 그룹화하지 마세요. 예를 들어 DRBD와 중앙 서비스 클러스터를 동일한 클러스터에 결합하지 마세요. 그러나 동일한 Pacemaker 클러스터를 사용하여 약 5개의 서로 다른 중앙 서비스(다중 SID 클러스터)를 관리할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "신뢰도"
+ "text": "Azure Front Door WAF를 사용하도록 설정합니다. 다양한 공격으로부터 애플리케이션을 보호합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
- "severity": "낮다",
- "text": "Azure 실행 비용을 절약하고 최적화하기 위해 스누즈 모델에서 개발/테스트 시스템을 실행하는 것이 좋습니다.",
- "waf": "비용"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
+ "severity": "높다",
+ "text": "검색 모드에서 WAF를 구성하여 워크로드에 맞게 Azure Front Door WAF를 조정하여 가양성 검색을 줄이고 수정합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
- "severity": "보통",
- "text": "SAP 자산을 관리하여 고객과 파트너 관계를 맺는 경우 Azure Lighthouse를 사용하는 것이 좋습니다. Azure Lighthouse를 사용하면 관리 서비스 공급자가 Azure 네이티브 ID 서비스를 사용하여 고객 환경에 인증할 수 있습니다. 고객은 언제든지 액세스 권한을 취소하고 서비스 제공업체의 조치를 감사할 수 있으므로 제어권을 고객에게 부여합니다.",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
+ "severity": "높다",
+ "text": "Azure Front Door WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure 업데이트 관리자를 사용하여 단일 VM 또는 여러 VM에 대해 사용 가능한 업데이트의 상태를 확인하고 정기적인 패치를 예약하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
+ "severity": "높다",
+ "text": "Azure Front Door WAF 기본 규칙 집합을 사용하도록 설정합니다. 기본 규칙 집합은 일반적인 공격을 탐지하고 차단합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
- "severity": "낮다",
- "text": "SAP Landscape Management(LaMa)를 사용하여 SAP Basis 운영을 최적화하고 관리합니다. Azure용 SAP LaMa 커넥터를 사용하여 SAP 시스템을 재배치, 복사, 복제 및 새로 고칩니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
+ "severity": "높다",
+ "text": "Azure Front Door WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"severity": "보통",
- "text": "SAP용 Azure Monitor 솔루션을 사용하여 Azure에서 SAP 워크로드(SAP HANA, 고가용성 SUSE 클러스터 및 SQL 시스템)를 모니터링합니다. SAP Solution Manager를 사용하여 SAP용 Azure Monitor 솔루션을 보완하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "작업"
+ "text": "최신 Azure Front Door WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP용 VM 확장 검사를 실행합니다. SAP용 VM 확장은 VM(가상 머신)의 할당된 관리 ID를 사용하여 VM 모니터링 및 구성 데이터에 액세스합니다. 이 검사는 SAP 애플리케이션의 모든 성능 메트릭이 기본 SAP용 Azure 확장에서 제공되는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "작업"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
+ "severity": "보통",
+ "text": "Azure Front Door WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 단기간에 많은 양의 트래픽을 보내는 것을 차단합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
"severity": "보통",
- "text": "액세스 제어 및 규정 준수 보고에 Azure Policy를 사용합니다. Azure Policy는 일관된 정책 준수와 빠른 위반 감지를 보장하기 위해 조직 전체 설정을 적용할 수 있는 기능을 제공합니다. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "작업"
+ "text": "Azure Front Door WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호를 제공합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
+ "severity": "낮다",
+ "text": "모든 지역에서 트래픽이 발생할 것으로 예상되지 않는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
"severity": "보통",
- "text": "Azure Network Watcher의 연결 모니터를 사용하여 SAP 데이터베이스 및 애플리케이션 서버에 대한 대기 시간 메트릭을 모니터링합니다. 또는 Azure Monitor를 사용하여 네트워크 대기 시간 측정값을 수집하고 표시합니다.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "text": "Azure Front Door WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 마세요.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
+ "severity": "보통",
+ "text": "Diagnostic Settings(진단 설정)를 켜서 로그 및 메트릭을 캡처합니다. 리소스 활동 로그, 액세스 로그, 상태 프로브 로그 및 WAF 로그를 포함합니다. 알림을 설정합니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"severity": "보통",
- "text": "프로비저닝된 Azure 인프라에서 SAP HANA에 대한 품질 검사를 수행하여 프로비저닝된 VM이 Azure의 SAP HANA 모범 사례를 준수하는지 확인합니다.",
+ "text": "Azure Front Door WAF 로그를 Microsoft Sentinel로 보냅니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3bb0a854-ea3d-4212-bd8e-3f0cb7792b02",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods",
+ "service": "Front Door",
+ "severity": "보통",
+ "text": "배포 전략을 지원하는 라우팅 방법을 선택합니다. 구성된 가중치 계수에 따라 트래픽을 분산하는 가중치 방법은 액티브-액티브 모델을 지원합니다. 모든 트래픽을 수신하고 보조 지역으로 트래픽을 백업으로 보내도록 주 지역을 구성하는 우선 순위 기반 값은 활성-수동 모델을 지원합니다. 앞의 방법을 지연 시간과 결합하여 지연 시간이 가장 낮은 오리진이 트래픽을 수신하도록 합니다.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 | project id = frontDoorId, compliant",
+ "guid": "c3a769e4-cc78-40a9-b36a-f9bcab19ec2d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/quickstart-create-front-door",
+ "service": "Front Door",
"severity": "높다",
- "text": "각 Azure 구독에 대해 영역 배포 전에 Azure 가용성 영역에서 대기 시간 테스트를 실행하여 Azure에서 SAP를 배포하기 위한 대기 시간이 짧은 영역을 선택합니다.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "공연"
+ "text": "하나 이상의 백 엔드 풀에 여러 원본을 두어 중복성을 지원합니다. 항상 응용 프로그램의 중복 인스턴스를 가지고 있으며 각 인스턴스가 끝점 또는 원본을 노출하는지 확인하십시오. 이러한 원본을 하나 이상의 백 엔드 풀에 배치할 수 있습니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "999852be-2137-4179-8fc3-30d1df6fed1d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/troubleshoot-issues#troubleshooting-steps",
+ "service": "Front Door",
"severity": "보통",
- "text": "복원력 보고서를 실행하여 프로비저닝된 전체 Azure 인프라(컴퓨팅, 데이터베이스, 네트워킹, 스토리지, Site Recovery)의 구성이 Azure용 Cloud Adaption Framework에서 정의한 구성을 준수하는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "text": "백 엔드에 대한 요청 전달에 대한 시간 제한을 설정합니다. 엔드포인트의 필요에 따라 시간 제한 설정을 조정합니다. 그렇지 않으면 원본이 응답을 보내기 전에 Azure Front Door가 연결을 닫을 수 있습니다. 모든 원본의 시간 제한이 더 짧은 경우 Azure Front Door의 기본 시간 제한을 낮출 수도 있습니다.",
"waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "17bf6351-3e5e-41f1-87bb-d5ad0b4e3de6",
+ "link": "https://learn.microsoft.com/azure/frontdoor/routing-methods#23session-affinity",
+ "service": "Front Door",
"severity": "보통",
- "text": "SAP용 Microsoft Sentinel 솔루션을 사용하여 위협 방지를 구현합니다. 이 솔루션을 사용하여 SAP 시스템을 모니터링하고 비즈니스 로직 및 애플리케이션 계층 전반에서 정교한 위협을 탐지할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "text": "응용 프로그램에 세션 선호도가 필요한지 여부를 결정합니다. 높은 안정성 요구 사항이 있는 경우 세션 선호도를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "425bfb31-94c4-4007-b9ae-46da9fe57cc7",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header",
+ "service": "Front Door",
+ "severity": "보통",
+ "text": "호스트 헤더를 백 엔드로 보냅니다. 백 엔드 서비스는 해당 호스트의 트래픽만 허용하는 규칙을 만들 수 있도록 호스트 이름을 인식해야 합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "81a5398a-2414-450f-9fc3-e048bc65784c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "보통",
- "text": "Azure 태그 지정을 활용하여 리소스를 논리적으로 그룹화 및 추적하고, 배포를 자동화하고, 가장 중요한 것은 발생한 비용에 대한 가시성을 제공할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
- "waf": "작업"
+ "text": "캐싱을 지원하는 엔드포인트에 대해 캐싱을 사용합니다.",
+ "waf": "비용"
},
{
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend healthprobe=tostring(properties.healthProbeSettings) | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe, frontDoorId | join ( cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/Origins' | extend origingroupname = tostring(properties.originGroupName) ) on origingroupname | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != '') by origingroupname, id, tostring(tags), resourceGroup, subscriptionId, frontDoorId | extend compliant = origincount > 1 or (origincount == 1 and enabledhealthprobecount == 0) | project id = frontDoorId, compliant",
+ "guid": "34069d73-e4de-46c5-a36f-625f87575a56",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"severity": "낮다",
- "text": "대기 시간에 민감한 애플리케이션에 대해 VM 간 대기 시간 모니터링을 사용합니다.",
- "waf": "공연"
+ "text": "단일 백 엔드 풀에서 상태 검사를 사용하지 않도록 설정합니다. Azure Front Door 원본 그룹에 원본이 하나만 구성된 경우 이러한 호출이 필요하지 않습니다. 이는 엔드포인트에 여러 원본을 가질 수 없는 경우에만 권장됩니다.",
+ "waf": "비용"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c92d6786-cdd1-444d-9cad-934a192a276a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-reports",
+ "service": "Front Door",
"severity": "보통",
- "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "신뢰도"
+ "text": "보안 보고서를 활용하기 위해 프리미엄 계층을 사용하는 것이 좋지만 표준 Azure Front Door 프로필은 기본 제공 분석/보고서에서 트래픽 보고서만 제공합니다.",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "440cf7de-30a1-4550-ab50-c9f6eac140cd",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-wildcard-domain",
+ "service": "Front Door",
"severity": "보통",
- "text": "모든 데이터베이스 파일 시스템 및 실행 프로그램을 바이러스 백신 검사에서 제외합니다. 이를 포함하면 성능 문제가 발생할 수 있습니다. 제외 목록에 대한 규범적 세부 정보는 데이터베이스 공급업체에 문의하십시오. 예를 들어 Oracle은 바이러스 백신 검사에서 /oracle//sapdata를 제외하는 것이 좋습니다.",
- "waf": "공연"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "severity": "낮다",
- "text": "마이그레이션 후 비 HANA 데이터베이스에 대한 전체 데이터베이스 통계를 수집하는 것이 좋습니다. 예를 들어 SAP Note 1020260 - Oracle 통계 제공을 구현합니다.",
- "waf": "공연"
+ "text": "가능한 경우 와일드카드 TLS 인증서를 사용합니다.",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "556e2733-6ca9-4edd-9cc7-26de66d46c2e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-caching",
+ "service": "Front Door",
"severity": "보통",
- "text": "Azure에서 SAP를 사용하는 모든 Oracle 배포에 Oracle ASM(자동 스토리지 관리)을 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "text": "캐싱을 위해 응용 프로그램 쿼리 문자열을 최적화합니다. 순전히 정적인 콘텐츠의 경우 쿼리 문자열을 무시하여 캐시 사용을 최대화합니다. 응용 프로그램에서 쿼리 문자열을 사용하는 경우 캐시 키에 포함하는 것이 좋습니다. 캐시 키에 쿼리 문자열을 포함하면 Azure Front Door가 구성에 따라 캐시된 응답 또는 기타 응답을 제공할 수 있습니다.",
"waf": "공연"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c0b7e55e-fcab-4e66-bdae-bd0290f6aece",
+ "link": "https://learn.microsoft.com/azure/frontdoor/standard-premium/how-to-compression",
+ "service": "Front Door",
"severity": "보통",
- "text": "Oracle을 실행하는 Azure의 SAP의 경우 SQL 스크립트 컬렉션을 통해 성능 문제를 진단할 수 있습니다. AWR(Automatic Workload Repository) 보고서에는 Oracle 시스템의 문제를 진단하는 데 유용한 정보가 포함되어 있습니다. 여러 세션 동안 AWR 보고서를 실행하고 최대 피크 시간을 선택하여 분석에 대한 광범위한 적용 범위를 보장하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "text": "다운로드 가능한 콘텐츠에 액세스할 때 파일 압축을 사용합니다.",
"waf": "공연"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/frontdoors' and properties['resourceState'] !~ 'migrated' | extend compliant = false | project id, compliant",
+ "guid": "cb8eb8c0-aa73-4a26-a495-6eba8dc4a243",
+ "link": "https://learn.microsoft.com/azure/cdn/tier-migration",
+ "service": "Front Door",
"severity": "높다",
- "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "text": "클래식 Azure Front Door는 2027년 3월까지 더 이상 사용되지 않으므로 현재 클래식 Azure Front Door를 사용하는 경우 표준 또는 프리미엄 SKU로 마이그레이션하는 것이 좋습니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "67c33697-15b1-4752-aeee-0b9b588defc4",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/networking/global-web-applications/mission-critical-content-delivery",
+ "service": "Front Door",
"severity": "보통",
- "text": "HTTP/S 앱을 안전하게 배달하려면 Application Gateway v2를 사용하고 WAF 보호 및 정책이 사용하도록 설정되어 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "text": "중요 업무용 고가용성 시나리오의 경우 Traffic Manager 부하 분산 Azure Front Door 및 타사 CDN 공급자 CDN 프로필을 사용하는 것이 좋습니다. ",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "972cd4cd-25b0-4b70-96e9-eab4bfd32907",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance",
+ "service": "Front Door",
+ "severity": "높다",
+ "text": "원본과 함께 Front Door를 App Services로 사용하는 경우 액세스 제한을 사용하여 Azure Front Door를 통해서만 앱 서비스에 대한 트래픽을 잠그는 것이 좋습니다. ",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure로 마이그레이션하는 동안 가상 머신의 DNS 또는 가상 이름이 변경되지 않은 경우 백그라운드 DNS 및 가상 이름은 SAP 환경의 많은 시스템 인터페이스를 연결하며, 고객은 시간이 지남에 따라 개발자가 정의하는 인터페이스를 가끔씩만 인식할 수 있습니다. 마이그레이션 후 가상 또는 DNS 이름이 변경될 때 다양한 시스템 간에 연결 문제가 발생하며, 이러한 유형의 문제를 방지하기 위해 DNS 별칭을 유지하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "작업"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
"severity": "보통",
- "text": "서로 다른 DNS 영역을 사용하여 각 환경(샌드박스, 개발, 사전 프로덕션 및 프로덕션)을 서로 구분합니다. 예외는 자체 VNet을 사용하는 SAP 배포의 경우입니다. 여기서는 프라이빗 DNS 영역이 필요하지 않을 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "작업"
+ "text": "Application Gateway v2 SKU를 사용하고 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "description": "VNet 피어링을 구성할 때 원격 가상 네트워크에 대한 트래픽 허용 설정을 사용합니다.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
"severity": "보통",
- "text": "로컬 및 글로벌 VNet 피어링은 연결을 제공하며, 여러 Azure 지역에서 SAP 배포를 위한 랜딩 존 간의 연결을 보장하기 위해 선호되는 접근 방식입니다",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "신뢰도"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP 애플리케이션과 SAP 데이터베이스 서버 간에 NVA를 배포하는 것은 지원되지 않습니다",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "공연"
+ "text": "Azure Load Balancer에 표준 SKU를 사용하고 있는지 확인합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
"severity": "보통",
- "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 새로운, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "작업"
+ "text": "Load Balancer 프런트 엔드 IP 주소가 영역 중복인지 확인합니다(영역 프런트 엔드가 필요하지 않은 경우).",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
"severity": "보통",
- "text": "파트너 NVA를 사용하는 경우에만 지역 간에 NVA(네트워크 가상 어플라이언스)를 배포하는 것이 좋습니다. 네이티브 NVA가 있는 경우 지역 또는 VNet 간의 NVA가 필요하지 않습니다. 파트너 네트워킹 기술 및 NVA를 배포하는 경우 공급업체의 지침에 따라 Azure 네트워킹과 충돌하는 구성을 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "작업"
+ "text": "Application Gateways v2는 IP 접두사가 /24보다 크거나 같은 서브넷에 배포해야 합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "일반적으로 역방향 프록시 및 특히 WAF의 관리는 네트워킹보다 애플리케이션에 더 가깝기 때문에 앱과 동일한 구독에 속합니다. 연결 구독에서 Application Gateway 및 WAF를 중앙 집중화하는 것은 단일 팀에서 관리하는 경우 괜찮을 수 있습니다.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Virtual WAN은 가상 WAN 기반 토폴로지에 대한 스포크 VNet 간의 연결을 관리하며(UDR[사용자 정의 라우팅] 또는 NVA를 설정할 필요 없음) 동일한 가상 허브의 VNet 간 트래픽에 대한 최대 네트워크 처리량은 초당 50기가비트입니다. 필요한 경우 SAP 랜딩 존은 VNet 피어링을 사용하여 다른 랜딩 존에 연결하고 이 대역폭 제한을 극복할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "작업"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP Workload를 실행하는 VM에 공용 IP를 할당하는 것은 권장되지 않습니다.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "text": "랜딩 존 가상 네트워크 내에서 그리고 보안 중인 앱을 사용하여 인바운드 HTTP(S) 연결을 프록시하는 데 사용되는 Azure Application Gateway v2 또는 파트너 NVA를 배포합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
- "severity": "높다",
- "text": "ASR을 구성할 때 DR 쪽에서 IP 주소를 예약하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "작업"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
- "severity": "높다",
- "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "작업"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
+ "severity": "보통",
+ "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Azure는 VNet에서 여러 위임된 서브넷을 만드는 데 도움이 되지만 Azure NetApp Files용 VNet에는 하나의 위임된 서브넷만 존재할 수 있습니다. Azure NetApp Files에 대해 둘 이상의 위임된 서브넷을 사용하는 경우 새 볼륨을 만들려는 시도가 실패합니다.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "작업"
+ "text": "최소 2개의 인스턴스로 자동 크기 조정을 구성합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다.",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "text": "가용성 영역에 Application Gateway 배포",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"severity": "보통",
- "text": "Application Gateway, SAP Web Dispatcher 및 기타 타사 서비스 간의 비교에서 볼 수 있듯이 Application Gateway 및 Web Application Firewall SAP 웹앱에 대한 역방향 프록시 역할을 하는 경우 Application Gateway 및 Web Application Firewall에 대한 제한 사항이 있습니다.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
"link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역 전체에서 글로벌 보호를 제공합니다.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "안전"
+ "service": "Traffic Manager",
+ "severity": "높다",
+ "text": "Traffic Manager를 사용하여 HTTP/S 이외의 프로토콜에 걸쳐 있는 글로벌 앱을 제공합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure Front Door 및 Application Gateway를 사용하여 HTTP/S 애플리케이션을 보호하는 경우 Azure Front Door의 Web Application Firewall 정책을 활용합니다. Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "낮다",
+ "text": "사용자가 내부 애플리케이션에만 액세스해야 하는 경우 Microsoft Entra ID 애플리케이션 프록시를 AVD(Azure Virtual Desktop)의 대안으로 고려했나요?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "보통",
- "text": "웹 응용 프로그램 방화벽을 사용하여 인터넷에 노출될 때 트래픽을 검사합니다. 또 다른 옵션은 부하 분산 장치 또는 Application Gateway 또는 타사 솔루션과 같은 기본 제공 방화벽 기능이 있는 리소스와 함께 사용하는 것입니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "text": "네트워크에서 들어오는 연결에 대해 열려 있는 방화벽 포트 수를 줄이려면 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션에 대한 안전하고 인증된 액세스 권한을 부여하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 새로운, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "공연"
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
+ "severity": "높다",
+ "text": "SNAT 확장성 향상을 위해 Load Balancer 아웃바운드 규칙 대신 Azure NAT Gateway 사용",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
- "severity": "보통",
- "text": "데이터 유출을 방지하려면 Azure Private Link를 사용하여 Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory 등과 같은 PaaS(Platform as a Service) 리소스에 안전하게 액세스합니다. Azure 프라이빗 엔드포인트는 VNet과 Azure Storage, Azure Backup 등과 같은 서비스 간의 트래픽을 보호하는 데도 도움이 될 수 있습니다. VNet과 프라이빗 엔드포인트 사용 서비스 간의 트래픽은 Microsoft 글로벌 네트워크를 통해 이동하므로 공용 인터넷에 노출되지 않습니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
+ "severity": "높다",
+ "text": "Azure Application Gateway WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
"severity": "높다",
- "text": "SAP 애플리케이션 및 DBMS 계층에 사용되는 VM에서 Azure 가속 네트워킹이 사용하도록 설정되어 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "공연"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure Load Balancer에 대한 내부 배포가 DSR(Direct Server Return)을 사용하도록 설정되어 있는지 확인합니다. 이 설정(유동 IP 사용)은 DBMS 계층의 고가용성 구성에 내부 로드 밸런서 구성을 사용할 때 대기 시간을 줄입니다.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "text": "Azure Application Gateway WAF 정책에서 요청 본문 검사 기능이 사용하도록 설정되어 있는지 확인합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
- "severity": "보통",
- "text": "ASG(애플리케이션 보안 그룹) 및 NSG 규칙을 사용하여 SAP 애플리케이션과 DBMS 계층 간의 네트워크 보안 액세스 제어 목록을 정의할 수 있습니다. ASG는 가상 머신을 그룹화하여 보안을 관리하는 데 도움을 줍니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
+ "severity": "높다",
+ "text": "워크로드에 대한 검색 모드에서 Azure Application Gateway WAF를 튜닝합니다. 거짓 긍정 탐지를 줄입니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
"severity": "높다",
- "text": "피어링되지 않은 다른 Azure VNet에 SAP 애플리케이션 계층 및 SAP DBMS를 배치하는 것은 지원되지 않습니다.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "공연"
+ "text": "'방지' 모드에서 Application Gateway에 대한 WAF 정책을 배포합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP 애플리케이션에서 네트워크 대기 시간을 최적화하려면 Azure 근접 배치 그룹을 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "공연"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "높다",
- "text": "온-프레미스와 Azure 간에 분할된 SAP 애플리케이션 서버 계층 및 DBMS 계층을 실행하는 것은 전혀 지원되지 않습니다. 두 계층 모두 온-프레미스 또는 Azure에 완전히 상주해야 합니다.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "공연"
+ "text": "Azure Application Gateway WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 단기간에 많은 양의 트래픽을 보내는 것을 차단합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "높다",
- "text": "계층 간의 과도한 네트워크 트래픽으로 인해 발생할 수 있는 상당한 비용 때문에 DBMS(데이터베이스 관리 시스템) 및 SAP 시스템의 애플리케이션 계층을 서로 다른 VNet에 호스트하고 VNet 피어링과 연결하는 것은 권장되지 않습니다. Azure 가상 네트워크 내의 서브넷을 사용하여 SAP 애플리케이션 계층과 DBMS 계층을 분리하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "비용"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
+ "severity": "보통",
+ "text": "Azure Application Gateway WAF 속도 제한에 대해 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호를 제공합니다. ",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
- "severity": "높다",
- "text": "Linux 게스트 운영 체제에서 Load Balancer를 사용하는 경우 Linux 네트워크 매개 변수 net.ipv4.tcp_timestamps가 0으로 설정되어 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "공연"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
+ "severity": "낮다",
+ "text": "모든 지역에서 트래픽이 발생할 것으로 예상되지 않는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP RISE/ECS 배포의 경우 가상 피어링은 고객의 기존 Azure 환경과의 연결을 설정하는 기본 방법입니다. SAP vnet과 고객 vnet은 모두 NSG(네트워크 보안 그룹)로 보호되므로 vnet 피어링을 통해 SAP 및 데이터베이스 포트에서 통신할 수 있습니다",
+ "text": "Azure Application Gateway WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 마세요.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "높다",
- "text": "Azure VM에 대한 SAP HANA 데이터베이스 백업을 검토합니다.",
- "waf": "비용"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
+ "severity": "보통",
+ "text": "최신 Azure Application Gateway WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP에 사용되는 Site Recovery 기본 제공 모니터링을 검토합니다.",
- "waf": "비용"
+ "text": "진단 설정을 추가하여 Azure Application Gateway WAF 로그를 저장합니다.",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP HANA 시스템 환경 모니터링 지침을 검토합니다.",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
+ "severity": "보통",
+ "text": "Azure Application Gateway WAF 로그를 Microsoft Sentinel로 보냅니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Azure Linux VM 백업 전략에서 Oracle Database를 검토합니다.",
+ "text": "Azure Application Gateway WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SQL Server 2016에서 Azure Blob Storage 사용을 검토합니다.",
+ "text": "레거시 WAF 구성 대신 WAF 정책을 사용합니다.",
"waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Azure VM에 대한 자동화된 Backup v2 사용을 검토합니다.",
- "waf": "작업"
+ "text": "Application Gateway 서브넷의 연결(예: NSG)만 허용하도록 백 엔드에서 인바운드 트래픽을 필터링합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
"severity": "높다",
- "text": "프리미엄 디스크(V1)를 사용하는 경우 M 시리즈에 쓰기 가속기 사용",
- "waf": "작업"
+ "text": "백엔드 서버에 대한 트래픽을 암호화해야 합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
- "severity": "보통",
- "text": "가용성 영역 대기 시간을 테스트합니다.",
- "waf": "공연"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
+ "severity": "높다",
+ "text": "웹 응용 프로그램 방화벽을 사용해야 합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "모든 SAP 구성요소에 대해 SAP EarlyWatch Alert를 활성화합니다.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "공연"
+ "text": "HTTP를 HTTPS로 리디렉션",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP ABAPMeter 보고서 /SSA/CAT를 사용하여 SAP 애플리케이션 서버-데이터베이스 서버 대기 시간을 검토합니다.",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "공연"
+ "text": "게이트웨이 관리 쿠키를 사용하여 처리를 위해 사용자 세션에서 동일한 서버로 트래픽을 전달합니다.",
+ "waf": "작업"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
- "severity": "보통",
- "text": "CCMS를 사용하여 SQL Server 성능 모니터링을 검토합니다.",
- "waf": "공연"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
+ "severity": "높다",
+ "text": "계획된 서비스 업데이트 중에 연결 드레이닝을 사용하도록 설정하여 백 엔드 풀의 기존 멤버에 대한 연결 손실을 방지합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
+ "severity": "낮다",
+ "text": "사용자 지정 오류 페이지를 만들어 개인화된 사용자 경험을 표시합니다.",
+ "waf": "작업"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP 애플리케이션 계층 VM과 DBMS VM(NIPING) 간의 네트워크 대기 시간을 테스트합니다.",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "공연"
+ "text": "클라이언트와 서버 간의 라우팅 및 정보 교환을 보다 쉽게 하기 위해 HTTP 요청 및 응답 헤더를 편집합니다.",
+ "waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP HANA Studio 알림을 검토합니다.",
+ "text": "Front Door를 구성하여 글로벌 웹 트래픽 라우팅, 최상위 최종 사용자 성능 및 빠른 글로벌 장애 조치(failover)를 통해 안정성을 최적화합니다.",
"waf": "공연"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "HANA_Configuration_Minichecks를 사용하여 SAP HANA 상태 점검을 수행합니다.",
+ "text": "전송 계층 부하 분산 사용",
"waf": "공연"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"severity": "보통",
- "text": "Azure, 온-프레미스 또는 기타 클라우드 환경에서 Windows 및 Linux VM을 실행하는 경우 Azure Automation의 업데이트 관리 센터를 사용하여 보안 패치를 포함한 운영 체제 업데이트를 관리할 수 있습니다.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "text": "단일 게이트웨이에서 여러 웹 응용 프로그램에 대한 호스트 또는 도메인 이름을 기반으로 라우팅을 구성합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"severity": "보통",
- "text": "SAP는 SAP 시스템을 보호하기 위해 즉각적인 조치가 필요한 매우 중요한 보안 패치 또는 핫픽스를 릴리스하므로 SAP 보안 OSS 노트를 정기적으로 검토합니다.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "text": "SSL 인증서 관리를 중앙 집중화하여 백엔드 서버 팜의 암호화 및 암호 해독 오버헤드를 줄입니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"severity": "낮다",
- "text": "SQL Server SAP의 경우 SQL Server 시스템 관리자 계정을 사용하지 않으므로 SQL Server 시스템 관리자 계정을 사용하지 않도록 설정할 수 있습니다. 원래 시스템 관리자 계정을 비활성화하기 전에 시스템 관리자 권한이 있는 다른 사용자가 서버에 액세스할 수 있는지 확인합니다.",
+ "text": "WebSocket 및 HTTP/2 프로토콜에 대한 기본 지원을 위해 Application Gateway 사용",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
"severity": "높다",
- "text": "xp_cmdshell 비활성화합니다. SQL Server 기능 xp_cmdshell SQL Server 내부 운영 체제 명령 셸을 사용하도록 설정합니다. 이는 보안 감사에서 잠재적인 위험입니다.",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "안전"
+ "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(자동으로 활성화됨)",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "높다",
- "text": "Azure에서 SAP HANA 데이터베이스 서버를 암호화하려면 SAP HANA 네이티브 암호화 기술을 사용합니다. 또한 Azure에서 SQL Server를 사용하는 경우 TDE(투명한 데이터 암호화)를 사용하여 데이터 및 로그 파일을 보호하고 백업도 암호화되도록 합니다.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "severity": "보통",
+ "text": "Microsoft에서 시작한 장애 조치(failover)에 유의하세요. 드문 경우지만 Microsoft는 영향을 받는 지역의 모든 IoT Hub를 해당 지역 쌍을 이루는 지역으로 장애 조치(failover)하기 위해 이러한 작업을 수행합니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
- "severity": "보통",
- "text": "Azure Storage 암호화는 모든 Azure Resource Manager 및 클래식 스토리지 계정에 대해 사용하도록 설정되며 사용하지 않도록 설정할 수 없습니다. 데이터는 기본적으로 암호화되므로 Azure Storage 암호화를 사용하기 위해 코드나 애플리케이션을 수정할 필요가 없습니다.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
+ "severity": "높다",
+ "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "높다",
- "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "안전"
+ "text": "수동 장애 조치(failover)를 트리거하는 방법을 알아봅니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
- "severity": "보통",
- "text": "무단 변경으로부터 보호하기 위해 성공적인 배포 후 Azure 리소스를 잠그는 것이 좋습니다. 또한 사용자 지정된 Azure 정책(Custome 역할)을 사용하여 구독별로 LOCK 제약 조건 및 규칙을 적용할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
+ "severity": "높다",
+ "text": "장애 조치(failover) 후 장애 복구(failback)하는 방법을 알아봅니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "'스토리지에 대한 Azure 보안 기준' 고려",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "기존 요구 사항에 따라 규정 및 규정 준수 제어(내부/외부) - 필요한 Azure 정책 및 Azure RBAC 역할 결정",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "높다",
- "text": "SAP 환경에서 엔드포인트용 Microsoft Defender 사용하도록 설정하는 경우 모든 서버를 대상으로 하는 대신 DBMS 서버에서 데이터 및 로그 파일을 제외하는 것이 좋습니다. 대상 파일을 제외할 때 DBMS 공급업체의 권장 사항을 따릅니다.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "새로 만든 저장소 계정은 ARM 배포 모델을 사용하여 만들어지므로 RBAC, 감사 등을 모두 사용할 수 있습니다. 구독에 클래식 배포 모델이 있는 이전 저장소 계정이 없는지 확인합니다.",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아봅니다.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "클라우드용 Microsoft Defender의 Just-In-Time 액세스 권한이 있는 SAP 관리자 사용자 지정 역할을 위임합니다.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "낮다",
- "text": "타사 보안 제품을 DIAG(SAP GUI)용 SNC(Secure Network Communications), RFC 및 HTTPS용 SPNEGO와 통합하여 전송 중인 데이터를 암호화합니다.",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "보안 주체 암호화 기능을 위해 기본적으로 Microsoft 관리형 키를 사용하고 필요한 경우 고객 관리형 키를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Blob에 대해 '일시 삭제' 사용 안 함",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "높다",
- "text": "애플리케이션당 환경, 지역별 Azure Key Vault를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 컨테이너를 복구할 수 있습니다(예: 실수로 인한 삭제 작업에서 복구).",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "severity": "높다",
- "text": "비 HANA Windows 및 비 Windows 운영 체제에 대한 디스크 암호화 키 및 비밀을 제어하고 관리하려면 Azure Key Vault를 사용합니다. SAP HANA는 Azure Key Vault에서 지원되지 않으므로 SAP ABAP 또는 SSH 키와 같은 대체 방법을 사용해야 합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 저장소 계정이 실수로 삭제되는 것을 방지합니다.",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "Azure 스포크 구독의 SAP에 대한 RBAC(역할 기반 액세스 제어) 역할을 사용자 지정하여 실수로 인한 네트워크 관련 변경을 방지합니다.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능'은 실제로 '불가능'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함된 경우 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "SAP 자산의 나머지 부분에서 DMZ 및 NVA를 격리하고, Azure Private Link를 구성하고, Azure의 SAP 리소스를 안전하게 관리 및 제어합니다.",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "text": "변경할 수 없는 Blob 고려",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "낮다",
- "text": "Azure에서 Microsoft 맬웨어 방지 소프트웨어를 사용하여 악성 파일, 애드웨어 및 기타 위협으로부터 가상 머신을 보호하는 것이 좋습니다.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "모든 데이터 전송이 암호화되고, 무결성이 보호되고, 서버가 인증되도록 스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "낮다",
- "text": "더욱 강력한 보호를 위해 엔드포인트용 Microsoft Defender 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 여부를 확인합니다. 이 경우 저장소 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "HTTPS를 적용할 때(HTTP 사용 안 함) 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
- "severity": "높다",
- "text": "가상 네트워크 피어링을 통해 스포크 네트워크에 연결된 허브 가상 네트워크를 통해 모든 트래픽을 전달하여 인터넷 또는 온-프레미스 네트워크에서 SAP 애플리케이션 및 데이터베이스 서버를 격리합니다. 피어링된 가상 네트워크는 Azure의 SAP 솔루션이 공용 인터넷에서 격리되도록 보장합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "낮다",
- "text": "SAP Fiori와 같은 인터넷 연결 애플리케이션의 경우 보안 수준을 유지하면서 애플리케이션 요구 사항에 따라 부하를 분산해야 합니다. 계층 7 보안의 경우 Azure Marketplace에서 사용할 수 있는 타사 WAF(Web Application Firewall)를 사용할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "AAD 토큰은 가능한 경우 공유 액세스 서명보다 우선해야 합니다",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Blob 액세스에 Azure AD(Azure Active Directory) 토큰 사용Use Azure Active Directory (Azure AD) tokens for blob access",
"waf": "안전"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "SAP용 Azure Monitor 솔루션에서 보안 통신을 사용하도록 설정하려면 루트 인증서 또는 서버 인증서를 사용하도록 선택할 수 있습니다. 루트 인증서를 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "IaM 권한의 최소 권한",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus 프리미엄은 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키도 고객 관리형 키를 사용하여 암호화됩니다. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
- "severity": "낮다",
- "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션을 사용합니다",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "클라이언트 애플리케이션과 Azure Service Bus 네임스페이스 간의 통신은 TLS(전송 계층 보안)를 사용하여 암호화됩니다. Azure Service Bus 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 보다 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Service Bus 네임스페이스를 구성할 수 있습니다.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
- "severity": "보통",
- "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 사본을 가져왔는지 모니터링할 수 있지만, 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시키는 것은 불가능합니다. AAD 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "AAD 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Service Bus 네임스페이스를 만들면 네임스페이스에 대해 RootManageSharedAccessKey라는 SAS 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙은 관리 루트 계정처럼 취급하고 애플리케이션에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
- "severity": "보통",
- "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 보거나 변경하는 '시기', '누가', '무엇을' 및 '방법'(예: 스토리지 계정 키, 액세스 정책 등)을 식별합니다.",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure 리소스 지원을 위해 관리되는 엔터티가 사용하도록 설정된 가상 머신 또는 Azure App Service 애플리케이션 내에서 실행되는 Service Bus 클라이언트 앱은 SAS 규칙 및 키 또는 기타 액세스 토큰을 처리할 필요가 없습니다. 클라이언트 앱에는 Service Bus 메시징 네임스페이스의 엔드포인트 주소만 필요합니다. ",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "키 만료 정책을 사용하면 계정 액세스 키 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Service Bus에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "사용 권한을 만들 때 Azure Service Bus에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Service Bus의 사용 권한은 개별 리소스 수준(예: 큐, 토픽 또는 구독)으로 범위를 지정할 수 있으며 지정해야 합니다. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
- "severity": "높다",
- "text": "최소 권한 데이터 플레인 RBAC 사용",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효 간격을 사용하여 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS 만료 정책 구성 고려",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus 리소스 로그에는 작업 로그, 가상 네트워크 및 IP 필터링 로그가 포함됩니다. 런타임 감사 로그는 Service Bus에서 다양한 데이터 평면 액세스 작업(예: 메시지 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 권한을 취소하는 옵션을 제공합니다. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그 및 런타임 감사 로그 추적(현재 프리미엄 계층에서만 사용 가능)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure Service Bus는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Service Bus 간의 트래픽이 Microsoft 백본 네트워크를 통과할 수 있습니다. 또한 공용 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "프라이빗 엔드포인트를 사용하여 Azure Service Bus에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 집합 또는 IPv4 주소 범위로만 추가로 제한할 수 있습니다. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
- "severity": "보통",
- "text": "특정 IP 주소 또는 범위에서만 Azure Service Bus 네임스페이스에 액세스할 수 있도록 허용하는 것이 좋습니다",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 이렇게 할 수 없는 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS Windows 워크로드에 필요한 경우 HostProcess 컨테이너를 사용할 수 있습니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
- "severity": "낮다",
- "text": "이벤트 기반 워크로드를 실행하는 경우 KEDA 사용Use KEDA if running event-driven workloads",
- "waf": "공연"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 단기 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 업로드에 사용할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "낮다",
- "text": "Dapr을 사용하여 마이크로 서비스 개발 용이",
- "waf": "작업"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS에 좁은 범위 적용",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
- "severity": "높다",
- "text": "SLA 지원 AKS 제품 사용",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "가능한 경우 SAS의 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 고려할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"severity": "낮다",
- "text": "Pod 및 배포 정의에서 중단 예산 사용Use Disruption Budgets in your pod and deployment definitions",
- "waf": "신뢰도"
+ "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "개인 레지스트리를 사용하는 경우 여러 지역에 이미지를 저장하도록 지역 복제를 구성합니다",
- "waf": "신뢰도"
+ "text": "SFTP: SFTP 액세스에 대한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "낮다",
- "text": "kubecost와 같은 외부 애플리케이션을 사용하여 다른 사용자에게 비용 할당",
- "waf": "비용"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
- "severity": "낮다",
- "text": "축소 모드를 사용하여 노드 삭제/할당 취소",
- "waf": "비용"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정할 때 CorsRules를 최소 권한으로 유지합니다.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "지나치게 광범위한 CORS 정책 방지",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
- "severity": "보통",
- "text": "필요한 경우 AKS 클러스터에서 다중 인스턴스 분할 GPU 사용",
- "waf": "비용"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀성 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
- "severity": "낮다",
- "text": "개발/테스트 클러스터를 실행하는 경우 NodePool 시작/중지를 사용합니다.",
- "waf": "비용"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "사용해야 하는 플랫폼 암호화를 결정합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "Kubernetes용 Azure Policy를 사용하여 클러스터 규정 준수 보장",
+ "text": "사용해야 하는 클라이언트 쪽 암호화를 결정합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
- "severity": "보통",
- "text": "사용자/시스템 노드 풀이 있는 컨트롤 플레인에서 응용 프로그램 분리",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Resource Graph Explorer(resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "공용 Blob 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus 프리미엄은 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키도 고객 관리형 키를 사용하여 암호화됩니다. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
"severity": "낮다",
- "text": "시스템 nodepool에 taint를 추가하여 전용으로 만듭니다.",
+ "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션을 사용합니다",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "클라이언트 애플리케이션과 Azure Service Bus 네임스페이스 간의 통신은 TLS(전송 계층 보안)를 사용하여 암호화됩니다. Azure Service Bus 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 보다 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Service Bus 네임스페이스를 구성할 수 있습니다.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"severity": "보통",
- "text": "이미지에 개인 레지스트리(예: ACR) 사용",
+ "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Service Bus 네임스페이스를 만들면 네임스페이스에 대해 RootManageSharedAccessKey라는 SAS 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙은 관리 루트 계정처럼 취급하고 애플리케이션에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"severity": "보통",
- "text": "이미지에서 취약성 검사",
+ "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
- "severity": "높다",
- "text": "앱 분리 요구 사항 정의(네임스페이스/노드 풀/클러스터)",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure 리소스 지원을 위해 관리되는 엔터티가 사용하도록 설정된 가상 머신 또는 Azure App Service 애플리케이션 내에서 실행되는 Service Bus 클라이언트 앱은 SAS 규칙 및 키 또는 기타 액세스 토큰을 처리할 필요가 없습니다. 클라이언트 앱에는 Service Bus 메시징 네임스페이스의 엔드포인트 주소만 필요합니다. ",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
+ "severity": "보통",
+ "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Service Bus에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
- "severity": "보통",
- "text": "CSI 비밀 저장소 드라이버를 사용하여 Azure Key Vault에 비밀 저장",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "사용 권한을 만들 때 Azure Service Bus에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Service Bus의 사용 권한은 개별 리소스 수준(예: 큐, 토픽 또는 구독)으로 범위를 지정할 수 있으며 지정해야 합니다. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "severity": "높다",
+ "text": "최소 권한 데이터 플레인 RBAC 사용",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
- "severity": "높다",
- "text": "클러스터에 서비스 주체를 사용하는 경우 주기적으로(예: 분기별) 자격 증명을 새로 고칩니다",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus 리소스 로그에는 작업 로그, 가상 네트워크 및 IP 필터링 로그가 포함됩니다. 런타임 감사 로그는 Service Bus에서 다양한 데이터 평면 액세스 작업(예: 메시지 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
+ "severity": "보통",
+ "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그 및 런타임 감사 로그 추적(현재 프리미엄 계층에서만 사용 가능)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure Service Bus는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Service Bus 간의 트래픽이 Microsoft 백본 네트워크를 통과할 수 있습니다. 또한 공용 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"severity": "보통",
- "text": "필요한 경우 키 관리 서비스 etcd 암호화를 추가합니다.",
+ "text": "프라이빗 엔드포인트를 사용하여 Azure Service Bus에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
- "severity": "낮다",
- "text": "필요한 경우 AKS용 기밀 컴퓨팅을 사용하는 것이 좋습니다.",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 집합 또는 IPv4 주소 범위로만 추가로 제한할 수 있습니다. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
+ "severity": "보통",
+ "text": "특정 IP 주소 또는 범위에서만 Azure Service Bus 네임스페이스에 액세스할 수 있도록 허용하는 것이 좋습니다",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
- "severity": "보통",
- "text": "컨테이너용 Defender 사용 고려",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "severity": "높다",
+ "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
"severity": "높다",
- "text": "서비스 주체 대신 관리 ID 사용",
- "waf": "안전"
+ "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
- "severity": "보통",
- "text": "AAD와 인증 통합(관리형 통합 사용)",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
+ "severity": "높다",
+ "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
- "severity": "보통",
- "text": "관리자 kubeconfig에 대한 액세스 제한(get-credentials --admin)",
- "waf": "안전"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
+ "severity": "높다",
+ "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
"severity": "보통",
- "text": "AAD RBAC와 권한 부여 통합",
- "waf": "안전"
+ "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "높다",
- "text": "쿠버네티스에서 RBAC 권한을 제한하기 위해 네임스페이스 사용",
- "waf": "안전"
+ "text": "읽기 작업에 대해 99.9%의 가용성을 갖도록 복제본 2개 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "보통",
- "text": "Pod ID 액세스 관리의 경우 Azure AD 워크로드 ID(미리 보기)를 사용합니다.",
- "waf": "안전"
+ "text": "읽기/쓰기 작업에 대해 99.9%의 가용성을 갖도록 복제본 3개 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
- "severity": "보통",
- "text": "AKS 비대화형 로그인의 경우 kubelogin(미리 보기)을 사용합니다.",
- "waf": "안전"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "severity": "높다",
+ "text": "읽기 및/또는 쓰기 복제본을 활성화하여 가용 영역 활용Leverage Availability Zones by enabling read and/or write replicas",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "보통",
- "text": "AKS 로컬 계정 사용 안 함",
- "waf": "안전"
+ "text": "지역 중복의 경우 Manually create services in 2 or more regions for Search는 지리적 지역 간에 검색 인덱스를 복제하는 자동화된 방법을 제공하지 않습니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "낮다",
- "text": "필요한 경우 Just-in-time 클러스터 액세스 구성",
- "waf": "안전"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
+ "severity": "보통",
+ "text": "여러 서비스에서 데이터를 동기화하려면 인덱서를 사용하여 여러 서비스의 콘텐츠를 업데이트하거나 REST API를 사용하여 여러 서비스에서 콘텐츠 업데이트를 푸시합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS에 필요한 경우 AAD 조건부 액세스 구성",
- "waf": "안전"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
+ "severity": "보통",
+ "text": "Azure Traffic Manager를 사용하여 요청 조정",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
- "severity": "낮다",
- "text": "Windows AKS 워크로드에 필요한 경우 gMSA를 구성합니다. ",
- "waf": "안전"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
+ "severity": "높다",
+ "text": "Azure Cognitive Search 인덱스를 백업 및 복원합니다. 이 샘플 코드를 사용하여 인덱스 정의 및 스냅샷을 일련의 Json 파일에 백업합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"severity": "보통",
- "text": "더 세밀하게 제어하려면 관리형 Kubelet ID를 사용하는 것이 좋습니다.",
- "waf": "안전"
+ "text": "Azure Bot Service의 안정성 지원 권장 사항을 따릅니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
"severity": "보통",
- "text": "AGIC를 사용하는 경우 클러스터 간에 AppGW를 공유하지 마세요",
+ "text": "로컬 데이터 레지던시 및 지역 규정 준수를 통해 봇 배포Deploying bots with local data residency and regional compliance",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
- "severity": "높다",
- "text": "AKS HTTP 라우팅 추가 기능을 사용하지 말고, 애플리케이션 라우팅 추가 기능과 함께 관리되는 NGINX 수신을 대신 사용합니다.",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
+ "severity": "보통",
+ "text": "Azure Bot Service는 글로벌 및 지역 서비스 모두에 대해 활성-활성 모드로 실행됩니다. 중단이 발생하면 오류를 감지하거나 서비스를 관리할 필요가 없습니다. Azure Bot Service는 다중 지역 지리적 아키텍처에서 자동 장애 조치(failover) 및 자동 복구를 자동으로 수행합니다. EU 봇 지역 서비스의 경우 Azure Bot Service는 중복성을 보장하기 위해 활성/활성 복제가 있는 유럽 내 두 개의 전체 지역을 제공합니다. 글로벌 봇 서비스의 경우 사용 가능한 모든 지역/지역을 글로벌 공간으로 제공할 수 있습니다.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Windows 워크로드의 경우 가속화된 네트워킹을 사용합니다.",
- "waf": "공연"
+ "text": "ACSS(Azure Center for SAP solutions)는 SAP를 Azure의 최상위 워크로드로 만드는 Azure 제품입니다. ACSS는 Azure에서 SAP 시스템을 통합 워크로드로 만들고 실행할 수 있도록 하는 엔드투엔드 솔루션으로, 혁신을 위한 보다 원활한 기반을 제공합니다. 새 Azure 기반 SAP 시스템과 기존 Azure 기반 SAP 시스템 모두에 대한 관리 기능을 활용할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
- "severity": "높다",
- "text": "표준 ALB 사용(기본 ALB와 반대)",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure는 Linux 및 Windows에서 SAP 배포 자동화를 지원합니다. SAP Deployment Automation Framework는 SAP 환경을 배포, 설치 및 유지 관리할 수 있는 오픈 소스 오케스트레이션 툴입니다.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure CNI를 사용하는 경우 NodePools에 다른 서브넷을 사용하는 것이 좋습니다.",
- "waf": "안전"
+ "text": "RTO를 충족하는 언제든지 특정 시점과 시간 프레임에서 프로덕션 데이터베이스에 대한 특정 시점 복구를 수행합니다. 특정 시점 복구에는 일반적으로 DBMS 계층 또는 SAP를 통해 데이터를 삭제하는 운영자 오류가 포함됩니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"severity": "보통",
- "text": "프라이빗 엔드포인트(기본 설정) 또는 Virtual Network 서비스 엔드포인트를 사용하여 클러스터에서 PaaS 서비스에 액세스",
- "waf": "안전"
+ "text": "백업 및 복구 시간을 테스트하여 재해 발생 후 모든 시스템을 동시에 복원하기 위한 RTO 요구 사항을 충족하는지 확인합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"severity": "높다",
- "text": "요구 사항에 가장 적합한 CNI 네트워크 플러그 인 선택(Azure CNI 권장)",
+ "text": "쌍을 이루는 지역 간에 표준 스토리지를 복제할 수 있지만 표준 스토리지를 사용하여 데이터베이스 또는 가상 하드 디스크를 저장할 수는 없습니다. 사용하는 쌍을 이루는 지역 간에만 백업을 복제할 수 있습니다. 다른 모든 데이터의 경우 SQL Server Always On 또는 SAP HANA 시스템 복제와 같은 기본 DBMS 기능을 사용하여 복제를 실행합니다. SAP 애플리케이션 계층에 Site Recovery, rsync 또는 robocopy 및 기타 타사 소프트웨어를 조합하여 사용합니다.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "높다",
- "text": "Azure CNI를 사용하는 경우 노드당 최대 Pod 수를 고려하여 서브넷 크기를 적절하게 조정합니다",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "고가용성을 달성하기 위해 Azure 가용성 영역을 사용하는 경우 SAP 애플리케이션 서버와 데이터베이스 서버 간의 대기 시간을 고려해야 합니다. 대기 시간이 긴 영역의 경우 SAP 애플리케이션 서버와 데이터베이스 서버가 항상 동일한 영역에서 실행되도록 운영 절차를 마련해야 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"severity": "높다",
- "text": "Azure CNI를 사용하는 경우 최대 Pod/노드(기본값 30)를 확인합니다.",
- "waf": "공연"
+ "text": "온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로의 ExpressRoute 연결을 설정합니다. 또한 ExpressRoute를 사용하는 대신 온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로 VPN 연결을 설정하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "내부 앱의 경우 조직은 방화벽에서 전체 AKS 서브넷을 여는 경우가 많습니다. 이렇게 하면 노드에 대한 네트워크 액세스도 열리고 잠재적으로 Pod에 대한 액세스도 열립니다(Azure CNI를 사용하는 경우). LoadBalancer IP가 다른 서브넷에 있는 경우 앱 클라이언트에서 이 IP만 사용할 수 있어야 합니다. 또 다른 이유는 AKS 서브넷의 IP 주소가 부족한 리소스인 경우 서비스에 해당 IP 주소를 사용하면 클러스터의 최대 확장성이 감소하기 때문입니다.",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"severity": "낮다",
- "text": "개인 IP LoadBalancer 서비스를 사용하는 경우 AKS 서브넷이 아닌 전용 서브넷을 사용합니다",
- "waf": "안전"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "높다",
- "text": "그에 따라 서비스 IP 주소 범위의 크기를 조정합니다(클러스터 확장성이 제한됨).",
+ "text": "DR 지역에서 데이터의 암호를 해독할 수 있도록 인증서, 비밀 또는 키와 같은 키 자격 증명 모음 콘텐츠를 지역 간에 복제합니다.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "낮다",
- "text": "필요한 경우 자체 CNI 플러그인을 추가합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "기본 및 재해 복구 가상 네트워크를 피어링합니다. 예를 들어 HANA 시스템 복제의 경우 SAP HANA DB 가상 네트워크를 재해 복구 사이트의 SAP HANA DB 가상 네트워크에 피어링해야 합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
"severity": "낮다",
- "text": "필요한 경우 AKS에서 노드당 공용 IP 구성",
- "waf": "공연"
+ "text": "SAP 배포에 Azure NetApp Files 스토리지를 사용하는 경우 최소한 두 지역의 프리미엄 계층에 두 개의 Azure NetApp Files 계정을 만듭니다.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
- "severity": "보통",
- "text": "수신 컨트롤러를 사용하여 LoadBalancer 유형 서비스를 사용하여 노출하는 대신 웹 기반 앱을 노출합니다",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "기본 데이터베이스 복제 기술을 사용하여 HA 쌍의 데이터베이스를 동기화해야 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
- "severity": "낮다",
- "text": "송신 트래픽 크기 조정을 위해 Azure NAT Gateway를 outboundType으로 사용",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "기본 VNet(가상 네트워크)의 CIDR은 DR 사이트 VNet의 CIDR과 충돌하거나 겹치지 않아야 합니다",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
- "severity": "보통",
- "text": "Azure CNI IP 소모를 방지하기 위해 IP의 동적 할당 사용",
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "Site Recovery를 사용하여 응용 프로그램 서버를 DR 사이트에 복제합니다. Site Recovery는 중앙 서비스 클러스터 VM을 DR 사이트에 복제하는 데도 도움이 될 수 있습니다. DR을 호출할 때 DR 사이트에서 Linux Pacemaker 클러스터를 다시 구성해야 합니다(예: VIP 또는 SBD 바꾸기, corosync.conf 실행 등).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "높다",
- "text": "보안 요구 사항에 필요한 경우 AzFW/NVA를 사용하여 송신 트래픽 필터링",
- "waf": "안전"
+ "text": "단일 장애 지점에 대한 SAP 소프트웨어의 가용성을 고려합니다. 여기에는 SAP NetWeaver 및 SAP S/4HANA 아키텍처, SAP ABAP 및 ASCS + SCS에서 사용되는 DBMS와 같은 애플리케이션 내의 단일 실패 지점이 포함됩니다. 또한 SAP Web Dispatcher와 같은 다른 도구도 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
- "severity": "보통",
- "text": "퍼블릭 API 엔드포인트를 사용하는 경우 액세스할 수 있는 IP 주소를 제한합니다",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP 및 SAP 데이터베이스의 경우 자동 장애 조치(failover) 클러스터를 구현하는 것이 좋습니다. Windows에서 Windows Server 장애 조치(failover) 클러스터링은 장애 조치(failover)를 지원합니다. Linux에서 Linux Pacemaker 또는 SIOS Protection Suite 및 Veritas InfoScale과 같은 타사 도구는 장애 조치를 지원합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "높다",
- "text": "요구 사항에 따라 개인 클러스터를 사용합니다",
- "waf": "안전"
+ "text": "Azure는 기본 및 보조 VM이 DBMS 데이터에 대한 스토리지를 공유하는 아키텍처를 지원하지 않습니다. DBMS 계층의 경우 일반적인 아키텍처 패턴은 기본 및 보조 VM에서 사용하는 것과 다른 스토리지 스택을 사용하여 동시에 데이터베이스를 복제하는 것입니다.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "보통",
- "text": "Windows 2019 및 2022 AKS 노드의 경우 Calico 네트워크 정책을 사용할 수 있습니다. ",
- "waf": "안전"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"severity": "높다",
- "text": "Kubernetes 네트워크 정책 옵션 사용(Calico/Azure)",
- "waf": "안전"
+ "text": "DBMS 데이터 및 트랜잭션/다시 실행 로그 파일은 Azure 지원 블록 스토리지 또는 Azure NetApp Files에 저장됩니다. Azure Files 또는 Azure Premium Files는 SAP 워크로드를 사용하여 DBMS 데이터 및/또는 다시 실행 로그 파일에 대한 스토리지로 지원되지 않습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
"severity": "높다",
- "text": "쿠버네티스 네트워크 정책을 사용하여 클러스터 내 보안 강화",
- "waf": "안전"
+ "text": "ASCS + SCS 구성 요소 및 특정 고가용성 시나리오에 대해 Windows에서 Azure 공유 디스크를 사용할 수 있습니다. SAP 애플리케이션 계층 구성 요소 및 DBMS 계층에 대해 장애 조치(failover) 클러스터를 별도로 설정합니다. Azure는 현재 SAP 애플리케이션 계층 구성 요소와 DBMS 계층을 하나의 장애 조치(failover) 클러스터로 결합하는 고가용성 아키텍처를 지원하지 않습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
"severity": "높다",
- "text": "웹 워크로드(UI 또는 API)에 WAF 사용Use a WAF for web workloads (UIs or APIs)",
- "waf": "안전"
+ "text": "SAP ASCS(애플리케이션 계층 구성 요소) 및 DBMS 계층에 대한 대부분의 장애 조치(failover) 클러스터에는 장애 조치(failover) 클러스터에 대한 가상 IP 주소가 필요합니다. Azure Load Balancer는 다른 모든 경우에 대해 가상 IP 주소를 처리해야 합니다. 한 가지 설계 원칙은 클러스터 구성당 하나의 부하 분산 장치를 사용하는 것입니다. 부하 분산 장치의 표준 버전(표준 Load Balancer SKU)을 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
- "severity": "보통",
- "text": "AKS Virtual Network에서 DDoS 표준 사용Use DDoS Standard in the AKS Virtual Network",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "로드 밸런서에서 부동 IP가 활성화되어 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
- "severity": "낮다",
- "text": "필요한 경우 회사 HTTP 프록시를 추가합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "고가용성 인프라를 배포하기 전에 선택한 지역에 따라 Azure 가용성 집합을 사용하여 배포할지 또는 가용성 영역을 사용하여 배포할지를 결정합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
- "severity": "보통",
- "text": "고급 마이크로서비스 통신 관리를 위해 서비스 메시를 사용하는 것이 좋습니다",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)용 애플리케이션에 대한 인프라 SLA를 충족하려면 모든 구성 요소에 대해 동일한 고가용성 옵션(VM, 가용성 집합, 가용성 영역)을 선택해야 합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"severity": "높다",
- "text": "가장 중요한 메트릭에 대한 경고 구성(권장 사항은 Container Insights 참조)",
- "waf": "작업"
+ "text": "동일한 가용성 집합에서 서로 다른 역할의 서버를 혼합하지 마십시오. 중앙 서비스 VM, 데이터베이스 VM, 애플리케이션 VM을 자체 가용성 집합으로 유지",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "낮다",
- "text": "Azure Advisor에서 클러스터에 대한 권장 사항을 정기적으로 확인합니다.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "근접 배치 그룹을 사용하지 않는 한 Azure 가용성 영역 내에 Azure 가용성 집합을 배포할 수 없습니다.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS 자동 인증서 회전 사용",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "가용성 집합을 만들 때 사용 가능한 최대 장애 도메인 및 업데이트 도메인 수를 사용합니다. 예를 들어 하나의 가용성 집합에 두 개 이상의 VM을 배포하는 경우 Azure 계획된 유지 관리 외에도 잠재적인 물리적 하드웨어 오류, 네트워크 중단 또는 전원 중단의 영향을 제한할 수 있는 최대 장애 도메인 수(3개)와 충분한 업데이트 도메인을 사용합니다. 장애 도메인의 기본 수는 2개이며 나중에 온라인으로 변경할 수 없습니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "높다",
- "text": "kubernetes 버전을 주기적으로(예: 분기별) 업그레이드하거나 AKS 자동 업그레이드 기능을 사용하는 정기적인 프로세스가 있습니다.",
- "waf": "작업"
+ "text": "가용성 집합 배포에서 Azure 근접 배치 그룹을 사용하는 경우 세 가지 SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)가 모두 동일한 근접 배치 그룹에 있어야 합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "높다",
- "text": "node-image upgrade를 사용하지 않는 경우 Linux 노드 업그레이드에 kured를 사용합니다.",
- "waf": "작업"
+ "text": "SAP SID당 하나의 근접 배치 그룹을 사용합니다. 그룹은 가용성 영역 또는 Azure 지역에 걸쳐 있지 않습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "높다",
- "text": "클러스터 노드 이미지를 주기적으로(예: 매주) 업그레이드하는 정기적인 프로세스가 있습니다.",
- "waf": "작업"
+ "text": "운영 체제에 따라 다음 서비스 중 하나를 사용하여 SAP 중앙 서비스 클러스터를 실행합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "낮다",
- "text": "gitops를 고려하여 애플리케이션 또는 클러스터 구성을 여러 클러스터에 배포합니다.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure는 현재 동일한 Linux Pacemaker 클러스터에서 ASCS와 DB HA를 결합하는 것을 지원하지 않습니다. 개별 클러스터로 분리합니다. 그러나 최대 5개의 여러 중앙 서비스 클러스터를 한 쌍의 VM으로 결합할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
- "severity": "낮다",
- "text": "프라이빗 클러스터에서 AKS 명령 호출을 사용하는 것이 좋습니다.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "가용성 집합 또는 가용성 영역의 고가용성 쌍에 두 VM을 모두 배포합니다. 이러한 VM은 크기가 동일해야 하며 스토리지 구성이 동일해야 합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "낮다",
- "text": "계획된 이벤트의 경우 노드 자동 드레인 사용을 고려하십시오.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure는 RHEL(Red Hat Enterprise Linux)에서 실행되는 동일한 고가용성 클러스터에서 SAP HANA와 ASCS/SCS 및 ERS 인스턴스의 설치 및 구성을 지원합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "높다",
- "text": "노드 RG(일명 '인프라 RG')의 운영자가 변경을 수행하지 않도록 자체 거버넌스 관행을 개발합니다.",
- "waf": "작업"
+ "text": "프리미엄 관리형 SSD에서 모든 프로덕션 시스템을 실행하고 Azure NetApp Files 또는 Ultra Disk Storage를 사용합니다. 적어도 OS 디스크는 더 나은 성능과 최상의 SLA를 달성할 수 있도록 프리미엄 계층에 있어야 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "낮다",
- "text": "사용자 정의 노드 RG (일명 '인프라 RG') 이름 사용",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
+ "severity": "높다",
+ "text": null,
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
- "severity": "보통",
- "text": "YAML 매니페스트에서 더 이상 사용되지 않는 Kubernetes API를 사용하지 마십시오.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP 워크로드에 사용하는 스토리지 유형에 따라 고가용성을 구성하는 것이 좋습니다. Azure에서 사용할 수 있는 일부 스토리지 서비스는 Azure Site Recovery에서 지원되지 않으므로 고가용성 구성이 다를 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
- "severity": "낮다",
- "text": "테인트 Windows 노드",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "높다",
+ "text": null,
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "낮다",
- "text": "Windows 컨테이너 패치 수준을 호스트 패치 수준과 동기화된 상태로 유지",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP System Start-Stop을 자동화하여 비용을 관리합니다.",
+ "waf": "비용"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "클러스터 수준의 진단 설정을 통해Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "낮다",
- "text": "마스터 로그(즉, API 로그)를 Azure Monitor 또는 기본 로그 관리 솔루션으로 보냅니다",
- "waf": "작업"
+ "text": "SAP HANA와 함께 Azure Premium Storage를 사용하는 경우 Azure Standard SSD Storage를 사용하여 비용에 민감한 스토리지 솔루션을 선택할 수 있습니다. 그러나 표준 SSD 또는 표준 HDD Azure Storage를 선택하면 개별 VM의 SLA에 영향을 줍니다. 또한 비프로덕션 환경과 같이 I/O 처리량이 낮고 대기 시간이 짧은 시스템의 경우 더 낮은 시리즈 VM을 사용할 수 있습니다.",
+ "waf": "비용"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "낮다",
- "text": "필요한 경우 nodePool 스냅샷을 사용합니다.",
+ "text": "저렴한 대체 구성(다목적)으로 비프로덕션 HANA 데이터베이스 서버 VM에 대해 저성능 SKU를 선택할 수 있습니다. 그러나 E 시리즈와 같은 일부 VM 유형은 HANA 인증(SAP HANA 하드웨어 디렉터리)되지 않았거나 1ms 미만의 스토리지 대기 시간을 달성할 수 없다는 점에 유의해야 합니다.",
"waf": "비용"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
- "severity": "낮다",
- "text": "시간에 민감하지 않은 워크로드에 대한 스폿 노드 풀 고려",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
+ "severity": null,
+ "text": null,
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
- "severity": "낮다",
- "text": "빠른 버스팅을 위해 AKS 가상 노드 고려",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "클라우드 커넥터를 통해 SAP 클라우드 애플리케이션에서 SAP 온-프레미스(IaaS 포함)로 ID를 전달하기 위한 주체 전파 적용",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
- "severity": "높다",
- "text": "Container Insights(또는 Prometheus와 같은 다른 도구)를 사용하여 클러스터 지표 모니터링",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAML을 사용하여 Azure AD를 사용하여 SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics 및 SAP C4C와 같은 SAP SaaS 애플리케이션에 SSO를 구현합니다.",
+ "waf": null
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
- "severity": "높다",
- "text": "Container Insights(또는 Telegraf/ElasticSearch와 같은 다른 도구)를 사용하여 클러스터 로그를 저장하고 분석합니다.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
+ "severity": null,
+ "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": null
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"severity": "보통",
- "text": "노드의 CPU 및 메모리 사용률 모니터링",
- "waf": "작업"
+ "text": null,
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure CNI를 사용하는 경우 노드당 사용되는 Pod IP의 %를 모니터링합니다.",
- "waf": "작업"
+ "text": "SAP NetWeaver SSO 또는 파트너 솔루션을 사용하여 SAP GUI에 SSO를 구현할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "OS 디스크의 I/O는 중요한 리소스입니다. 노드의 OS가 I/O에서 제한되면 예측할 수 없는 동작이 발생할 수 있으며, 일반적으로 노드가 NotReady로 선언됩니다",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
"severity": "보통",
- "text": "노드에서 OS 디스크 큐 크기 모니터링Monitor OS disk queue depth in nodes",
- "waf": "작업"
+ "text": "SAP GUI 및 웹 브라우저 액세스용 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP Secure Login Server를 고려합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"severity": "보통",
- "text": "AzFW/NVA에서 송신 필터링을 사용하지 않는 경우 표준 ALB 할당 SNAT 포트를 모니터링합니다",
- "waf": "작업"
+ "text": null,
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"severity": "보통",
- "text": "AKS 클러스터에 대한 Resource Health 알림 구독Subscribe to resource health notifications for your AKS cluster",
- "waf": "작업"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "높다",
- "text": "Pod 규격에서 요청 및 제한 구성",
- "waf": "작업"
+ "text": "SAP NetWeaver용 OAuth를 사용하여 SSO를 구현하여 타사 또는 사용자 지정 애플리케이션이 SAP NetWeaver OData 서비스에 액세스할 수 있도록 합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"severity": "보통",
- "text": "네임스페이스에 대한 리소스 할당량 적용Enforce resource quotas for namespaces",
- "waf": "작업"
+ "text": "SAP HANA에 대한 SSO 구현",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
- "severity": "높다",
- "text": "구독에 노드 풀을 확장할 수 있는 충분한 할당량이 있는지 확인합니다.",
- "waf": "작업"
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure AD를 RISE에서 호스트되는 SAP 시스템의 ID 공급자로 간주합니다. 자세한 내용은 Azure AD와 서비스 통합을 참조하세요.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"severity": "보통",
- "text": "Cluster Autoscaler 사용",
- "waf": "공연"
+ "text": "SAP에 액세스하는 애플리케이션의 경우 주체 전파를 사용하여 SSO를 설정할 수 있습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS 노드 풀에 대한 노드 구성 사용자 지정",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP IAS(Identity Authentication Service)가 필요한 SAP BTP 서비스 또는 SaaS 솔루션을 사용하는 경우 SAP Cloud Identity Authentication Services와 Azure AD 간에 SSO를 구현하여 해당 SAP 서비스에 액세스하는 것이 좋습니다. 이 통합을 통해 SAP IAS는 프록시 ID 공급자 역할을 하고 중앙 사용자 저장소 및 ID 공급자로 Azure AD에 인증 요청을 전달할 수 있습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
"severity": "보통",
- "text": "필요한 경우 Horizontal Pod Autoscaler 사용",
- "waf": "공연"
+ "text": "SAP BTP에 대한 SSO 구현",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "노드가 클수록 임시 디스크 및 가속화된 네트워킹과 같은 더 높은 성능과 기능을 제공하지만 폭발 반경이 증가하고 크기 조정 세분성이 감소합니다",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
- "severity": "높다",
- "text": "너무 크거나 너무 작지 않은 적절한 노드 크기를 고려합니다",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP SuccessFactors를 사용하는 경우 Azure AD 자동화된 사용자 프로비저닝을 사용하는 것이 좋습니다. 이 통합을 통해 SAP SuccessFactors에 신입 사원을 추가할 때 Azure AD에서 해당 사용자 계정을 자동으로 생성할 수 있습니다. 필요에 따라 Microsoft 365 또는 Azure AD에서 지원하는 기타 SaaS 애플리케이션에서 사용자 계정을 만들 수 있습니다. SAP SuccessFactors에 이메일 주소의 쓰기 저장을 사용합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "낮다",
- "text": "확장성을 위해 5,000개 이상의 노드가 필요한 경우 추가 AKS 클러스터를 사용하는 것이 좋습니다",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "description": "관리 그룹 계층 구조를 4개 이하로 합리적으로 평평하게 유지합니다.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP 구독에 기존 관리 그룹 정책 적용",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS 자동화를 위해 EventGrid 이벤트를 구독하는 것이 좋습니다.",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "긴밀하게 결합된 애플리케이션을 동일한 SAP 구독에 통합하여 추가적인 라우팅 및 관리 복잡성 방지",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "낮다",
- "text": "AKS 클러스터에서 장기 실행 작업의 경우 이벤트 종료를 고려합니다.",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "구독을 배율 단위로 활용하고 리소스를 확장하려면 환경별로 구독을 배포하는 것이 좋습니다. 샌드박스, 비프로덕션, 프로덕션 ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "구독 프로비저닝의 일부로 할당량 증가를 보장(예: 구독 내에서 사용 가능한 총 VM 코어 수)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "작업"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"severity": "낮다",
- "text": "필요한 경우 AKS 노드에 Azure Dedicated Host를 사용하는 것이 좋습니다",
- "waf": "공연"
+ "text": "할당량 API는 Azure 서비스에 대한 할당량을 보고 관리하는 데 사용할 수 있는 REST API입니다. 필요한 경우 사용을 고려하십시오.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
"severity": "높다",
- "text": "임시 OS 디스크 사용",
- "waf": "공연"
+ "text": "가용성 영역에 배포하는 경우 할당량이 승인되면 VM의 영역 배포를 사용할 수 있는지 확인합니다. 필요한 구독, VM 시리즈, CPU 수 및 가용성 영역을 포함한 지원 요청을 제출합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "높다",
- "text": "임시 디스크가 아닌 디스크의 경우 여러 Pod를 실행하는 데 고성능이 필요하고 기본 AKS 로그 회전 임계값을 사용하여 대규모 로그를 생성하므로 많은 Pod/노드를 실행할 때 노드에 높은 IOPS 및 더 큰 OS 디스크를 사용합니다",
- "waf": "공연"
+ "text": "필요한 서비스 및 기능이 선택한 배포 지역 내에서 사용할 수 있는지 확인합니다(예: ). ANF, 지역 등.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "낮다",
- "text": "고성능 스토리지 옵션의 경우 AKS에서 Ultra Disks를 사용합니다.",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "비용 분류 및 리소스 그룹화를 위해 Azure 리소스 태그 활용(BillTo, 부서(또는 사업부), 환경(프로덕션, 스테이지, 개발), 계층(웹 계층, 응용 프로그램 계층), 응용 프로그램 소유자, 프로젝트 이름)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
- "severity": "보통",
- "text": "클러스터에서 상태를 유지하지 않고 외부(AzStorage, AzSQL, Cosmos 등)에 데이터를 저장합니다.",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "Azure Backup 서비스를 사용하여 HANA 데이터베이스를 보호할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"severity": "보통",
- "text": "AzFiles 표준을 사용하는 경우 성능상의 이유로 AzFiles 프리미엄 및/또는 ANF를 고려합니다",
- "waf": "공연"
+ "text": "HANA, Oracle 또는 DB2 데이터베이스에 Azure NetApp Files를 배포하는 경우 Azure 애플리케이션 일치 스냅샷 도구(AzAcSnap)를 사용하여 애플리케이션 일치 스냅샷을 만듭니다. AzAcSnap은 Oracle 데이터베이스도 지원합니다. 개별 VM이 아닌 중앙 VM에서 AzAcSnap을 사용하는 것이 좋습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
- "severity": "보통",
- "text": "Azure 디스크 및 AZ를 사용하는 경우 올바른 영역에 스토리지를 프로비전하기 위해 VolumeBindingMode::WaitForFirstConsumer를 사용하여 LRS 디스크의 영역 내에 노드 풀을 사용하거나 여러 영역에 걸쳐 있는 노드 풀에 ZRS 디스크를 사용하는 것이 좋습니다",
- "waf": "공연"
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "운영 체제와 SAP 시스템 간의 표준 시간대 일치를 확인합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"severity": "보통",
- "text": "Application Gateway v2 SKU를 사용하고 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "안전"
+ "text": "동일한 클러스터에서 서로 다른 애플리케이션 서비스를 그룹화하지 마세요. 예를 들어 DRBD와 중앙 서비스 클러스터를 동일한 클러스터에 결합하지 마세요. 그러나 동일한 Pacemaker 클러스터를 사용하여 약 5개의 서로 다른 중앙 서비스(다중 SID 클러스터)를 관리할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
- "severity": "보통",
- "text": "Azure Load Balancer에 표준 SKU를 사용하고 있는지 확인합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "Azure 실행 비용을 절약하고 최적화하기 위해 스누즈 모델에서 개발/테스트 시스템을 실행하는 것이 좋습니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Load Balancer 프런트 엔드 IP 주소가 영역 중복인지 확인합니다(영역 프런트 엔드가 필요하지 않은 경우).",
- "waf": "안전"
+ "text": "SAP 자산을 관리하여 고객과 파트너 관계를 맺는 경우 Azure Lighthouse를 사용하는 것이 좋습니다. Azure Lighthouse를 사용하면 관리 서비스 공급자가 Azure 네이티브 ID 서비스를 사용하여 고객 환경에 인증할 수 있습니다. 고객은 언제든지 액세스 권한을 취소하고 서비스 제공업체의 조치를 감사할 수 있으므로 제어권을 고객에게 부여합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Application Gateways v2는 IP 접두사가 /24보다 크거나 같은 서브넷에 배포해야 합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "안전"
+ "text": "Azure 업데이트 관리자를 사용하여 단일 VM 또는 여러 VM에 대해 사용 가능한 업데이트의 상태를 확인하고 정기적인 패치를 예약하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "description": "일반적으로 역방향 프록시 및 특히 WAF의 관리는 네트워킹보다 애플리케이션에 더 가깝기 때문에 앱과 동일한 구독에 속합니다. 연결 구독에서 Application Gateway 및 WAF를 중앙 집중화하는 것은 단일 팀에서 관리하는 경우 괜찮을 수 있습니다.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
- "severity": "보통",
- "text": "랜딩 존 가상 네트워크 내에서 그리고 보안 중인 앱을 사용하여 인바운드 HTTP(S) 연결을 프록시하는 데 사용되는 Azure Application Gateway v2 또는 파트너 NVA를 배포합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "SAP Landscape Management(LaMa)를 사용하여 SAP Basis 운영을 최적화하고 관리합니다. Azure용 SAP LaMa 커넥터를 사용하여 SAP 시스템을 재배치, 복사, 복제 및 새로 고칩니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "보통",
- "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "text": "SAP용 Azure Monitor 솔루션을 사용하여 Azure에서 SAP 워크로드(SAP HANA, 고가용성 SUSE 클러스터 및 SQL 시스템)를 모니터링합니다. SAP Solution Manager를 사용하여 SAP용 Azure Monitor 솔루션을 보완하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
- "severity": "보통",
- "text": "최소 2개의 인스턴스로 자동 크기 조정을 구성합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP용 VM 확장 검사를 실행합니다. SAP용 VM 확장은 VM(가상 머신)의 할당된 관리 ID를 사용하여 VM 모니터링 및 구성 데이터에 액세스합니다. 이 검사는 SAP 애플리케이션의 모든 성능 메트릭이 기본 SAP용 Azure 확장에서 제공되는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
"severity": "보통",
- "text": "가용성 영역에 Application Gateway 배포",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "신뢰도"
+ "text": "액세스 제어 및 규정 준수 보고에 Azure Policy를 사용합니다. Azure Policy는 일관된 정책 준수와 빠른 위반 감지를 보장하기 위해 조직 전체 설정을 적용할 수 있는 기능을 제공합니다. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
- },
- {
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
- "severity": "높다",
- "text": "Traffic Manager를 사용하여 HTTP/S 이외의 프로토콜에 걸쳐 있는 글로벌 앱을 제공합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "신뢰도"
- },
- {
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
- "severity": "낮다",
- "text": "사용자가 내부 애플리케이션에만 액세스해야 하는 경우 Microsoft Entra ID 애플리케이션 프록시를 AVD(Azure Virtual Desktop)의 대안으로 고려했나요?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "안전"
+ "text": "Azure Network Watcher의 연결 모니터를 사용하여 SAP 데이터베이스 및 애플리케이션 서버에 대한 대기 시간 메트릭을 모니터링합니다. 또는 Azure Monitor를 사용하여 네트워크 대기 시간 측정값을 수집하고 표시합니다.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "작업"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"severity": "보통",
- "text": "네트워크에서 들어오는 연결에 대해 열려 있는 방화벽 포트 수를 줄이려면 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션에 대한 안전하고 인증된 액세스 권한을 부여하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "안전"
+ "text": "프로비저닝된 Azure 인프라에서 SAP HANA에 대한 품질 검사를 수행하여 프로비저닝된 VM이 Azure의 SAP HANA 모범 사례를 준수하는지 확인합니다.",
+ "waf": "작업"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "높다",
- "text": "SNAT 확장성 향상을 위해 Load Balancer 아웃바운드 규칙 대신 Azure NAT Gateway 사용",
- "waf": "신뢰도"
+ "text": "각 Azure 구독에 대해 영역 배포 전에 Azure 가용성 영역에서 대기 시간 테스트를 실행하여 Azure에서 SAP를 배포하기 위한 대기 시간이 짧은 영역을 선택합니다.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "공연"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
- "severity": "높다",
- "text": "Azure Application Gateway WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "복원력 보고서를 실행하여 프로비저닝된 전체 Azure 인프라(컴퓨팅, 데이터베이스, 네트워킹, 스토리지, Site Recovery)의 구성이 Azure용 Cloud Adaption Framework에서 정의한 구성을 준수하는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "신뢰도"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
- "severity": "높다",
- "text": "Azure Application Gateway WAF 정책에서 요청 본문 검사 기능이 사용하도록 설정되어 있는지 확인합니다.",
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP용 Microsoft Sentinel 솔루션을 사용하여 위협 방지를 구현합니다. 이 솔루션을 사용하여 SAP 시스템을 모니터링하고 비즈니스 로직 및 애플리케이션 계층 전반에서 정교한 위협을 탐지할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
"waf": "안전"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
- "severity": "높다",
- "text": "워크로드에 대한 검색 모드에서 Azure Application Gateway WAF를 튜닝합니다. 거짓 긍정 탐지를 줄입니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure 태그 지정을 활용하여 리소스를 논리적으로 그룹화 및 추적하고, 배포를 자동화하고, 가장 중요한 것은 발생한 비용에 대한 가시성을 제공할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "작업"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
- "severity": "높다",
- "text": "'방지' 모드에서 Application Gateway에 대한 WAF 정책을 배포합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "대기 시간에 민감한 애플리케이션에 대해 VM 간 대기 시간 모니터링을 사용합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure Application Gateway WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 단기간에 많은 양의 트래픽을 보내는 것을 차단합니다.",
- "waf": "안전"
+ "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure Application Gateway WAF 속도 제한에 대해 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호를 제공합니다. ",
- "waf": "안전"
+ "text": "모든 데이터베이스 파일 시스템 및 실행 프로그램을 바이러스 백신 검사에서 제외합니다. 이를 포함하면 성능 문제가 발생할 수 있습니다. 제외 목록에 대한 규범적 세부 정보는 데이터베이스 공급업체에 문의하십시오. 예를 들어 Oracle은 바이러스 백신 검사에서 /oracle//sapdata를 제외하는 것이 좋습니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"severity": "낮다",
- "text": "모든 지역에서 트래픽이 발생할 것으로 예상되지 않는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.",
- "waf": "안전"
+ "text": "마이그레이션 후 비 HANA 데이터베이스에 대한 전체 데이터베이스 통계를 수집하는 것이 좋습니다. 예를 들어 SAP Note 1020260 - Oracle 통계 제공을 구현합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure Application Gateway WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 마세요.",
- "waf": "안전"
+ "text": "Azure에서 SAP를 사용하는 모든 Oracle 배포에 Oracle ASM(자동 스토리지 관리)을 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"severity": "보통",
- "text": "최신 Azure Application Gateway WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.",
- "waf": "안전"
+ "text": "Oracle을 실행하는 Azure의 SAP의 경우 SQL 스크립트 컬렉션을 통해 성능 문제를 진단할 수 있습니다. AWR(Automatic Workload Repository) 보고서에는 Oracle 시스템의 문제를 진단하는 데 유용한 정보가 포함되어 있습니다. 여러 세션 동안 AWR 보고서를 실행하고 최대 피크 시간을 선택하여 분석에 대한 광범위한 적용 범위를 보장하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
- "severity": "보통",
- "text": "진단 설정을 추가하여 Azure Application Gateway WAF 로그를 저장합니다.",
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure Application Gateway WAF 로그를 Microsoft Sentinel로 보냅니다.",
- "waf": "작업"
+ "text": "HTTP/S 앱을 안전하게 배달하려면 Application Gateway v2를 사용하고 WAF 보호 및 정책이 사용하도록 설정되어 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "보통",
- "text": "Azure Application Gateway WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.",
+ "text": "Azure로 마이그레이션하는 동안 가상 머신의 DNS 또는 가상 이름이 변경되지 않은 경우 백그라운드 DNS 및 가상 이름은 SAP 환경의 많은 시스템 인터페이스를 연결하며, 고객은 시간이 지남에 따라 개발자가 정의하는 인터페이스를 가끔씩만 인식할 수 있습니다. 마이그레이션 후 가상 또는 DNS 이름이 변경될 때 다양한 시스템 간에 연결 문제가 발생하며, 이러한 유형의 문제를 방지하기 위해 DNS 별칭을 유지하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "보통",
- "text": "레거시 WAF 구성 대신 WAF 정책을 사용합니다.",
+ "text": "서로 다른 DNS 영역을 사용하여 각 환경(샌드박스, 개발, 사전 프로덕션 및 프로덕션)을 서로 구분합니다. 예외는 자체 VNet을 사용하는 SAP 배포의 경우입니다. 여기서는 프라이빗 DNS 영역이 필요하지 않을 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "description": "VNet 피어링을 구성할 때 원격 가상 네트워크에 대한 트래픽 허용 설정을 사용합니다.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Application Gateway 서브넷의 연결(예: NSG)만 허용하도록 백 엔드에서 인바운드 트래픽을 필터링합니다.",
- "waf": "안전"
+ "text": "로컬 및 글로벌 VNet 피어링은 연결을 제공하며, 여러 Azure 지역에서 SAP 배포를 위한 랜딩 존 간의 연결을 보장하기 위해 선호되는 접근 방식입니다",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "높다",
- "text": "백엔드 서버에 대한 트래픽을 암호화해야 합니다.",
- "waf": "안전"
+ "text": "SAP 애플리케이션과 SAP 데이터베이스 서버 간에 NVA를 배포하는 것은 지원되지 않습니다",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
- "severity": "높다",
- "text": "웹 응용 프로그램 방화벽을 사용해야 합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 새로운, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"severity": "보통",
- "text": "HTTP를 HTTPS로 리디렉션",
- "waf": "안전"
+ "text": "파트너 NVA를 사용하는 경우에만 지역 간에 NVA(네트워크 가상 어플라이언스)를 배포하는 것이 좋습니다. 네이티브 NVA가 있는 경우 지역 또는 VNet 간의 NVA가 필요하지 않습니다. 파트너 네트워킹 기술 및 NVA를 배포하는 경우 공급업체의 지침에 따라 Azure 네트워킹과 충돌하는 구성을 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"severity": "보통",
- "text": "게이트웨이 관리 쿠키를 사용하여 처리를 위해 사용자 세션에서 동일한 서버로 트래픽을 전달합니다.",
+ "text": "Virtual WAN은 가상 WAN 기반 토폴로지에 대한 스포크 VNet 간의 연결을 관리하며(UDR[사용자 정의 라우팅] 또는 NVA를 설정할 필요 없음) 동일한 가상 허브의 VNet 간 트래픽에 대한 최대 네트워크 처리량은 초당 50기가비트입니다. 필요한 경우 SAP 랜딩 존은 VNet 피어링을 사용하여 다른 랜딩 존에 연결하고 이 대역폭 제한을 극복할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"severity": "높다",
- "text": "계획된 서비스 업데이트 중에 연결 드레이닝을 사용하도록 설정하여 백 엔드 풀의 기존 멤버에 대한 연결 손실을 방지합니다.",
+ "text": "SAP Workload를 실행하는 VM에 공용 IP를 할당하는 것은 권장되지 않습니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
- "severity": "낮다",
- "text": "사용자 지정 오류 페이지를 만들어 개인화된 사용자 경험을 표시합니다.",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "ASR을 구성할 때 DR 쪽에서 IP 주소를 예약하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
- "severity": "보통",
- "text": "클라이언트와 서버 간의 라우팅 및 정보 교환을 보다 쉽게 하기 위해 HTTP 요청 및 응답 헤더를 편집합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
"severity": "보통",
- "text": "Front Door를 구성하여 글로벌 웹 트래픽 라우팅, 최상위 최종 사용자 성능 및 빠른 글로벌 장애 조치(failover)를 통해 안정성을 최적화합니다.",
- "waf": "공연"
+ "text": "Azure는 VNet에서 여러 위임된 서브넷을 만드는 데 도움이 되지만 Azure NetApp Files용 VNet에는 하나의 위임된 서브넷만 존재할 수 있습니다. Azure NetApp Files에 대해 둘 이상의 위임된 서브넷을 사용하는 경우 새 볼륨을 만들려는 시도가 실패합니다.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"severity": "보통",
- "text": "전송 계층 부하 분산 사용",
- "waf": "공연"
+ "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다.",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"severity": "보통",
- "text": "단일 게이트웨이에서 여러 웹 응용 프로그램에 대한 호스트 또는 도메인 이름을 기반으로 라우팅을 구성합니다.",
+ "text": "Application Gateway, SAP Web Dispatcher 및 기타 타사 서비스 간의 비교에서 볼 수 있듯이 Application Gateway 및 Web Application Firewall SAP 웹앱에 대한 역방향 프록시 역할을 하는 경우 Application Gateway 및 Web Application Firewall에 대한 제한 사항이 있습니다.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
- "severity": "보통",
- "text": "SSL 인증서 관리를 중앙 집중화하여 백엔드 서버 팜의 암호화 및 암호 해독 오버헤드를 줄입니다.",
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역 전체에서 글로벌 보호를 제공합니다.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "낮다",
- "text": "WebSocket 및 HTTP/2 프로토콜에 대한 기본 지원을 위해 Application Gateway 사용",
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure Front Door 및 Application Gateway를 사용하여 HTTP/S 애플리케이션을 보호하는 경우 Azure Front Door의 Web Application Firewall 정책을 활용합니다. Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
- "severity": "낮다",
- "text": "모범 사례는 기준 고가용성 영역 중복 웹 애플리케이션 아키텍처를 참조하세요.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "프리미엄 및 표준 계층을 사용합니다. 이러한 계층은 스테이징 슬롯 및 자동 백업을 지원합니다.",
- "waf": "신뢰도"
+ "text": "웹 응용 프로그램 방화벽을 사용하여 인터넷에 노출될 때 트래픽을 검사합니다. 또 다른 옵션은 부하 분산 장치 또는 Application Gateway 또는 타사 솔루션과 같은 기본 제공 방화벽 기능이 있는 리소스와 함께 사용하는 것입니다.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
- "severity": "높다",
- "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(프리미엄 v2 또는 v3 계층 필요)",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 새로운, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"severity": "보통",
- "text": "상태 확인 구현",
- "waf": "신뢰도"
+ "text": "데이터 유출을 방지하려면 Azure Private Link를 사용하여 Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory 등과 같은 PaaS(Platform as a Service) 리소스에 안전하게 액세스합니다. Azure 프라이빗 엔드포인트는 VNet과 Azure Storage, Azure Backup 등과 같은 서비스 간의 트래픽을 보호하는 데도 도움이 될 수 있습니다. VNet과 프라이빗 엔드포인트 사용 서비스 간의 트래픽은 Microsoft 글로벌 네트워크를 통해 이동하므로 공용 인터넷에 노출되지 않습니다.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"severity": "높다",
- "text": "Azure App Service에 대한 백업 및 복원 모범 사례를 참조하세요.",
- "waf": "신뢰도"
+ "text": "SAP 애플리케이션 및 DBMS 계층에 사용되는 VM에서 Azure 가속 네트워킹이 사용하도록 설정되어 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
- "severity": "높다",
- "text": "Azure App Service 안정성 모범 사례 구현",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure Load Balancer에 대한 내부 배포가 DSR(Direct Server Return)을 사용하도록 설정되어 있는지 확인합니다. 이 설정(유동 IP 사용)은 DBMS 계층의 고가용성 구성에 내부 로드 밸런서 구성을 사용할 때 대기 시간을 줄입니다.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "낮다",
- "text": "App Service 앱을 다른 지역으로 이동하는 방법을 숙지합니다. 재해가 발생하는 동안",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "ASG(애플리케이션 보안 그룹) 및 NSG 규칙을 사용하여 SAP 애플리케이션과 DBMS 계층 간의 네트워크 보안 액세스 제어 목록을 정의할 수 있습니다. ASG는 가상 머신을 그룹화하여 보안을 관리하는 데 도움을 줍니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"severity": "높다",
- "text": "Azure App Service의 안정성 지원 숙지",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
- "severity": "보통",
- "text": "App Service 계획에서 실행되는 Function Apps에 대해 \"Always On\"이 사용하도록 설정되어 있는지 확인합니다.",
- "waf": "신뢰도"
+ "text": "피어링되지 않은 다른 Azure VNet에 SAP 애플리케이션 계층 및 SAP DBMS를 배치하는 것은 지원되지 않습니다.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "보통",
- "text": "상태 검사를 사용하여 App Service 인스턴스 모니터링Monitor App Service instances using Health checks",
- "waf": "신뢰도"
+ "text": "SAP 애플리케이션에서 네트워크 대기 시간을 최적화하려면 Azure 근접 배치 그룹을 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
- "severity": "보통",
- "text": "Application Insights 가용성 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "온-프레미스와 Azure 간에 분할된 SAP 애플리케이션 서버 계층 및 DBMS 계층을 실행하는 것은 전혀 지원되지 않습니다. 두 계층 모두 온-프레미스 또는 Azure에 완전히 상주해야 합니다.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "severity": "낮다",
- "text": "Application Insights 표준 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "계층 간의 과도한 네트워크 트래픽으로 인해 발생할 수 있는 상당한 비용 때문에 DBMS(데이터베이스 관리 시스템) 및 SAP 시스템의 애플리케이션 계층을 서로 다른 VNet에 호스트하고 VNet 피어링과 연결하는 것은 권장되지 않습니다. Azure 가상 네트워크 내의 서브넷을 사용하여 SAP 애플리케이션 계층과 DBMS 계층을 분리하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "비용"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Key Vault를 사용하여 애플리케이션에 필요한 모든 비밀을 저장합니다. Key Vault는 비밀을 저장하기 위한 안전하고 감사된 환경을 제공하며 Key Vault SDK 또는 App Service Key Vault 참조를 통해 App Service와 잘 통합됩니다.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
"severity": "높다",
- "text": "Key Vault를 사용하여 비밀 저장",
- "waf": "안전"
+ "text": "Linux 게스트 운영 체제에서 Load Balancer를 사용하는 경우 Linux 네트워크 매개 변수 net.ipv4.tcp_timestamps가 0으로 설정되어 있는지 확인합니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "관리 ID를 사용하여 Key Vault SDK를 사용하거나 App Service Key Vault 참조를 통해 Key Vault에 연결합니다.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "높다",
- "text": "관리 ID를 사용하여 Key Vault에 연결",
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP RISE/ECS 배포의 경우 가상 피어링은 고객의 기존 Azure 환경과의 연결을 설정하는 기본 방법입니다. SAP vnet과 고객 vnet은 모두 NSG(네트워크 보안 그룹)로 보호되므로 vnet 피어링을 통해 SAP 및 데이터베이스 포트에서 통신할 수 있습니다",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service TLS 인증서를 Key Vault에 저장합니다.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "높다",
- "text": "Key Vault를 사용하여 TLS 인증서를 저장합니다.",
- "waf": "안전"
+ "text": "Azure VM에 대한 SAP HANA 데이터베이스 백업을 검토합니다.",
+ "waf": "비용"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "중요한 정보를 처리하는 시스템은 격리해야 합니다. 이렇게 하려면 별도의 App Service 계획 또는 App Service Environment를 사용하고 다른 구독 또는 관리 그룹을 사용하는 것이 좋습니다.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "보통",
- "text": "민감한 정보를 처리하는 시스템 격리",
- "waf": "안전"
+ "text": "SAP에 사용되는 Site Recovery 기본 제공 모니터링을 검토합니다.",
+ "waf": "비용"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service의 로컬 디스크는 암호화되지 않으며 중요한 데이터를 저장해서는 안 됩니다. (예: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP HANA 시스템 환경 모니터링 지침을 검토합니다.",
+ "waf": "작업"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"severity": "보통",
- "text": "로컬 디스크에 중요한 데이터를 저장하지 마십시오.",
- "waf": "안전"
+ "text": "Azure Linux VM 백업 전략에서 Oracle Database를 검토합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "인증된 웹 애플리케이션의 경우 Azure AD 또는 Azure AD B2C와 같이 잘 설정된 ID 공급자를 사용합니다. 선택한 애플리케이션 프레임워크를 활용하여 이 공급자와 통합하거나 App Service 인증/권한 부여 기능을 사용합니다.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"severity": "보통",
- "text": "인증에 설정된 ID 공급자 사용",
- "waf": "안전"
+ "text": "SQL Server 2016에서 Azure Blob Storage 사용을 검토합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "잘 관리되고 안전한 DevOps 배포 파이프라인과 같이 제어되고 신뢰할 수 있는 환경에서 App Service에 코드를 배포합니다. 이렇게 하면 버전이 제어되지 않고 악성 호스트에서 배포되는 것으로 확인되지 않은 코드를 방지할 수 있습니다.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
- "severity": "높다",
- "text": "신뢰할 수 있는 환경에서 배포",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure VM에 대한 자동화된 Backup v2 사용을 검토합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "FTP/FTPS 및 WebDeploy/SCM 모두에 대한 기본 인증을 사용 안함으로 설정합니다. 이렇게 하면 이러한 서비스에 대한 액세스가 비활성화되고 배포에 Azure AD 보안 엔드포인트가 사용됩니다. SCM 사이트는 Azure AD 자격 증명을 사용하여 열 수도 있습니다.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"severity": "높다",
- "text": "기본 인증 사용 안 함",
- "waf": "안전"
+ "text": "프리미엄 디스크(V1)를 사용하는 경우 M 시리즈에 쓰기 가속기 사용",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "가능한 경우 관리 ID를 사용하여 Azure AD 보안 리소스에 연결합니다. 이렇게 할 수 없는 경우 Key Vault에 비밀을 저장하고 대신 관리 ID를 사용하여 Key Vault에 연결합니다.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "severity": "높다",
- "text": "관리 ID를 사용하여 리소스에 연결",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "가용성 영역 대기 시간을 테스트합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 관리 ID를 사용하여 끌어옵니다.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
- "severity": "높다",
- "text": "관리 ID를 사용하여 컨테이너 끌어오기",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "모든 SAP 구성요소에 대해 SAP EarlyWatch Alert를 활성화합니다.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service의 진단 설정을 구성하면 모든 원격 분석을 로깅 및 모니터링의 중앙 대상으로 Log Analytics에 보낼 수 있습니다. 이를 통해 HTTP 로그, 애플리케이션 로그, 플랫폼 로그 등과 같은 App Service의 런타임 활동을 모니터링할 수 있습니다.",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"severity": "보통",
- "text": "Log Analytics에 App Service 런타임 로그 보내기Send App Service runtime logs to Log Analytics",
- "waf": "안전"
+ "text": "SAP ABAPMeter 보고서 /SSA/CAT를 사용하여 SAP 애플리케이션 서버-데이터베이스 서버 대기 시간을 검토합니다.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "활동 로그를 Log Analytics에 로깅 및 모니터링의 중앙 대상으로 보내도록 진단 설정을 지정합니다. 이렇게 하면 App Service 리소스 자체에서 컨트롤 플레인 작업을 모니터링할 수 있습니다.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"severity": "보통",
- "text": "Log Analytics에 App Service 활동 로그 보내기Send App Service activity logs to Log Analytics",
- "waf": "안전"
+ "text": "CCMS를 사용하여 SQL Server 성능 모니터링을 검토합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "지역 VNet 통합, 네트워크 보안 그룹 및 UDR의 조합을 사용하여 아웃바운드 네트워크 액세스를 제어합니다. 트래픽은 Azure Firewall과 같은 NVA로 라우팅되어야 합니다. 방화벽의 로그를 모니터링해야 합니다.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
"severity": "보통",
- "text": "아웃바운드 네트워크 액세스를 제어해야 함",
- "waf": "안전"
+ "text": "SAP 애플리케이션 계층 VM과 DBMS VM(NIPING) 간의 네트워크 대기 시간을 테스트합니다.",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "VNet 통합을 사용하고 VNet NAT Gateway 또는 NVA와 같은 Azure Firewall을 사용하여 안정적인 아웃바운드 IP를 제공할 수 있습니다. 이렇게 하면 필요한 경우 수신 당사자가 IP를 기반으로 허용 목록을 만들 수 있습니다. Azure 서비스에 대한 통신의 경우 IP 주소에 의존할 필요가 없는 경우가 많으며 서비스 엔드포인트와 같은 메커니즘을 대신 사용해야 합니다. (또한 수신 끝에서 프라이빗 엔드포인트를 사용하면 SNAT가 발생하지 않고 안정적인 아웃바운드 IP 범위를 제공합니다.)",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
- "severity": "낮다",
- "text": "인터넷 주소에 대한 아웃바운드 통신을 위한 안정적인 IP 보장",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP HANA Studio 알림을 검토합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service 액세스 제한, 서비스 엔드포인트 또는 프라이빗 엔드포인트의 조합을 사용하여 인바운드 네트워크 액세스를 제어합니다. 웹앱 자체 및 SCM 사이트에 대해 서로 다른 액세스 제한이 필요하고 구성될 수 있습니다.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "높다",
- "text": "인바운드 네트워크 액세스를 제어해야 합니다.",
- "waf": "안전"
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "HANA_Configuration_Minichecks를 사용하여 SAP HANA 상태 점검을 수행합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Application Gateway 또는 Azure Front Door와 같은 Web Application Firewall을 사용하여 악의적인 인바운드 트래픽으로부터 보호합니다. WAF의 로그를 모니터링해야 합니다.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
- "severity": "높다",
- "text": "App Service 앞에서 WAF 사용Use a WAF in front of App Service",
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure, 온-프레미스 또는 기타 클라우드 환경에서 Windows 및 Linux VM을 실행하는 경우 Azure Automation의 업데이트 관리 센터를 사용하여 보안 패치를 포함한 운영 체제 업데이트를 관리할 수 있습니다.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "WAF에 대한 액세스만 잠궈 WAF를 우회할 수 없는지 확인합니다. 액세스 제한, 서비스 엔드포인트 및 프라이빗 엔드포인트의 조합을 사용합니다.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "높다",
- "text": "WAF가 우회되지 않도록 방지",
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "SAP는 SAP 시스템을 보호하기 위해 즉각적인 조치가 필요한 매우 중요한 보안 패치 또는 핫픽스를 릴리스하므로 SAP 보안 OSS 노트를 정기적으로 검토합니다.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service 구성에서 최소 TLS 정책을 1.2로 설정합니다.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
- "severity": "보통",
- "text": "최소 TLS 정책을 1.2로 설정합니다.",
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "SQL Server SAP의 경우 SQL Server 시스템 관리자 계정을 사용하지 않으므로 SQL Server 시스템 관리자 계정을 사용하지 않도록 설정할 수 있습니다. 원래 시스템 관리자 계정을 비활성화하기 전에 시스템 관리자 권한이 있는 다른 사용자가 서버에 액세스할 수 있는지 확인합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "HTTPS만 사용하도록 App Service를 구성합니다. 이로 인해 App Service가 HTTP에서 HTTPS로 리디렉션됩니다. 코드 또는 WAF에서 HSTS(HTTP Strict Transport Security)를 사용하여 HTTPS를 통해서만 사이트에 액세스해야 함을 브라우저에 알리는 것이 좋습니다.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"severity": "높다",
- "text": "HTTPS만 사용",
+ "text": "xp_cmdshell 비활성화합니다. SQL Server 기능 xp_cmdshell SQL Server 내부 운영 체제 명령 셸을 사용하도록 설정합니다. 이는 보안 감사에서 잠재적인 위험입니다.",
+ "training": "https://me.sap.com/notes/3019299/E",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "CORS 구성에서 와일드카드를 사용하면 모든 원본이 서비스에 액세스할 수 있으므로 CORS의 목적에 어긋나므로 사용하지 마세요. 특히 서비스에 액세스할 수 있을 것으로 예상되는 원본만 허용합니다.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "높다",
- "text": "와일드카드는 CORS에 사용할 수 없습니다.",
+ "text": "Azure에서 SAP HANA 데이터베이스 서버를 암호화하려면 SAP HANA 네이티브 암호화 기술을 사용합니다. 또한 Azure에서 SQL Server를 사용하는 경우 TDE(투명한 데이터 암호화)를 사용하여 데이터 및 로그 파일을 보호하고 백업도 암호화되도록 합니다.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "원격 디버깅은 서비스에서 추가 포트를 열어 공격 노출 영역을 증가시키므로 프로덕션에서 켜면 안 됩니다. 서비스는 48시간 후에 자동으로 원격 디버깅을 설정합니다.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
- "severity": "높다",
- "text": "원격 디버깅 끄기",
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
+ "severity": "보통",
+ "text": "Azure Storage 암호화는 모든 Azure Resource Manager 및 클래식 스토리지 계정에 대해 사용하도록 설정되며 사용하지 않도록 설정할 수 없습니다. 데이터는 기본적으로 암호화되므로 Azure Storage 암호화를 사용하기 위해 코드나 애플리케이션을 수정할 필요가 없습니다.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "App Service용 Defender를 사용하도록 설정합니다. 이는 다른 위협 중에서도 알려진 악성 IP 주소에 대한 통신을 탐지합니다. 작업의 일부로 App Service용 Defender의 권장 사항을 검토합니다.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
- "severity": "보통",
- "text": "클라우드용 Defender 사용 - App Service용 Defender",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure는 네트워크에서 DDoS 기본 보호를 제공하며, 정상적인 트래픽 패턴을 학습하고 비정상적인 동작을 감지할 수 있는 지능형 DDoS 표준 기능으로 개선할 수 있습니다. DDoS 표준은 Virtual Network에 적용되므로 Application Gateway 또는 NVA와 같은 앱 앞의 네트워크 리소스에 대해 구성해야 합니다.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "보통",
- "text": "WAF VNet에서 DDOS 보호 표준 사용Enable DDOS Protection Standard on the WAF VNet",
+ "text": "무단 변경으로부터 보호하기 위해 성공적인 배포 후 Azure 리소스를 잠그는 것이 좋습니다. 또한 사용자 지정된 Azure 정책(Custome 역할)을 사용하여 구독별로 LOCK 제약 조건 및 규칙을 적용할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 프라이빗 엔드포인트 및 앱 설정 'WEBSITE_PULL_IMAGE_OVER_VNET'를 사용하여 Azure Container Registry에서 가상 네트워크를 통해 끌어옵니다.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"severity": "보통",
- "text": "Virtual Network를 통해 컨테이너 끌어오기",
+ "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "참여의 침투 테스트 규칙에 따라 웹 응용 프로그램에 대한 침투 테스트를 수행합니다.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
- "severity": "보통",
- "text": "침투 테스트 수행",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "기존 요구 사항에 따라 규정 및 규정 준수 제어(내부/외부) - 필요한 Azure 정책 및 Azure RBAC 역할 결정",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "DevSecOps 사례에 따라 취약성을 검증하고 검사한 신뢰할 수 있는 코드를 배포합니다.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
- "severity": "보통",
- "text": "유효성이 검사된 코드 배포",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP 환경에서 엔드포인트용 Microsoft Defender 사용하도록 설정하는 경우 모든 서버를 대상으로 하는 대신 DBMS 서버에서 데이터 및 로그 파일을 제외하는 것이 좋습니다. 대상 파일을 제외할 때 DBMS 공급업체의 권장 사항을 따릅니다.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "안전"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"severity": "높다",
- "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용",
+ "text": "클라우드용 Microsoft Defender의 Just-In-Time 액세스 권한이 있는 SAP 관리자 사용자 지정 역할을 위임합니다.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub는 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "낮다",
- "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "text": "타사 보안 제품을 DIAG(SAP GUI)용 SNC(Secure Network Communications), RFC 및 HTTPS용 SPNEGO와 통합하여 전송 중인 데이터를 암호화합니다.",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hubs 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Event Hubs 네임스페이스를 구성할 수 있습니다. Event Hubs 네임스페이스에 최소 버전의 TLS가 필요한 경우 이전 버전으로 수행된 모든 요청이 실패합니다. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "보통",
- "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "보안 주체 암호화 기능을 위해 기본적으로 Microsoft 관리형 키를 사용하고 필요한 경우 고객 관리형 키를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Event Hubs 네임스페이스를 만들 때 네임스페이스에 대해 RootManageSharedAccessKey라는 정책 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 응용 프로그램에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "애플리케이션당 환경, 지역별 Azure Key Vault를 사용합니다.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure 리소스에 대한 관리 ID는 Azure VM(Virtual Machines), 함수 앱, Virtual Machine Scale Sets 및 기타 서비스에서 실행되는 애플리케이션에서 Azure AD 자격 증명을 사용하여 Event Hubs 리소스에 대한 액세스 권한을 부여할 수 있습니다. Azure AD 인증과 함께 Azure 리소스에 대한 관리 ID를 사용하면 클라우드에서 실행되는 애플리케이션에 자격 증명을 저장하지 않아도 됩니다. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Event Hub에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "비 HANA Windows 및 비 Windows 운영 체제에 대한 디스크 암호화 키 및 비밀을 제어하고 관리하려면 Azure Key Vault를 사용합니다. SAP HANA는 Azure Key Vault에서 지원되지 않으므로 SAP ABAP 또는 SSH 키와 같은 대체 방법을 사용해야 합니다.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "권한을 만들 때 Azure Event Hub에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Event Hub의 사용 권한은 개별 리소스 수준(예: 소비자 그룹, 이벤트 허브 엔터티, 이벤트 허브 네임스페이스 등)으로 범위를 지정할 수 있으며 범위가 지정되어야 합니다.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
"severity": "높다",
- "text": "최소 권한 데이터 평면 RBAC 사용",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Azure 스포크 구독의 SAP에 대한 RBAC(역할 기반 액세스 제어) 역할을 사용자 지정하여 실수로 인한 네트워크 관련 변경을 방지합니다.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub 리소스 로그에는 작업 로그, 가상 네트워크 및 Kafka 로그가 포함됩니다. 런타임 감사 로그는 Event Hubs의 모든 데이터 평면 액세스 작업(예: 이벤트 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그, 런타임 감사 로그 및 Kafka 로그와 같은 메트릭 및 로그를 캡처합니다.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "SAP 자산의 나머지 부분에서 DMZ 및 NVA를 격리하고, Azure Private Link를 구성하고, Azure의 SAP 리소스를 안전하게 관리 및 제어합니다.",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure Event Hub는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Event Hub 간의 트래픽이 Microsoft 백본 네트워크를 통해 트래버스할 수 있습니다. 또한 퍼블릭 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "프라이빗 엔드포인트를 사용하여 Azure Event Hub에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "Azure에서 Microsoft 맬웨어 방지 소프트웨어를 사용하여 악성 파일, 애드웨어 및 기타 위협으로부터 가상 머신을 보호하는 것이 좋습니다.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 또는 IPv4 주소 범위 집합으로만 추가로 제한할 수 있습니다. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "특정 IP 주소 또는 범위에서 Azure Event Hub 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "더욱 강력한 보호를 위해 엔드포인트용 Microsoft Defender 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
"waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "FTA 탄력성 핸드북 활용",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "높다",
+ "text": "가상 네트워크 피어링을 통해 스포크 네트워크에 연결된 허브 가상 네트워크를 통해 모든 트래픽을 전달하여 인터넷 또는 온-프레미스 네트워크에서 SAP 애플리케이션 및 데이터베이스 서버를 격리합니다. 피어링된 가상 네트워크는 Azure의 SAP 솔루션이 공용 인터넷에서 격리되도록 보장합니다.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": " 영역 사용 지역의 프리미엄, 전용 또는 표준 SKU를 사용하여 포털에서 만든 새 EH 네임스페이스에 대해 자동으로 설정됩니다. EH 메타데이터와 이벤트 데이터 자체는 모두 영역 간에 복제됩니다",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
- "severity": "높다",
- "text": "지역적으로 적용 가능한 경우 가용성 영역 활용Leverage Availability Zones if regionally applicable",
- "waf": "신뢰도"
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "낮다",
+ "text": "SAP Fiori와 같은 인터넷 연결 애플리케이션의 경우 보안 수준을 유지하면서 애플리케이션 요구 사항에 따라 부하를 분산해야 합니다. 계층 7 보안의 경우 Azure Marketplace에서 사용할 수 있는 타사 WAF(Web Application Firewall)를 사용할 수 있습니다.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "보통",
- "text": "예측 가능한 성능을 위해 프리미엄 또는 전용 SKU 사용",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "기본 제공 지역 재해 복구 기능을 사용하도록 설정하면 네임스페이스(Event Hubs, 소비자 그룹 및 설정)의 전체 구성이 기본 네임스페이스에서 보조 네임스페이스로 지속적으로 복제되며, 언제든지 한 번만 장애 조치(failover)를 주 네임스페이스에서 보조 네임스페이스로 이동할 수 있습니다. 활성/수동 기능은 애플리케이션 구성을 변경할 필요 없이 실패한 Azure 지역에서 더 쉽게 복구하고 중단할 수 있도록 설계되었습니다",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
- "severity": "높다",
- "text": "Active Passive 구성을 사용하여 지역 재해 복구 계획Plan for Geo Disaster Recovery using Active Passive configuration",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "다운된 지역에서 이벤트 데이터의 중단 또는 손실을 허용할 수 없는 DR 구성에 사용해야 합니다. 이러한 경우 복제 지침을 따르고 기본 제공 지역 재해 복구 기능(활성/수동)을 사용하지 마세요. 액티브/액티브를 사용하여 서로 다른 지역 및 네임스페이스에서 여러 Event Hubs를 유지 관리하면 허브 간에 이벤트가 복제됩니다",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "Business Critical Applications의 경우 Active Active 구성을 사용합니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
- "severity": "보통",
- "text": "복원력 있는 Event Hubs 설계",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "높다",
- "text": "읽기 작업에 대해 99.9%의 가용성을 갖도록 복제본 2개 사용",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "보통",
- "text": "읽기/쓰기 작업에 대해 99.9%의 가용성을 갖도록 복제본 3개 사용",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
- "severity": "높다",
- "text": "읽기 및/또는 쓰기 복제본을 활성화하여 가용 영역 활용Leverage Availability Zones by enabling read and/or write replicas",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "보통",
- "text": "지역 중복의 경우 Manually create services in 2 or more regions for Search는 지리적 지역 간에 검색 인덱스를 복제하는 자동화된 방법을 제공하지 않습니다",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
- "severity": "보통",
- "text": "여러 서비스에서 데이터를 동기화하려면 인덱서를 사용하여 여러 서비스의 콘텐츠를 업데이트하거나 REST API를 사용하여 여러 서비스에서 콘텐츠 업데이트를 푸시합니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
- "severity": "보통",
- "text": "Azure Traffic Manager를 사용하여 요청 조정",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
- "severity": "높다",
- "text": "Azure Cognitive Search 인덱스를 백업 및 복원합니다. 이 샘플 코드를 사용하여 인덱스 정의 및 스냅샷을 일련의 Json 파일에 백업합니다",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
- "severity": "높다",
- "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(자동으로 활성화됨)",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "보통",
- "text": "Microsoft에서 시작한 장애 조치(failover)에 유의하세요. 드문 경우지만 Microsoft는 영향을 받는 지역의 모든 IoT Hub를 해당 지역 쌍을 이루는 지역으로 장애 조치(failover)하기 위해 이러한 작업을 수행합니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
- "severity": "높다",
- "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "높다",
- "text": "수동 장애 조치(failover)를 트리거하는 방법을 알아봅니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
- "severity": "높다",
- "text": "장애 조치(failover) 후 장애 복구(failback)하는 방법을 알아봅니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "Azure Spring Apps는 모든 앱에 대해 두 개의 배포를 허용하며, 그 중 하나만 프로덕션 트래픽을 수신합니다. 블루-그린 배포 전략을 통해 가동 중지 시간 제로를 달성할 수 있습니다. 파란색 녹색 배포는 표준 및 엔터프라이즈 계층에서만 사용할 수 있습니다. ADO/GitHub 작업과 함께 CI/CD를 사용하여 배포를 자동화할 수 있습니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "Azure Spring Apps 인스턴스는 애플리케이션에 대해 여러 지역에서 만들 수 있으며 Traffic Manager/Front Door에서 트래픽을 라우팅할 수 있습니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "지원되는 지역에서 Azure Spring Apps는 영역 중복으로 배포할 수 있으며, 이는 인스턴스가 가용성 영역에 자동으로 분산됨을 의미합니다. 이 기능은 Standard 및 Enterprise 계층에서만 사용할 수 있습니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "앱에 1개 이상의 앱 인스턴스 사용",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "로그, 메트릭 및 추적을 사용하여 Azure Spring Apps를 모니터링합니다. ASA를 Application Insights와 통합하고, 오류를 추적하고, 통합 문서를 만듭니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "Spring Cloud Gateway에서 자동 크기 조정 설정",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
- "severity": "낮다",
- "text": "표준 소비 및 전용 플랜이 있는 앱에 대해 자동 크기 조정을 사용하도록 설정합니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
- "severity": "보통",
- "text": "중요 업무용 앱에 대한 Spring Boot의 상업적 지원을 위해 Enterprise 플랜을 사용합니다. 다른 계층에서는 OSS 지원을 받을 수 있습니다.",
- "waf": "신뢰도"
+ "text": "SAP용 Azure Monitor 솔루션에서 보안 통신을 사용하도록 설정하려면 루트 인증서 또는 서버 인증서를 사용하도록 선택할 수 있습니다. 루트 인증서를 사용하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "안전"
},
{
"arm-service": "Microsoft.KeyVault/vaults",
@@ -6310,1735 +5939,2218 @@
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "공명형 AI를 위한 Metaprompting 가드레일 따르기",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "text": "Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview 의 데이터 수집 규칙",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "더 나은 속도 제한, 부하 분산, 인증 및 로깅을 위해 APIM 또는 AI Central과 같은 솔루션을 사용하여 게이트웨이 패턴을 고려합니다.",
- "waf": "운영 우수성"
- },
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
+ "text": "기본 데이터 원본을 찾을 수 없는 백업 인스턴스 확인",
+ "waf": "비용"
+ },
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "AOAI 인스턴스에 대한 모니터링 활성화",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
+ "text": "연결되지 않은 서비스(디스크, NIC, IP 주소 등) 삭제 또는 보관",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "리소스에 대해 수행된 작업(예: 구독 키 다시 생성) 또는 메트릭 임계값(예: 한 시간에 10을 초과하는 오류 수)에 의해 생성된 활동 로그의 항목과 같은 이벤트를 팀에 알리는 경고를 만듭니다",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
+ "text": "중요 업무용 응용 프로그램에 대한 Site Recovery 저장소와 백업 간의 적절한 균형을 고려합니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "용량으로 인한 서비스 중단을 방지하기 위해 토큰 사용량을 모니터링합니다.",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
+ "text": "40개의 서로 다른 로그 분석 작업 영역 간의 지출 및 절감 기회 확인 - 비프로덕션 작업 영역에 대해 서로 다른 보존 및 데이터 수집 사용-인식 및 계층 크기 조정을 위한 일일 한도 만들기 - 일일 한도를 설정하는 경우 한도에 도달할 때 경고를 만드는 것 외에도 특정 비율(예: 90%)에 도달했을 때 알림을 받을 경고 규칙도 만들어야 합니다. - 가능한 경우 작업 영역 변환 고려 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "처리된 추론 토큰, 생성된 완료 토큰, 속도 제한 모니터링과 같은 메트릭 관찰",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
+ "text": "제거 로그 정책 및 자동화 적용(필요한 경우 로그를 콜드 스토리지로 이동할 수 있음)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
- "severity": "낮다",
- "text": "진단이 충분하지 않은 경우 Azure OpenAI 앞에 있는 Azure API Managements와 같은 게이트웨이를 사용하여 허용되는 경우 들어오는 프롬프트와 나가는 응답을 모두 기록하는 것이 좋습니다",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
+ "text": "디스크가 실제로 필요한지 확인하고, 그렇지 않은 경우 삭제하십시오. 필요한 경우 더 낮은 스토리지 계층을 찾거나 백업을 사용합니다.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Infrastructure as code를 사용하여 Azure OpenAI Service, 모델 배포 및 모든 관련 리소스를 배포합니다",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "text": "사용자 지정 규칙을 사용하여 사용하지 않는 스토리지를 하위 계층으로 이동하는 것이 좋습니다 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "API 키 대신 관리 ID로 Microsoft Entra 인증 사용",
- "waf": "안전"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "text": "Advisor가 VM 올바른 크기 조정에 대해 구성되어 있는지 확인합니다. ",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "입력과 정답이 있는 알려진 골든 데이터 세트를 사용하여 시스템의 성능/정확도를 평가합니다. 평가를 위해 PromptFlow의 기능을 활용합니다.",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "Cost analysys에서 Meter Category Licenses를 검색하여 확인합니다.",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "text": "모든 Windows VM에서 스크립트 실행 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM을 자주 만드는 경우 정책 구현을 고려합니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "프로비저닝된 처리량 모델의 사용 평가 ",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "text": " 이미 라이선스가 있는 경우 AHUB에 넣을 수도 https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Azure AI 콘텐츠 안전성 검토 및 구현",
- "waf": "운영 우수성"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
+ "text": "유연성 옵션을 사용하여 예약된 VM 제품군 통합(4-5개 이하의 제품군)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "분당 토큰 및 응답을 기반으로 시스템의 처리량을 정의 및 평가하고 요구 사항에 맞춥니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "text": "Azure Reserved Instances 활용: 이 기능을 사용하면 1년 또는 3년 동안 VM을 예약할 수 있으므로 PAYG 가격에 비해 상당한 비용 절감 효과를 얻을 수 있습니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "토큰 크기, 스트리밍 옵션을 제한하여 시스템의 대기 시간을 개선합니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "text": "더 큰 디스크만 예약할 수 있습니다 => 1TiB -",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "탄력성 요구를 예측하여 우선 순위에 따라 동기 및 일괄 처리 요청 분리를 결정합니다. 우선 순위가 높은 경우 동기 접근 방식을 사용하고 낮은 우선 순위의 경우 큐를 사용한 비동기 일괄 처리가 선호됩니다",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
+ "text": "적절한 크기 최적화 후",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "소비자의 예상 수요를 기반으로 토큰 사용 요구 사항을 벤치마킹합니다. 프로비저닝된 처리량 단위 배포를 사용하는 경우 처리량의 유효성을 검사하는 데 도움이 되도록 Azure OpenAI 벤치마킹 도구를 사용하는 것이 좋습니다",
- "waf": "공연"
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "text": "적용 가능한 경우 확인 및 정책/변경 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations 시행",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "PTU(프로비저닝된 처리량 단위)를 사용하는 경우 오버플로 요청에 대한 TPM(분당 토큰) 배포를 배포하는 것이 좋습니다. 게이트웨이를 사용하여 PTU 제한에 도달할 때 TPM 배포로 요청을 라우팅합니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
+ "text": "VM + 라이선스 부분 할인(ahub + 3YRI)은 약 70% 할인입니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "올바른 작업에 적합한 모델을 선택하십시오. 속도, 응답 품질 및 출력 복잡성 간에 적절한 절충점이 있는 모델 선택",
- "waf": "공연"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
+ "text": "플랫 사이징보다는 VMSS를 사용하여 수요에 맞추는 것이 좋습니다",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
+ "text": "AKS 자동 크기 조정기를 사용하여 클러스터 사용량과 일치시킵니다(Pod 요구 사항이 스케일러와 일치하는지 확인).",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "text": "해당하는 경우 복구 지점을 자격 증명 모음 보관으로 이동(유효성 검사)Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "text": "가능한 경우 대체와 함께 스폿 VM을 사용하는 것이 좋습니다. 클러스터의 자동 종료를 고려합니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
+ "text": "함수 - 연결 재사용",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
+ "text": "함수 - 로컬에 데이터 캐시",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
+ "text": "기능 - 콜드 스타트 - '패키지에서 실행' 기능을 사용합니다. 이렇게 하면 코드가 단일 zip 파일로 다운로드됩니다. 예를 들어, 이것은 많은 노드 모듈이 있는 Javascript 함수를 크게 개선할 수 있습니다. 언어별 도구를 사용하여 패키지 크기를 줄입니다(예: 트리 쉐이킹 Javascript 애플리케이션).",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "text": "기능 - 기능을 따뜻하게 유지",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
+ "text": "다른 함수와 함께 자동 크기 조정을 사용하는 경우 모든 리소스에 대한 모든 자동 크기 조정을 구동하는 것이 있을 수 있으므로 별도의 소비 계획으로 이동하는 것이 좋습니다(CPU에 대한 더 높은 계획 고려).",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
+ "text": "지정된 계획의 함수 앱은 모두 함께 크기가 조정되므로 크기 조정과 관련된 모든 문제는 계획의 모든 앱에 영향을 줄 수 있습니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
+ "text": "'대기 시간'에 대한 요금이 청구되나요? 이 질문은 일반적으로 비동기 작업을 수행하고 결과를 기다리는 C # 함수 (예 : await Task.Delay(1000) 또는 await client )의 컨텍스트에서 묻습니다. GetAsync('http://google.com')입니다. 대답은 '예'입니다 - GB 초 계산은 함수의 시작 및 종료 시간과 해당 기간 동안의 메모리 사용량을 기반으로 합니다. CPU 작업 측면에서 해당 시간 동안 실제로 발생하는 일은 계산에 포함되지 않습니다. 이 규칙의 한 가지 예외는 지속성 함수를 사용하는 경우입니다. 오케스트레이터 함수에서 대기하는 데 소요된 시간에 대해서는 요금이 청구되지 않습니다.가능한 경우 수요 형성 기술을 적용합니다(개발 환경?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "text": "Frontdoor - 기본 홈페이지 끄기앱의 애플리케이션 설정에서 AzureWebJobsDisableHomepage를 true로 설정합니다. 이렇게 하면 PoP에 204(콘텐츠 없음)가 반환되므로 헤더 데이터만 반환됩니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "text": "Frontdoor 프론트도어 - 아무것도 반환하지 않는 무언가로 라우팅합니다. 함수, 함수 프록시를 설정하거나 WebApp에서 200(정상)을 반환하고 콘텐츠를 보내지 않거나 최소한으로 보내는 경로를 추가합니다. 이것의 장점은 호출될 때 로그아웃할 수 있다는 것입니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "text": "덜 사용되는 데이터에 대한 보관 계층 고려",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "text": "크기가 계층과 일치하지 않는 디스크 크기를 확인합니다(예: 513GiB 디스크는 P30(1TiB)를 지불하고 크기 조정을 고려합니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "text": "가능하면 프리미엄 또는 울트라 대신 표준 SSD를 사용하는 것이 좋습니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "text": "스토리지 계정의 경우 선택한 계층이 트랜잭션 요금을 합산하지 않는지 확인합니다(다음 계층으로 이동하는 것이 더 저렴할 수 있음).",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "text": "ASR의 경우 RPO/RTO 및 복제 처리량이 허용하는 경우 표준 SSD 디스크를 사용하는 것이 좋습니다",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "text": "스토리지 계정: 핫 계층 및/또는 GRS 필요 확인",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "text": "디스크 - 모든 곳에서 프리미엄 SSD 디스크 사용의 유효성을 검사합니다. 예를 들어 비프로덕션은 표준 SSD 또는 주문형 프리미엄 SSD로 교환할 수 있습니다. ",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "text": "예산을 만들어 비용을 관리하고 이해 관계자에게 지출 이상 및 초과 지출 위험을 자동으로 알리는 경고를 만듭니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "text": "추가 데이터 분석을 위해 비용 데이터를 스토리지 계정으로 내보냅니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "text": "리소스를 사용하지 않을 때 일시 중지하여 전용 SQL 풀에 대한 비용을 제어합니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "text": "서버리스 Apache Spark 자동 일시 중지 기능을 활성화하고 그에 따라 제한 시간 값을 설정합니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "text": "다양한 크기의 Apache Spark 풀 정의를 여러 개 만듭니다.",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "text": "사전 구매 플랜으로 1년 동안 Azure Synapse SCU(커밋 단위)를 구매하여 Azure Synapse Analytics 비용을 절감하세요.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
+ "text": "인터럽트 가능한 작업에 스폿 VM 사용: 할인된 가격으로 입찰 및 구매할 수 있는 VM으로, 중요하지 않은 워크로드에 비용 효율적인 솔루션을 제공합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "text": "모든 VM의 적절한 크기 조정",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "text": "VM 크기를 정규화된 최신 크기로 바꾸기",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "적절한 크기 조정 VM - 사용량을 5% 미만으로 모니터링하는 것으로 시작한 다음 최대 40%까지 작업",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "애플리케이션을 컨테이너화하면 VM 밀도를 개선하고 확장 비용을 절감할 수 있습니다",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "비용"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub는 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "낮다",
+ "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hubs 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Event Hubs 네임스페이스를 구성할 수 있습니다. Event Hubs 네임스페이스에 최소 버전의 TLS가 필요한 경우 이전 버전으로 수행된 모든 요청이 실패합니다. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Event Hubs 네임스페이스를 만들 때 네임스페이스에 대해 RootManageSharedAccessKey라는 정책 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 응용 프로그램에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure 리소스에 대한 관리 ID는 Azure VM(Virtual Machines), 함수 앱, Virtual Machine Scale Sets 및 기타 서비스에서 실행되는 애플리케이션에서 Azure AD 자격 증명을 사용하여 Event Hubs 리소스에 대한 액세스 권한을 부여할 수 있습니다. Azure AD 인증과 함께 Azure 리소스에 대한 관리 ID를 사용하면 클라우드에서 실행되는 애플리케이션에 자격 증명을 저장하지 않아도 됩니다. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"severity": "보통",
- "text": "미세 조정으로 모델 성능이 향상되었는지 여부를 파악하기 위해 미세 조정 없이 성능에 대한 기준이 있습니다.",
- "waf": "공연"
+ "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Event Hub에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "낮다",
- "text": "여러 지역에 여러 OAI 인스턴스 배포",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "권한을 만들 때 Azure Event Hub에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Event Hub의 사용 권한은 개별 리소스 수준(예: 소비자 그룹, 이벤트 허브 엔터티, 이벤트 허브 네임스페이스 등)으로 범위를 지정할 수 있으며 범위가 지정되어야 합니다.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
+ "severity": "높다",
+ "text": "최소 권한 데이터 평면 RBAC 사용",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub 리소스 로그에는 작업 로그, 가상 네트워크 및 Kafka 로그가 포함됩니다. 런타임 감사 로그는 Event Hubs의 모든 데이터 평면 액세스 작업(예: 이벤트 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그, 런타임 감사 로그 및 Kafka 로그와 같은 메트릭 및 로그를 캡처합니다.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure Event Hub는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Event Hub 간의 트래픽이 Microsoft 백본 네트워크를 통해 트래버스할 수 있습니다. 또한 퍼블릭 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "프라이빗 엔드포인트를 사용하여 Azure Event Hub에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 또는 IPv4 주소 범위 집합으로만 추가로 제한할 수 있습니다. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "특정 IP 주소 또는 범위에서 Azure Event Hub 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
+ "severity": "보통",
+ "text": "FTA 탄력성 핸드북 활용",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": " 영역 사용 지역의 프리미엄, 전용 또는 표준 SKU를 사용하여 포털에서 만든 새 EH 네임스페이스에 대해 자동으로 설정됩니다. EH 메타데이터와 이벤트 데이터 자체는 모두 영역 간에 복제됩니다",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"severity": "높다",
- "text": "APIM과 같은 게이트웨이 패턴을 사용하여 재시도 및 상태 확인 구현Implement retry & healthchecks with gateway pattern like APIM",
+ "text": "지역적으로 적용 가능한 경우 가용성 영역 활용Leverage Availability Zones if regionally applicable",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "보통",
- "text": "워크로드에 대한 TPM 및 RPM의 적절한 할당량이 있는지 확인합니다.",
+ "text": "예측 가능한 성능을 위해 프리미엄 또는 전용 SKU 사용",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "기본 제공 지역 재해 복구 기능을 사용하도록 설정하면 네임스페이스(Event Hubs, 소비자 그룹 및 설정)의 전체 구성이 기본 네임스페이스에서 보조 네임스페이스로 지속적으로 복제되며, 언제든지 한 번만 장애 조치(failover)를 주 네임스페이스에서 보조 네임스페이스로 이동할 수 있습니다. 활성/수동 기능은 애플리케이션 구성을 변경할 필요 없이 실패한 Azure 지역에서 더 쉽게 복구하고 중단할 수 있도록 설계되었습니다",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
+ "severity": "높다",
+ "text": "Active Passive 구성을 사용하여 지역 재해 복구 계획Plan for Geo Disaster Recovery using Active Passive configuration",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "다운된 지역에서 이벤트 데이터의 중단 또는 손실을 허용할 수 없는 DR 구성에 사용해야 합니다. 이러한 경우 복제 지침을 따르고 기본 제공 지역 재해 복구 기능(활성/수동)을 사용하지 마세요. 액티브/액티브를 사용하여 서로 다른 지역 및 네임스페이스에서 여러 Event Hubs를 유지 관리하면 허브 간에 이벤트가 복제됩니다",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"severity": "보통",
- "text": "HAI 도구 키트 지침의 고려 사항을 검토하고 slution에 대한 이러한 상호 작용 방법을 적용합니다",
- "waf": "운영 우수성"
+ "text": "Business Critical Applications의 경우 Active Active 구성을 사용합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "보통",
- "text": "미세 조정이 사용되는 경우 지역 간에 별도의 미세 조정된 모델을 배포합니다.",
+ "text": "복원력 있는 Event Hubs 설계",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "낮다",
+ "text": "모범 사례는 기준 고가용성 영역 중복 웹 애플리케이션 아키텍처를 참조하세요.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "보통",
- "text": "중요한 데이터를 정기적으로 백업 및 복제하여 데이터 손실 또는 시스템 장애 발생 시 데이터 가용성과 복구 가능성을 보장합니다. Azure의 백업 및 재해 복구 서비스를 활용하여 데이터를 보호하세요.",
+ "text": "프리미엄 및 표준 계층을 사용합니다. 이러한 계층은 스테이징 슬롯 및 자동 백업을 지원합니다.",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
"severity": "높다",
- "text": "SLA를 갖도록 Azure AI 검색 서비스 계층을 선택해야 합니다. ",
+ "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(프리미엄 v2 또는 v3 계층 필요)",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "상태 확인 구현",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "Azure App Service에 대한 백업 및 복원 모범 사례를 참조하세요.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "Azure App Service 안정성 모범 사례 구현",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "severity": "낮다",
+ "text": "App Service 앱을 다른 지역으로 이동하는 방법을 숙지합니다. 재해가 발생하는 동안",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "Azure App Service의 안정성 지원 숙지",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "App Service 계획에서 실행되는 Function Apps에 대해 \"Always On\"이 사용하도록 설정되어 있는지 확인합니다.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "상태 검사를 사용하여 App Service 인스턴스 모니터링Monitor App Service instances using Health checks",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "Application Insights 가용성 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"severity": "낮다",
- "text": "임베딩을 생성하기 전에 데이터 및 민감도를 분류하고 Microsoft Purview를 사용하여 레이블을 지정하고 생성된 임베딩을 동일한 민감도 및 분류로 처리해야 합니다",
- "waf": "안전"
+ "text": "Application Insights 표준 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Key Vault를 사용하여 애플리케이션에 필요한 모든 비밀을 저장합니다. Key Vault는 비밀을 저장하기 위한 안전하고 감사된 환경을 제공하며 Key Vault SDK 또는 App Service Key Vault 참조를 통해 App Service와 잘 통합됩니다.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"severity": "높다",
- "text": "BYOK(옵션)를 사용한 SSE/디스크 암호화로 RAG에 사용되는 데이터 암호화",
+ "text": "Key Vault를 사용하여 비밀 저장",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "관리 ID를 사용하여 Key Vault SDK를 사용하거나 App Service Key Vault 참조를 통해 Key Vault에 연결합니다.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"severity": "높다",
- "text": "데이터 소스 간 전송 중인 데이터, RAG(Retrieval-Augmented Generation) 및 LLM 통신에 사용되는 AI 검색에 TLS가 적용되는지 확인합니다.",
+ "text": "관리 ID를 사용하여 Key Vault에 연결",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service TLS 인증서를 Key Vault에 저장합니다.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
"severity": "높다",
- "text": "RBAC를 사용하여 Azure OpenAI 서비스에 대한 액세스를 관리합니다. 사용자에게 적절한 권한을 할당하고 사용자의 역할과 책임에 따라 액세스를 제한합니다.",
+ "text": "Key Vault를 사용하여 TLS 인증서를 저장합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "중요한 정보를 처리하는 시스템은 격리해야 합니다. 이렇게 하려면 별도의 App Service 계획 또는 App Service Environment를 사용하고 다른 구독 또는 관리 그룹을 사용하는 것이 좋습니다.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"severity": "보통",
- "text": "데이터 암호화, 마스킹 또는 수정 기술을 구현하여 비프로덕션 환경에서 또는 테스트 또는 문제 해결을 위해 데이터를 공유할 때 민감한 데이터를 숨기거나 난독화된 값으로 대체합니다.",
+ "text": "민감한 정보를 처리하는 시스템 격리",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Azure Defender를 활용하여 보안 위협을 탐지 및 대응하고 의심스러운 활동 또는 위반을 식별하기 위한 모니터링 및 경고 메커니즘을 설정합니다. 고급 위협 탐지 및 대응을 위해 Azure Sentinel 활용",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service의 로컬 디스크는 암호화되지 않으며 중요한 데이터를 저장해서는 안 됩니다. (예: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "로컬 디스크에 중요한 데이터를 저장하지 마십시오.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "인증된 웹 애플리케이션의 경우 Azure AD 또는 Azure AD B2C와 같이 잘 설정된 ID 공급자를 사용합니다. 선택한 애플리케이션 프레임워크를 활용하여 이 공급자와 통합하거나 App Service 인증/권한 부여 기능을 사용합니다.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
"severity": "보통",
- "text": "규정 준수 규정을 준수하기 위해 데이터 보존 및 폐기 정책을 수립합니다. 더 이상 필요하지 않은 데이터에 대한 안전한 삭제 방법을 구현하고 데이터 보존 및 폐기 활동에 대한 감사 추적을 유지 관리합니다.",
+ "text": "인증에 설정된 ID 공급자 사용",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "잘 관리되고 안전한 DevOps 배포 파이프라인과 같이 제어되고 신뢰할 수 있는 환경에서 App Service에 코드를 배포합니다. 이렇게 하면 버전이 제어되지 않고 악성 호스트에서 배포되는 것으로 확인되지 않은 코드를 방지할 수 있습니다.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"severity": "높다",
- "text": "Content Safety를 사용하여 Prompt shields 및 groundedness detection 구현 ",
- "waf": "운영 우수성"
+ "text": "신뢰할 수 있는 환경에서 배포",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "FTP/FTPS 및 WebDeploy/SCM 모두에 대한 기본 인증을 사용 안함으로 설정합니다. 이렇게 하면 이러한 서비스에 대한 액세스가 비활성화되고 배포에 Azure AD 보안 엔드포인트가 사용됩니다. SCM 사이트는 Azure AD 자격 증명을 사용하여 열 수도 있습니다.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"severity": "높다",
- "text": "개인 정보 보호 제어를 구현하고 데이터 처리 활동에 필요한 동의 또는 권한을 얻어 GDPR 또는 HIPAA와 같은 관련 데이터 보호 규정을 준수하도록 합니다.",
+ "text": "기본 인증 사용 안 함",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "데이터 보안 모범 사례, 데이터 안전한 처리의 중요성, 데이터 침해와 관련된 잠재적 위험에 대해 직원을 교육합니다. 데이터 보안 프로토콜을 성실히 따르도록 권장합니다.",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "가능한 경우 관리 ID를 사용하여 Azure AD 보안 리소스에 연결합니다. 이렇게 할 수 없는 경우 Key Vault에 비밀을 저장하고 대신 관리 ID를 사용하여 Key Vault에 연결합니다.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "관리 ID를 사용하여 리소스에 연결",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 관리 ID를 사용하여 끌어옵니다.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"severity": "높다",
- "text": "생산 데이터를 개발 및 테스트 데이터와 분리합니다. 프로덕션에서는 실제 민감한 데이터만 사용하고 개발 및 테스트 환경에서는 익명 또는 합성 데이터를 활용합니다.",
+ "text": "관리 ID를 사용하여 컨테이너 끌어오기",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service의 진단 설정을 구성하면 모든 원격 분석을 로깅 및 모니터링의 중앙 대상으로 Log Analytics에 보낼 수 있습니다. 이를 통해 HTTP 로그, 애플리케이션 로그, 플랫폼 로그 등과 같은 App Service의 런타임 활동을 모니터링할 수 있습니다.",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "보통",
- "text": "데이터 민감도 수준이 다양하다면 각 수준에 대해 별도의 인덱스를 만드는 것이 좋습니다. 예를 들어, 일반 데이터에 대한 인덱스와 민감한 데이터에 대한 인덱스가 있을 수 있으며, 각각 다른 액세스 프로토콜에 의해 제어됩니다",
+ "text": "Log Analytics에 App Service 런타임 로그 보내기Send App Service runtime logs to Log Analytics",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "활동 로그를 Log Analytics에 로깅 및 모니터링의 중앙 대상으로 보내도록 진단 설정을 지정합니다. 이렇게 하면 App Service 리소스 자체에서 컨트롤 플레인 작업을 모니터링할 수 있습니다.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "보통",
- "text": "한 단계 더 나아가 중요한 데이터 세트를 서비스의 다른 인스턴스에 배치합니다. 각 인스턴스는 고유한 특정 RBAC 정책 집합으로 제어할 수 있습니다",
+ "text": "Log Analytics에 App Service 활동 로그 보내기Send App Service activity logs to Log Analytics",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "지역 VNet 통합, 네트워크 보안 그룹 및 UDR의 조합을 사용하여 아웃바운드 네트워크 액세스를 제어합니다. 트래픽은 Azure Firewall과 같은 NVA로 라우팅되어야 합니다. 방화벽의 로그를 모니터링해야 합니다.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "아웃바운드 네트워크 액세스를 제어해야 함",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "VNet 통합을 사용하고 VNet NAT Gateway 또는 NVA와 같은 Azure Firewall을 사용하여 안정적인 아웃바운드 IP를 제공할 수 있습니다. 이렇게 하면 필요한 경우 수신 당사자가 IP를 기반으로 허용 목록을 만들 수 있습니다. Azure 서비스에 대한 통신의 경우 IP 주소에 의존할 필요가 없는 경우가 많으며 서비스 엔드포인트와 같은 메커니즘을 대신 사용해야 합니다. (또한 수신 끝에서 프라이빗 엔드포인트를 사용하면 SNAT가 발생하지 않고 안정적인 아웃바운드 IP 범위를 제공합니다.)",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
+ "severity": "낮다",
+ "text": "인터넷 주소에 대한 아웃바운드 통신을 위한 안정적인 IP 보장",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service 액세스 제한, 서비스 엔드포인트 또는 프라이빗 엔드포인트의 조합을 사용하여 인바운드 네트워크 액세스를 제어합니다. 웹앱 자체 및 SCM 사이트에 대해 서로 다른 액세스 제한이 필요하고 구성될 수 있습니다.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "높다",
- "text": "민감한 정보에서 생성된 임베딩과 벡터는 그 자체로 민감하다는 점을 인식해야 합니다. 이 데이터에는 원본 자료와 동일한 보호 조치가 제공되어야 합니다",
+ "text": "인바운드 네트워크 액세스를 제어해야 합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Application Gateway 또는 Azure Front Door와 같은 Web Application Firewall을 사용하여 악의적인 인바운드 트래픽으로부터 보호합니다. WAF의 로그를 모니터링해야 합니다.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"severity": "높다",
- "text": "임베딩 및 벡터가 있는 데이터 저장소에 RBAC를 적용하고 역할의 액세스 요구 사항에 따라 액세스 범위를 지정합니다.",
+ "text": "App Service 앞에서 WAF 사용Use a WAF in front of App Service",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "WAF에 대한 액세스만 잠궈 WAF를 우회할 수 없는지 확인합니다. 액세스 제한, 서비스 엔드포인트 및 프라이빗 엔드포인트의 조합을 사용합니다.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "높다",
- "text": "AI 서비스에 대한 프라이빗 엔드포인트를 구성하여 네트워크 내 서비스 액세스를 제한합니다.",
+ "text": "WAF가 우회되지 않도록 방지",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service 구성에서 최소 TLS 정책을 1.2로 설정합니다.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "최소 TLS 정책을 1.2로 설정합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "HTTPS만 사용하도록 App Service를 구성합니다. 이로 인해 App Service가 HTTP에서 HTTPS로 리디렉션됩니다. 코드 또는 WAF에서 HSTS(HTTP Strict Transport Security)를 사용하여 HTTPS를 통해서만 사이트에 액세스해야 함을 브라우저에 알리는 것이 좋습니다.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "HTTPS만 사용",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "CORS 구성에서 와일드카드를 사용하면 모든 원본이 서비스에 액세스할 수 있으므로 CORS의 목적에 어긋나므로 사용하지 마세요. 특히 서비스에 액세스할 수 있을 것으로 예상되는 원본만 허용합니다.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
"severity": "높다",
- "text": "Azure Firewall 및 UDR을 사용하여 엄격한 인바운드 및 아웃바운드 트래픽 제어를 적용하고 외부 통합 지점을 제한합니다.",
+ "text": "와일드카드는 CORS에 사용할 수 없습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "원격 디버깅은 서비스에서 추가 포트를 열어 공격 노출 영역을 증가시키므로 프로덕션에서 켜면 안 됩니다. 서비스는 48시간 후에 자동으로 원격 디버깅을 설정합니다.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
"severity": "높다",
- "text": "네트워크 세분화 및 액세스 제어를 구현하여 LLM 애플리케이션에 대한 액세스를 인증된 사용자 및 시스템으로만 제한하고 측면 이동을 방지합니다.",
+ "text": "원격 디버깅 끄기",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "App Service용 Defender를 사용하도록 설정합니다. 이는 다른 위협 중에서도 알려진 악성 IP 주소에 대한 통신을 탐지합니다. 작업의 일부로 App Service용 Defender의 권장 사항을 검토합니다.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"severity": "보통",
- "text": "LLMLingua 또는 gprtrim과 같은 프롬프트 압축 도구 사용",
- "waf": "비용 최적화"
+ "text": "클라우드용 Defender 사용 - App Service용 Defender",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "LLM 애플리케이션에서 사용하는 API 및 엔드포인트가 관리 ID, API 키 또는 OAuth와 같은 인증 및 권한 부여 메커니즘으로 적절하게 보호되어 무단 액세스를 방지해야 합니다.",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure는 네트워크에서 DDoS 기본 보호를 제공하며, 정상적인 트래픽 패턴을 학습하고 비정상적인 동작을 감지할 수 있는 지능형 DDoS 표준 기능으로 개선할 수 있습니다. DDoS 표준은 Virtual Network에 적용되므로 Application Gateway 또는 NVA와 같은 앱 앞의 네트워크 리소스에 대해 구성해야 합니다.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
+ "severity": "보통",
+ "text": "WAF VNet에서 DDOS 보호 표준 사용Enable DDOS Protection Standard on the WAF VNet",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 프라이빗 엔드포인트 및 앱 설정 'WEBSITE_PULL_IMAGE_OVER_VNET'를 사용하여 Azure Container Registry에서 가상 네트워크를 통해 끌어옵니다.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"severity": "보통",
- "text": "다단계 인증(multi-factor authentication)과 같은 강력한 최종 사용자 인증 메커니즘을 적용하여 LLM 애플리케이션 및 관련 네트워크 리소스에 대한 무단 액세스를 방지합니다.",
+ "text": "Virtual Network를 통해 컨테이너 끌어오기",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "참여의 침투 테스트 규칙에 따라 웹 응용 프로그램에 대한 침투 테스트를 수행합니다.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"severity": "보통",
- "text": "네트워크 모니터링 도구를 구현하여 의심스럽거나 악의적인 활동에 대한 네트워크 트래픽을 탐지하고 분석합니다. 로깅을 활성화하여 네트워크 이벤트를 캡처하고 보안 사고 발생 시 포렌식 분석을 용이하게 합니다.",
+ "text": "침투 테스트 수행",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "DevSecOps 사례에 따라 취약성을 검증하고 검사한 신뢰할 수 있는 코드를 배포합니다.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"severity": "보통",
- "text": "보안 감사 및 침투 테스트를 수행하여 LLM 애플리케이션의 네트워크 인프라에서 네트워크 보안 약점 또는 취약성을 식별하고 해결합니다.",
+ "text": "유효성이 검사된 코드 배포",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "높다",
+ "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
"severity": "낮다",
- "text": "Azure AI 서비스는 더 나은 관리를 위해 적절하게 태그가 지정됩니다.",
- "waf": "운영 우수성"
+ "text": "AKS Windows 워크로드에 필요한 경우 HostProcess 컨테이너를 사용할 수 있습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
"severity": "낮다",
- "text": "Azure AI Service 계정은 조직의 명명 규칙을 따릅니다.",
- "waf": "운영 우수성"
+ "text": "이벤트 기반 워크로드를 실행하는 경우 KEDA 사용Use KEDA if running event-driven workloads",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Azure AI Services 리소스의 진단 로그를 사용하도록 설정해야 함",
- "waf": "운영 우수성"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "Dapr을 사용하여 마이크로 서비스 개발 용이",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"severity": "높다",
- "text": "키 액세스(로컬 인증)는 보안을 위해 사용하지 않도록 설정하는 것이 좋습니다. 키 기반 액세스를 사용하지 않도록 설정하면 Microsoft Entra ID가 유일한 액세스 방법이 되어 최소 권한 원칙과 세분화된 제어를 유지할 수 있습니다. ",
- "waf": "안전"
+ "text": "SLA 지원 AKS 제품 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Azure Key Vault를 사용하여 키를 안전하게 저장하고 관리하세요. LLM 애플리케이션의 코드 내에 중요한 키를 하드 코딩하거나 포함하지 않도록 하고 관리 ID를 사용하여 Azure Key Vault에서 안전하게 검색합니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "Pod 및 배포 정의에서 중단 예산 사용Use Disruption Budgets in your pod and deployment definitions",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"severity": "높다",
- "text": "Azure Key Vault에 저장된 키를 정기적으로 회전하고 만료하여 무단 액세스의 위험을 최소화합니다.",
- "waf": "안전"
+ "text": "개인 레지스트리를 사용하는 경우 여러 지역에 이미지를 저장하도록 지역 복제를 구성합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "tiktoken을 사용하여 대화 모드에서 토큰 최적화를 위한 토큰 크기 이해",
- "waf": "비용 최적화"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "kubecost와 같은 외부 애플리케이션을 사용하여 다른 사용자에게 비용 할당",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "보안 코딩 관행에 따라 주입 공격, XSS(교차 사이트 스크립팅) 또는 보안 구성 오류와 같은 일반적인 취약성을 방지합니다",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "축소 모드를 사용하여 노드 삭제/할당 취소",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "LLM 라이브러리와 다른 시스템 컴포넌트를 정기적으로 업데이트하고 패치하는 프로세스를 설정합니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "필요한 경우 AKS 클러스터에서 다중 인스턴스 분할 GPU 사용",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "Azure OpenAI 또는 기타 LLM 사용 약관, 정책 및 지침, 허용되는 사용 사례 준수",
- "waf": "운영 우수성"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "개발/테스트 클러스터를 실행하는 경우 NodePool 시작/중지를 사용합니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"severity": "보통",
- "text": "기본 모델과 미세 조정된 모델 및 토큰 단계 크기의 비용 차이를 이해합니다.",
- "waf": "비용 최적화"
+ "text": "Kubernetes용 Azure Policy를 사용하여 클러스터 규정 준수 보장",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "높다",
- "text": "가능한 경우 호출당 오버헤드를 최소화하여 전체 비용을 줄일 수 있는 일괄 처리 요청. 배치 크기를 최적화해야 합니다.",
- "waf": "비용 최적화"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "사용자/시스템 노드 풀이 있는 컨트롤 플레인에서 응용 프로그램 분리",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "모델 사용을 모니터링하는 비용 추적 시스템을 설정하고 해당 정보를 사용하여 모델 선택 및 프롬프트 크기를 알립니다",
- "waf": "비용 최적화"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "시스템 nodepool에 taint를 추가하여 전용으로 만듭니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"severity": "보통",
- "text": "모델 응답당 토큰 수에 대한 최대 제한을 설정합니다. 유효한 응답에 사용할 수 있을 만큼 충분히 큰지 확인하기 위해 크기를 최적화합니다",
- "waf": "비용 최적화"
+ "text": "이미지에 개인 레지스트리(예: ACR) 사용",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"severity": "보통",
- "text": "안정성을 위한 AI 검색 설정에 대해 제공된 지침을 검토합니다.",
- "waf": "운영 우수성"
+ "text": "이미지에서 취약성 검사",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "AI Search Vector 스토리지 계획 및 관리",
- "waf": "운영 우수성"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "앱 분리 요구 사항 정의(네임스페이스/노드 풀/클러스터)",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"severity": "보통",
- "text": "LLMOps 사례를 적용하여 GenAI 애플리케이션의 라이프사이클 관리를 자동화합니다.",
- "waf": "운영 우수성"
+ "text": "CSI 비밀 저장소 드라이버를 사용하여 Azure Key Vault에 비밀 저장",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"severity": "높다",
- "text": "청구 모델 사용 평가 - PAYG 대 PTU",
- "waf": "비용 최적화"
+ "text": "클러스터에 서비스 주체를 사용하는 경우 주기적으로(예: 분기별) 자격 증명을 새로 고칩니다",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"severity": "보통",
- "text": "모델 버전 간에 전환할 때 프롬프트와 응용 프로그램의 품질을 평가합니다.",
- "waf": "운영 우수성"
+ "text": "필요한 경우 키 관리 서비스 etcd 암호화를 추가합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "GenAI 앱을 평가, 모니터링 및 개선하여 근거, 관련성, 정확성, 일관성, 유창성 등의 기능을 제공합니다.",
- "waf": "운영 우수성"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 AKS용 기밀 컴퓨팅을 사용하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"severity": "보통",
- "text": "다양한 검색 매개 변수를 기반으로 Azure AI Search 결과를 평가합니다",
- "waf": "운영 우수성"
+ "text": "컨테이너용 Defender 사용 고려",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
- "severity": "보통",
- "text": "데이터를 사용하여 프롬프트 엔지니어링 및 RAG와 같은 다른 기본 접근 방식을 시도한 경우에만 모델을 미세 조정하여 정확도를 높이는 방법으로 살펴보십시오",
- "waf": "운영 우수성"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "서비스 주체 대신 관리 ID 사용",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"severity": "보통",
- "text": "프롬프트 엔지니어링 기법을 사용하여 LLM 응답의 정확도 향상",
- "waf": "운영 우수성"
+ "text": "AAD와 인증 통합(관리형 통합 사용)",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"severity": "보통",
- "text": "GenAI 애플리케이션을 위한 레드 팀",
+ "text": "관리자 kubeconfig에 대한 액세스 제한(get-credentials --admin)",
"waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"severity": "보통",
- "text": "최종 사용자에게 LLM 응답에 대한 점수 매기기 옵션을 제공하고 이러한 점수를 추적합니다. ",
- "waf": "운영 우수성"
+ "text": "AAD RBAC와 권한 부여 통합",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"severity": "높다",
- "text": "할당량 관리 방법 고려",
- "waf": "비용 최적화"
+ "text": "쿠버네티스에서 RBAC 권한을 제한하기 위해 네임스페이스 사용",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
"severity": "보통",
- "text": "APIM 기반 게이트웨이와 같은 Load Balancer 솔루션을 사용하여 서비스 및 지역 간에 부하와 용량을 분산합니다",
- "waf": "운영 우수성"
+ "text": "Pod ID 액세스 관리의 경우 Azure AD 워크로드 ID(미리 보기)를 사용합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "AKS 비대화형 로그인의 경우 kubelogin(미리 보기)을 사용합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"severity": "보통",
- "text": "'스토리지에 대한 Azure 보안 기준'을 고려합니다.",
+ "text": "AKS 로컬 계정 사용 안 함",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 Just-in-time 클러스터 액세스 구성",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "새로 만든 스토리지 계정은 ARM 배포 모델을 사용하여 생성되므로 RBAC, 감사 등이 모두 활성화됩니다. 구독에 클래식 배포 모델을 사용하는 이전 저장소 계정이 없는지 확인합니다.",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "AKS에 필요한 경우 AAD 조건부 액세스 구성",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아보세요.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "Windows AKS 워크로드에 필요한 경우 gMSA를 구성합니다. ",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"severity": "보통",
- "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
+ "text": "더 세밀하게 제어하려면 관리형 Kubelet ID를 사용하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"severity": "보통",
- "text": "Blob에 대해 '일시 삭제' 사용 안 함",
- "waf": "안전"
+ "text": "AGIC를 사용하는 경우 클러스터 간에 AppGW를 공유하지 마세요",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 복구할 수 있습니다(예: 실수로 삭제한 작업에서 복구).",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"severity": "높다",
- "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
- "waf": "안전"
+ "text": "AKS HTTP 라우팅 추가 기능을 사용하지 말고, 애플리케이션 라우팅 추가 기능과 함께 관리되는 NGINX 수신을 대신 사용합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"severity": "보통",
- "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
- "waf": "안전"
+ "text": "Windows 워크로드의 경우 가속화된 네트워킹을 사용합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 스토리지 계정의 우발적인 삭제를 방지합니다.",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "높다",
- "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
- "waf": "안전"
+ "text": "표준 ALB 사용(기본 ALB와 반대)",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능한'은 실제로 '불가능한'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함되면 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "변경할 수 없는 Blob 고려",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "Azure CNI를 사용하는 경우 NodePools에 다른 서브넷을 사용하는 것이 좋습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하여 모든 데이터 전송이 암호화되고 무결성이 보호되며 서버가 인증되도록 하는 것이 좋습니다. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "프라이빗 엔드포인트(기본 설정) 또는 Virtual Network 서비스 엔드포인트를 사용하여 클러스터에서 PaaS 서비스에 액세스",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 확인합니다. 이 경우 스토리지 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "높다",
- "text": "HTTPS를 적용(HTTP 사용 안 함)할 때 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
- "waf": "안전"
+ "text": "요구 사항에 가장 적합한 CNI 네트워크 플러그 인 선택(Azure CNI 권장)",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "Azure CNI를 사용하는 경우 노드당 최대 Pod 수를 고려하여 서브넷 크기를 적절하게 조정합니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ". 최신 TLS 버전을 적용하면 이전 버전을 사용하는 클라이언트의 요청이 거부됩니다. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "높다",
- "text": "스토리지 계정에 대한 최신 TLS 버전 적용Enforce the latest TLS version for a storage account",
+ "text": "Azure CNI를 사용하는 경우 최대 Pod/노드(기본값 30)를 확인합니다.",
+ "waf": "공연"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "내부 앱의 경우 조직은 방화벽에서 전체 AKS 서브넷을 여는 경우가 많습니다. 이렇게 하면 노드에 대한 네트워크 액세스도 열리고 잠재적으로 Pod에 대한 액세스도 열립니다(Azure CNI를 사용하는 경우). LoadBalancer IP가 다른 서브넷에 있는 경우 앱 클라이언트에서 이 IP만 사용할 수 있어야 합니다. 또 다른 이유는 AKS 서브넷의 IP 주소가 부족한 리소스인 경우 서비스에 해당 IP 주소를 사용하면 클러스터의 최대 확장성이 감소하기 때문입니다.",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "개인 IP LoadBalancer 서비스를 사용하는 경우 AKS 서브넷이 아닌 전용 서브넷을 사용합니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "가능한 경우 Microsoft Entra ID 토큰을 공유 액세스 서명보다 선호해야 합니다",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "높다",
- "text": "Blob 액세스에 Microsoft Entra ID 토큰 사용Use Microsoft Entra ID tokens for blob access",
+ "text": "그에 따라 서비스 IP 주소 범위의 크기를 조정합니다(클러스터 확장성이 제한됨).",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 자체 CNI 플러그인을 추가합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 AKS에서 노드당 공용 IP 구성",
+ "waf": "공연"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"severity": "보통",
- "text": "IaM 권한의 최소 권한",
- "waf": "안전"
+ "text": "수신 컨트롤러를 사용하여 LoadBalancer 유형 서비스를 사용하여 노출하는 대신 웹 기반 앱을 노출합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 대해 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "송신 트래픽 크기 조정을 위해 Azure NAT Gateway를 outboundType으로 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 복사본을 가져왔는지 모니터링할 수 있지만 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시킬 수 없습니다. Entra ID 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "Microsoft Entra ID 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "Azure CNI IP 소모를 방지하기 위해 IP의 동적 할당 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 '언제', '누가', '무엇을' 및 '어떻게' 확인하거나 변경합니다(예: 스토리지 계정 키, 액세스 정책 등).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"severity": "높다",
- "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "키 만료 정책을 사용하면 계정 액세스 키의 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다.",
+ "text": "보안 요구 사항에 필요한 경우 AzFW/NVA를 사용하여 송신 트래픽 필터링",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효성 간격으로 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"severity": "보통",
- "text": "SAS 만료 정책을 구성하는 것이 좋습니다.",
+ "text": "퍼블릭 API 엔드포인트를 사용하는 경우 액세스할 수 있는 IP 주소를 제한합니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 사용 권한을 취소할 수 있는 옵션을 제공합니다. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "요구 사항에 따라 개인 클러스터를 사용합니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "보통",
- "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
+ "text": "Windows 2019 및 2022 AKS 노드의 경우 Calico 네트워크 정책을 사용할 수 있습니다. ",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 가능하지 않은 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "높다",
- "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
+ "text": "Kubernetes 네트워크 정책 옵션 사용(Calico/Azure)",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 가까운 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 Blob에 업로드할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "높다",
- "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
+ "text": "쿠버네티스 네트워크 정책을 사용하여 클러스터 내 보안 강화",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "SAS에 좁은 범위 적용",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "웹 워크로드(UI 또는 API)에 WAF 사용Use a WAF for web workloads (UIs or APIs)",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"severity": "보통",
- "text": "가능한 경우 SAS 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
+ "text": "AKS Virtual Network에서 DDoS 표준 사용Use DDoS Standard in the AKS Virtual Network",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 감안할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
"severity": "낮다",
- "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "SFTP: SFTP 액세스를 위한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
+ "text": "필요한 경우 회사 HTTP 프록시를 추가합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"severity": "보통",
- "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹 앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정하는 경우 CorsRules를 최소 권한으로 유지합니다.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "높다",
- "text": "지나치게 광범위한 CORS 정책 방지",
+ "text": "고급 마이크로서비스 통신 관리를 위해 서비스 메시를 사용하는 것이 좋습니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하도록 하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"severity": "높다",
- "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
- "waf": "안전"
+ "text": "가장 중요한 메트릭에 대한 경고 구성(권장 사항은 Container Insights 참조)",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "어떤 플랫폼 암호화를 사용해야 하는지 확인합니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "Azure Advisor에서 클러스터에 대한 권장 사항을 정기적으로 확인합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "클라이언트 쪽 암호화를 사용해야 하는지 여부를 결정합니다.",
- "waf": "안전"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "AKS 자동 인증서 회전 사용",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "리소스 그래프 탐색기(리소스 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"severity": "높다",
- "text": "공용 Blob 익명 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
- "waf": "안전"
+ "text": "kubernetes 버전을 주기적으로(예: 분기별) 업그레이드하거나 AKS 자동 업그레이드 기능을 사용하는 정기적인 프로세스가 있습니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
"severity": "높다",
- "text": "성능 및 안정성 향상을 위해 storagev2 계정 유형 활용",
- "waf": "신뢰도"
+ "text": "node-image upgrade를 사용하지 않는 경우 Linux 노드 업그레이드에 kured를 사용합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"severity": "높다",
- "text": "최고의 가용성을 위해 GRS, ZRS 또는 GZRS 스토리지 활용",
- "waf": "신뢰도"
+ "text": "클러스터 노드 이미지를 주기적으로(예: 매주) 업그레이드하는 정기적인 프로세스가 있습니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "장애 조치(failover) 후 쓰기 작업의 경우 고객 관리 장애 조치(failover)를 사용합니다. ",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "gitops를 고려하여 애플리케이션 또는 클러스터 구성을 여러 클러스터에 배포합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "Microsoft 관리 장애 조치(failover) 세부 정보 이해",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "프라이빗 클러스터에서 AKS 명령 호출을 사용하는 것이 좋습니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
- "severity": "보통",
- "text": "일시 삭제 사용",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "계획된 이벤트의 경우 노드 자동 드레인 사용을 고려하십시오.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
- "severity": "보통",
- "text": "Azure Bot Service의 안정성 지원 권장 사항을 따릅니다",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "노드 RG(일명 '인프라 RG')의 운영자가 변경을 수행하지 않도록 자체 거버넌스 관행을 개발합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "severity": "보통",
- "text": "로컬 데이터 레지던시 및 지역 규정 준수를 통해 봇 배포Deploying bots with local data residency and regional compliance",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "사용자 정의 노드 RG (일명 '인프라 RG') 이름 사용",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"severity": "보통",
- "text": "Azure Bot Service는 글로벌 및 지역 서비스 모두에 대해 활성-활성 모드로 실행됩니다. 중단이 발생하면 오류를 감지하거나 서비스를 관리할 필요가 없습니다. Azure Bot Service는 다중 지역 지리적 아키텍처에서 자동 장애 조치(failover) 및 자동 복구를 자동으로 수행합니다. EU 봇 지역 서비스의 경우 Azure Bot Service는 중복성을 보장하기 위해 활성/활성 복제가 있는 유럽 내 두 개의 전체 지역을 제공합니다. 글로벌 봇 서비스의 경우 사용 가능한 모든 지역/지역을 글로벌 공간으로 제공할 수 있습니다.",
- "waf": "신뢰도"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "높다",
- "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 기능 호스팅 계획을 선택하십시오.",
- "waf": "신뢰도"
+ "text": "YAML 매니페스트에서 더 이상 사용되지 않는 Kubernetes API를 사용하지 마십시오.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "높다",
- "text": "지역적으로 적용 가능한 가용성 영역 활용(소비 계층에는 사용할 수 없음)",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "테인트 Windows 노드",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
- "severity": "보통",
- "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "Windows 컨테이너 패치 수준을 호스트 패치 수준과 동기화된 상태로 유지",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
- "severity": "높다",
- "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "클러스터 수준의 진단 설정을 통해Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "마스터 로그(즉, API 로그)를 Azure Monitor 또는 기본 로그 관리 솔루션으로 보냅니다",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
- "severity": "높다",
- "text": "App Service 계획에서 실행되는 모든 함수 앱에 대해 'Always On'이 사용하도록 설정되어 있는지 확인합니다.",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 nodePool 스냅샷을 사용합니다.",
+ "waf": "비용"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
- "severity": "보통",
- "text": "함수 앱을 자체 스토리지 계정에 페어링합니다. 긴밀하게 결합되지 않는 한 함수 앱에 대한 스토리지 계정을 다시 사용하지 마세요",
- "waf": "신뢰도"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "시간에 민감하지 않은 워크로드에 대한 스폿 노드 풀 고려",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
- "severity": "보통",
- "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 함수 앱 코드를 보호합니다.",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "빠른 버스팅을 위해 AKS 가상 노드 고려",
"waf": "작업"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
- "text": "Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview 의 데이터 수집 규칙",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "Container Insights(또는 Prometheus와 같은 다른 도구)를 사용하여 클러스터 지표 모니터링",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
- "text": "기본 데이터 원본을 찾을 수 없는 백업 인스턴스 확인",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "Container Insights(또는 Telegraf/ElasticSearch와 같은 다른 도구)를 사용하여 클러스터 로그를 저장하고 분석합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "text": "연결되지 않은 서비스(디스크, NIC, IP 주소 등) 삭제 또는 보관",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "노드의 CPU 및 메모리 사용률 모니터링",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
- "text": "중요 업무용 응용 프로그램에 대한 Site Recovery 저장소와 백업 간의 적절한 균형을 고려합니다.",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "Azure CNI를 사용하는 경우 노드당 사용되는 Pod IP의 %를 모니터링합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
- "text": "40개의 서로 다른 로그 분석 작업 영역 간의 지출 및 절감 기회 확인 - 비프로덕션 작업 영역에 대해 서로 다른 보존 및 데이터 수집 사용-인식 및 계층 크기 조정을 위한 일일 한도 만들기 - 일일 한도를 설정하는 경우 한도에 도달할 때 경고를 만드는 것 외에도 특정 비율(예: 90%)에 도달했을 때 알림을 받을 경고 규칙도 만들어야 합니다. - 가능한 경우 작업 영역 변환 고려 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "OS 디스크의 I/O는 중요한 리소스입니다. 노드의 OS가 I/O에서 제한되면 예측할 수 없는 동작이 발생할 수 있으며, 일반적으로 노드가 NotReady로 선언됩니다",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "노드에서 OS 디스크 큐 크기 모니터링Monitor OS disk queue depth in nodes",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
- "text": "제거 로그 정책 및 자동화 적용(필요한 경우 로그를 콜드 스토리지로 이동할 수 있음)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "AzFW/NVA에서 송신 필터링을 사용하지 않는 경우 표준 ALB 할당 SNAT 포트를 모니터링합니다",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
- "text": "디스크가 실제로 필요한지 확인하고, 그렇지 않은 경우 삭제하십시오. 필요한 경우 더 낮은 스토리지 계층을 찾거나 백업을 사용합니다.",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "AKS 클러스터에 대한 Resource Health 알림 구독Subscribe to resource health notifications for your AKS cluster",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
- "text": "사용자 지정 규칙을 사용하여 사용하지 않는 스토리지를 하위 계층으로 이동하는 것이 좋습니다 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "Pod 규격에서 요청 및 제한 구성",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
- "text": "Advisor가 VM 올바른 크기 조정에 대해 구성되어 있는지 확인합니다. ",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "네임스페이스에 대한 리소스 할당량 적용Enforce resource quotas for namespaces",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "Cost analysys에서 Meter Category Licenses를 검색하여 확인합니다.",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "text": "모든 Windows VM에서 스크립트 실행 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM을 자주 만드는 경우 정책 구현을 고려합니다.",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "구독에 노드 풀을 확장할 수 있는 충분한 할당량이 있는지 확인합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
- "text": " 이미 라이선스가 있는 경우 AHUB에 넣을 수도 https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "Cluster Autoscaler 사용",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
- "text": "유연성 옵션을 사용하여 예약된 VM 제품군 통합(4-5개 이하의 제품군)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "AKS 노드 풀에 대한 노드 구성 사용자 지정",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
- "text": "Azure Reserved Instances 활용: 이 기능을 사용하면 1년 또는 3년 동안 VM을 예약할 수 있으므로 PAYG 가격에 비해 상당한 비용 절감 효과를 얻을 수 있습니다.",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "필요한 경우 Horizontal Pod Autoscaler 사용",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
- "text": "더 큰 디스크만 예약할 수 있습니다 => 1TiB -",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "노드가 클수록 임시 디스크 및 가속화된 네트워킹과 같은 더 높은 성능과 기능을 제공하지만 폭발 반경이 증가하고 크기 조정 세분성이 감소합니다",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "너무 크거나 너무 작지 않은 적절한 노드 크기를 고려합니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
- "text": "적절한 크기 최적화 후",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "확장성을 위해 5,000개 이상의 노드가 필요한 경우 추가 AKS 클러스터를 사용하는 것이 좋습니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "text": "적용 가능한 경우 확인 및 정책/변경 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations 시행",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "AKS 자동화를 위해 EventGrid 이벤트를 구독하는 것이 좋습니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "text": "VM + 라이선스 부분 할인(ahub + 3YRI)은 약 70% 할인입니다.",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "AKS 클러스터에서 장기 실행 작업의 경우 이벤트 종료를 고려합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
- "text": "플랫 사이징보다는 VMSS를 사용하여 수요에 맞추는 것이 좋습니다",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "필요한 경우 AKS 노드에 Azure Dedicated Host를 사용하는 것이 좋습니다",
+ "waf": "공연"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
"service": "AKS",
- "text": "AKS 자동 크기 조정기를 사용하여 클러스터 사용량과 일치시킵니다(Pod 요구 사항이 스케일러와 일치하는지 확인).",
- "waf": "비용"
+ "severity": "높다",
+ "text": "임시 OS 디스크 사용",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
- "text": "해당하는 경우 복구 지점을 자격 증명 모음 보관으로 이동(유효성 검사)Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
+ "severity": "높다",
+ "text": "임시 디스크가 아닌 디스크의 경우 여러 Pod를 실행하는 데 고성능이 필요하고 기본 AKS 로그 회전 임계값을 사용하여 대규모 로그를 생성하므로 많은 Pod/노드를 실행할 때 노드에 높은 IOPS 및 더 큰 OS 디스크를 사용합니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "text": "가능한 경우 대체와 함께 스폿 VM을 사용하는 것이 좋습니다. 클러스터의 자동 종료를 고려합니다.",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
+ "severity": "낮다",
+ "text": "고성능 스토리지 옵션의 경우 AKS에서 Ultra Disks를 사용합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
- "text": "함수 - 연결 재사용",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "클러스터에서 상태를 유지하지 않고 외부(AzStorage, AzSQL, Cosmos 등)에 데이터를 저장합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
- "text": "함수 - 로컬에 데이터 캐시",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "AzFiles 표준을 사용하는 경우 성능상의 이유로 AzFiles 프리미엄 및/또는 ANF를 고려합니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
- "text": "기능 - 콜드 스타트 - '패키지에서 실행' 기능을 사용합니다. 이렇게 하면 코드가 단일 zip 파일로 다운로드됩니다. 예를 들어, 이것은 많은 노드 모듈이 있는 Javascript 함수를 크게 개선할 수 있습니다. 언어별 도구를 사용하여 패키지 크기를 줄입니다(예: 트리 쉐이킹 Javascript 애플리케이션).",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "비용"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
+ "severity": "보통",
+ "text": "Azure 디스크 및 AZ를 사용하는 경우 올바른 영역에 스토리지를 프로비전하기 위해 VolumeBindingMode::WaitForFirstConsumer를 사용하여 LRS 디스크의 영역 내에 노드 풀을 사용하거나 여러 영역에 걸쳐 있는 노드 풀에 ZRS 디스크를 사용하는 것이 좋습니다",
+ "waf": "공연"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
"service": "Azure Functions",
- "text": "기능 - 기능을 따뜻하게 유지",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "비용"
+ "severity": "높다",
+ "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 기능 호스팅 계획을 선택하십시오.",
+ "waf": "신뢰도"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
"service": "Azure Functions",
- "text": "다른 함수와 함께 자동 크기 조정을 사용하는 경우 모든 리소스에 대한 모든 자동 크기 조정을 구동하는 것이 있을 수 있으므로 별도의 소비 계획으로 이동하는 것이 좋습니다(CPU에 대한 더 높은 계획 고려).",
- "waf": "비용"
+ "severity": "높다",
+ "text": "지역적으로 적용 가능한 가용성 영역 활용(소비 계층에는 사용할 수 없음)",
+ "waf": "신뢰도"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
"service": "Azure Functions",
- "text": "지정된 계획의 함수 앱은 모두 함께 크기가 조정되므로 크기 조정과 관련된 모든 문제는 계획의 모든 앱에 영향을 줄 수 있습니다.",
- "waf": "비용"
+ "severity": "보통",
+ "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
+ "waf": "신뢰도"
},
{
"arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
"service": "Azure Functions",
- "text": "'대기 시간'에 대한 요금이 청구되나요? 이 질문은 일반적으로 비동기 작업을 수행하고 결과를 기다리는 C # 함수 (예 : await Task.Delay(1000) 또는 await client )의 컨텍스트에서 묻습니다. GetAsync('http://google.com')입니다. 대답은 '예'입니다 - GB 초 계산은 함수의 시작 및 종료 시간과 해당 기간 동안의 메모리 사용량을 기반으로 합니다. CPU 작업 측면에서 해당 시간 동안 실제로 발생하는 일은 계산에 포함되지 않습니다. 이 규칙의 한 가지 예외는 지속성 함수를 사용하는 경우입니다. 오케스트레이터 함수에서 대기하는 데 소요된 시간에 대해서는 요금이 청구되지 않습니다.가능한 경우 수요 형성 기술을 적용합니다(개발 환경?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "비용"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
- "text": "Frontdoor - 기본 홈페이지 끄기앱의 애플리케이션 설정에서 AzureWebJobsDisableHomepage를 true로 설정합니다. 이렇게 하면 PoP에 204(콘텐츠 없음)가 반환되므로 헤더 데이터만 반환됩니다.",
- "waf": "비용"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "text": "Frontdoor 프론트도어 - 아무것도 반환하지 않는 무언가로 라우팅합니다. 함수, 함수 프록시를 설정하거나 WebApp에서 200(정상)을 반환하고 콘텐츠를 보내지 않거나 최소한으로 보내는 경로를 추가합니다. 이것의 장점은 호출될 때 로그아웃할 수 있다는 것입니다.",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
- "text": "덜 사용되는 데이터에 대한 보관 계층 고려",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
- "text": "크기가 계층과 일치하지 않는 디스크 크기를 확인합니다(예: 513GiB 디스크는 P30(1TiB)를 지불하고 크기 조정을 고려합니다.",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "text": "가능하면 프리미엄 또는 울트라 대신 표준 SSD를 사용하는 것이 좋습니다.",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "text": "스토리지 계정의 경우 선택한 계층이 트랜잭션 요금을 합산하지 않는지 확인합니다(다음 계층으로 이동하는 것이 더 저렴할 수 있음).",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "text": "ASR의 경우 RPO/RTO 및 복제 처리량이 허용하는 경우 표준 SSD 디스크를 사용하는 것이 좋습니다",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
- "text": "스토리지 계정: 핫 계층 및/또는 GRS 필요 확인",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "text": "디스크 - 모든 곳에서 프리미엄 SSD 디스크 사용의 유효성을 검사합니다. 예를 들어 비프로덕션은 표준 SSD 또는 주문형 프리미엄 SSD로 교환할 수 있습니다. ",
- "waf": "비용"
- },
- {
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
- "text": "예산을 만들어 비용을 관리하고 이해 관계자에게 지출 이상 및 초과 지출 위험을 자동으로 알리는 경고를 만듭니다.",
- "waf": "비용"
+ "severity": "높다",
+ "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
- "text": "추가 데이터 분석을 위해 비용 데이터를 스토리지 계정으로 내보냅니다.",
- "waf": "비용"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "Azure Functions",
+ "severity": "높다",
+ "text": "App Service 계획에서 실행되는 모든 함수 앱에 대해 'Always On'이 사용하도록 설정되어 있는지 확인합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "text": "리소스를 사용하지 않을 때 일시 중지하여 전용 SQL 풀에 대한 비용을 제어합니다.",
- "waf": "비용"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
+ "severity": "보통",
+ "text": "함수 앱을 자체 스토리지 계정에 페어링합니다. 긴밀하게 결합되지 않는 한 함수 앱에 대한 스토리지 계정을 다시 사용하지 마세요",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "text": "서버리스 Apache Spark 자동 일시 중지 기능을 활성화하고 그에 따라 제한 시간 값을 설정합니다.",
- "waf": "비용"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
+ "severity": "보통",
+ "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 함수 앱 코드를 보호합니다.",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
- "text": "다양한 크기의 Apache Spark 풀 정의를 여러 개 만듭니다.",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "Azure Spring Apps는 모든 앱에 대해 두 개의 배포를 허용하며, 그 중 하나만 프로덕션 트래픽을 수신합니다. 블루-그린 배포 전략을 통해 가동 중지 시간 제로를 달성할 수 있습니다. 파란색 녹색 배포는 표준 및 엔터프라이즈 계층에서만 사용할 수 있습니다. ADO/GitHub 작업과 함께 CI/CD를 사용하여 배포를 자동화할 수 있습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "text": "사전 구매 플랜으로 1년 동안 Azure Synapse SCU(커밋 단위)를 구매하여 Azure Synapse Analytics 비용을 절감하세요.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "Azure Spring Apps 인스턴스는 애플리케이션에 대해 여러 지역에서 만들 수 있으며 Traffic Manager/Front Door에서 트래픽을 라우팅할 수 있습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "text": "인터럽트 가능한 작업에 스폿 VM 사용: 할인된 가격으로 입찰 및 구매할 수 있는 VM으로, 중요하지 않은 워크로드에 비용 효율적인 솔루션을 제공합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "지원되는 지역에서 Azure Spring Apps는 영역 중복으로 배포할 수 있으며, 이는 인스턴스가 가용성 영역에 자동으로 분산됨을 의미합니다. 이 기능은 Standard 및 Enterprise 계층에서만 사용할 수 있습니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "text": "모든 VM의 적절한 크기 조정",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "앱에 1개 이상의 앱 인스턴스 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "text": "VM 크기를 정규화된 최신 크기로 바꾸기",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "로그, 메트릭 및 추적을 사용하여 Azure Spring Apps를 모니터링합니다. ASA를 Application Insights와 통합하고, 오류를 추적하고, 통합 문서를 만듭니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "적절한 크기 조정 VM - 사용량을 5% 미만으로 모니터링하는 것으로 시작한 다음 최대 40%까지 작업",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "Spring Cloud Gateway에서 자동 크기 조정 설정",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "애플리케이션을 컨테이너화하면 VM 밀도를 개선하고 확장 비용을 절감할 수 있습니다",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "비용"
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "낮다",
+ "text": "표준 소비 및 전용 플랜이 있는 앱에 대해 자동 크기 조정을 사용하도록 설정합니다.",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
+ "severity": "보통",
+ "text": "중요 업무용 앱에 대한 Spring Boot의 상업적 지원을 위해 Enterprise 플랜을 사용합니다. 다른 계층에서는 OSS 지원을 받을 수 있습니다.",
+ "waf": "신뢰도"
},
{
"arm-service": "Microsoft.DataFactory/datafactories",
@@ -8102,1885 +8214,1773 @@
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"severity": "보통",
- "text": "다중 지역 애플리케이션 랜딩 존 및 재해 복구 시나리오를 신속하게 지원할 수 있도록 여러 지역에 Azure 랜딩 존 연결 리소스를 배포합니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "신뢰도"
+ "text": "전역 수준에서 오류 처리 정책 구현",
+ "waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"severity": "보통",
- "text": "다중 테넌트에 대한 명확한 규정 또는 비즈니스 요구 사항이 없는 한 Azure 리소스를 관리하기 위해 하나의 Entra 테넌트를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "text": "모든 API 정책에 요소가 포함되어 있는지 확인합니다.",
"waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "낮다",
- "text": "다중 테넌트 자동화 접근 방식을 사용하여 Microsoft Entra ID 테넌트를 관리합니다.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "정책 조각을 사용하여 여러 API에서 동일한 정책 정의를 반복하지 않도록 합니다.",
"waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
- "severity": "높다",
- "text": "동일한 ID로 다중 테넌트 관리에 Azure Lighthouse를 사용합니다.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "API로 수익을 창출할 계획이라면 '수익 창출 지원' 도움말에서 권장사항을 확인하세요",
"waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
- "severity": "높다",
- "text": "파트너에게 테넌트를 관리할 수 있는 액세스 권한을 부여하는 경우 Azure Lighthouse를 사용합니다.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "비용"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"severity": "높다",
- "text": "클라우드 운영 모델에 맞는 RBAC 모델을 적용합니다. 관리 그룹 및 구독에서 범위를 지정하고 할당합니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "안전"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
- "severity": "보통",
- "text": "모든 계정 유형에 대해 회사 또는 학교 계정 인증 유형만 사용합니다. Microsoft 계정을 사용하지 마십시오.",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "안전"
+ "text": "진단 설정을 사용하도록 설정하여 로그를 Azure Monitor로 내보내기",
+ "waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "보통",
- "text": "그룹만 사용하여 사용 권한을 할당합니다. 그룹 관리 시스템이 이미 있는 경우 Entra ID 전용 그룹에 온-프레미스 그룹을 추가합니다.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "안전"
+ "text": "더 자세한 원격 분석을 위해 Application Insights 사용",
+ "waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "높다",
- "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 Microsoft Entra ID 조건부 액세스 정책을 적용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "안전"
+ "text": "가장 중요한 메트릭에 대한 경고 구성",
+ "waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"severity": "높다",
- "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 다단계 인증을 적용합니다.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "text": "사용자 지정 SSL 인증서가 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되어 있는지 확인합니다",
"waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
- "severity": "보통",
- "text": "Microsoft Entra ID PIM(Privileged Identity Management)을 적용하여 제로 스탠딩 액세스 및 최소 권한을 설정합니다.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
+ "severity": "높다",
+ "text": "Azure AD를 사용하여 API(데이터 평면)에 들어오는 요청 보호",
"waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"severity": "보통",
- "text": "Active Directory Domain Services에서 Entra Domain Services로 전환하려는 경우 모든 워크로드의 호환성을 평가합니다.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "text": "Microsoft Entra ID를 사용하여 개발자 포털에서 사용자 인증",
"waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "보통",
- "text": "Microsoft Entra Domain Services를 사용하는 경우 복제본 세트를 사용합니다. 복제본 세트는 관리되는 도메인의 복원력을 향상시키고 추가 지역에 배포할 수 있도록 합니다. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "신뢰도"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"severity": "보통",
- "text": "Microsoft Entra ID 로그를 플랫폼 중앙 Azure Monitor와 통합합니다. Azure Monitor는 Azure의 로그 및 모니터링 데이터에 대한 단일 정보 소스를 허용하여 조직에 로그 수집 및 보존에 대한 요구 사항을 충족할 수 있는 클라우드 네이티브 옵션을 제공합니다.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "안전"
- },
- {
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
- "severity": "높다",
- "text": "응급 액세스 또는 비상 계정을 구현하여 테넌트 전체 계정 잠금을 방지합니다. MFA는 2024년 10월에 모든 사용자에 대해 기본적으로 설정됩니다. 암호 키(FIDO2)를 사용하거나 MFA에 대한 인증서 기반 인증을 구성하도록 이러한 계정을 업데이트하는 것이 좋습니다. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "text": "제품의 가시성을 제어하기 위해 적절한 그룹을 만듭니다",
"waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"severity": "보통",
- "text": "특별히 필요한 시나리오가 없는 한 Microsoft Entra ID 역할 할당에 온-프레미스 동기화 계정을 사용하지 마세요.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "안전"
+ "text": "백엔드 기능을 사용하여 중복 API 백엔드 구성 제거",
+ "waf": "작업"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"severity": "보통",
- "text": "Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 애플리케이션에 대한 액세스 권한을 부여하는 경우 테넌트당 하나의 인스턴스만 가질 수 있으므로 플랫폼 리소스로 관리합니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "안전"
+ "text": "명명된 값을 사용하여 정책에서 사용할 수 있는 공통 값 저장",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"severity": "보통",
- "text": "최대한의 유연성이 필요한 네트워크 시나리오에는 허브 및 스포크(hub-and-spoke) 네트워크 토폴로지를 사용합니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "안전"
+ "text": "DR의 경우 99.99% SLA를 위해 둘 이상의 지역에 걸쳐 확장된 배포와 함께 프리미엄 계층을 활용합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
- "severity": "높다",
- "text": "ExpressRoute 게이트웨이, VPN 게이트웨이 및 Azure Firewall 또는 파트너 NVA를 포함한 공유 네트워킹 서비스를 중앙 허브 가상 네트워크에 배포합니다. 필요한 경우 DNS 서비스도 배포합니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "비용"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "99.99%의 SLA 증가를 위해 둘 이상의 가용성 영역에 하나 이상의 단위를 배포합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"severity": "높다",
- "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "text": "자동화된 백업 루틴이 있는지 확인",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "보통",
- "text": "파트너 네트워킹 기술 또는 NVA를 배포할 때 파트너 공급업체의 지침을 따릅니다.",
+ "text": "정책을 사용하여 장애 조치 백엔드 URL 및 캐싱을 추가하여 실패한 호출을 줄입니다.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "severity": "낮다",
- "text": "허브 및 스포크 시나리오에서 ExpressRoute와 VPN 게이트웨이 간의 전송이 필요한 경우 Azure Route Server를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "안전"
- },
- {
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
"severity": "낮다",
- "text": "Route Server를 사용하는 경우 Route Server 서브넷에 /27 접두사를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "안전"
+ "text": "고성능 수준에서 기록해야 하는 경우 Event Hubs 정책을 고려합니다",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"severity": "보통",
- "text": "Azure 지역 간에 여러 허브 및 스포크 토폴로지가 있는 네트워크 아키텍처의 경우 허브 VNet 간의 글로벌 가상 네트워크 피어링을 사용하여 지역을 서로 연결합니다.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "text": "제한 정책을 적용하여 초당 요청 수 제어Apply throttling policies to control the number of requests per second",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
"waf": "공연"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"severity": "보통",
- "text": "네트워크용 Azure Monitor를 사용하여 Azure에서 네트워크의 엔드투엔드 상태를 모니터링합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "작업"
+ "text": "부하가 증가할 때 인스턴스 수를 확장하도록 자동 크기 조정 구성Configure autoscaling to scale out the number of instances when the load increases",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"severity": "보통",
- "text": "한 지역에 400개 이상의 스포크 네트워크가 있는 경우 VNet 피어링 제한(500) 및 ExpressRoute를 통해 보급할 수 있는 최대 접두사 수(1000)를 우회하기 위해 추가 허브를 배포합니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "신뢰도"
+ "text": "Azure에 백 엔드 API에 가까운 지역이 없는 자체 호스팅 게이트웨이를 배포합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"severity": "보통",
- "text": "경로 테이블당 경로 수를 400개로 제한합니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "text": "프로덕션 워크로드에 프리미엄 계층을 사용합니다.",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
- "severity": "높다",
- "text": "VNet 피어링을 구성할 때 '원격 가상 네트워크에 대한 트래픽 허용' 설정을 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "다중 리전 모델에서는 Policies를 사용하여 가용성 또는 지연 시간에 따라 리전 백엔드로 요청을 라우팅합니다.",
"waf": "신뢰도"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
"severity": "높다",
- "text": "영역 중복 배포와 함께 표준 Load Balancer SKU를 사용하는 경우 표준 SKU Load Balancer를 선택하면 가용성 영역 및 영역 복원력을 통해 안정성이 향상되어 배포가 영역 및 지역 오류를 견딜 수 있습니다. Basic과 달리 전역 부하 분산을 지원하고 SLA를 제공합니다.",
+ "text": "APIM의 제한에 유의해야 합니다.",
"waf": "신뢰도"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"severity": "높다",
- "text": "부하 분산 장치 백 엔드 풀에 두 개 이상의 인스턴스가 포함되어 있는지 확인하고, 백 엔드에 두 개 이상의 인스턴스를 사용하여 Azure Load Balancer를 배포하면 단일 실패 지점을 방지하고 확장성을 지원할 수 있습니다.",
+ "text": "자체 호스팅 게이트웨이 배포가 복원력이 있는지 확인합니다.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
"severity": "보통",
- "text": "ExpressRoute Direct를 사용하는 경우 조직의 라우터와 MSEE 간의 계층 2 수준에서 트래픽을 암호화하도록 MACsec을 구성합니다. 다이어그램은 흐름에서 이 암호화를 보여 줍니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "안전"
+ "text": "다중 지역 배포를 위해 APIM 앞에서 Azure Front Door 사용Use Azure Front Door in front of APIM for multi-region deployment",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
"severity": "보통",
- "text": "MACsec을 사용할 수 없는 시나리오(예: ExpressRoute Direct를 사용하지 않음)의 경우 VPN Gateway를 사용하여 ExpressRoute 개인 피어링을 통해 IPsec 터널을 설정합니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "VNet(Virtual Network) 내에 서비스 배포Deploy the service within a Virtual Network (VNet)",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
- "severity": "높다",
- "text": "Azure 지역 및 온-프레미스 위치에서 겹치는 IP 주소 공간이 사용되지 않는지 확인합니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "서브넷에 NSG(네트워크 보안 그룹)를 배포하여 APIM에서 들어오고 나가는 트래픽을 제한하거나 모니터링합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"severity": "보통",
- "text": "개인 인터넷(RFC 1918)에 대한 주소 할당 범위의 IP 주소를 사용합니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "text": "프라이빗 엔드포인트를 배포하여 APIM이 VNet에 배포되지 않은 경우 들어오는 트래픽을 필터링합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
- "severity": "높다",
- "text": "IP 주소 공간이 낭비되지 않는지 확인하고 불필요하게 큰 가상 네트워크(예: /16)를 만들지 마세요.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "공연"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
- "severity": "높다",
- "text": "프로덕션 및 재해 복구 사이트에 대해 겹치는 IP 주소 범위를 사용하지 마세요.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "신뢰도"
- },
- {
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"severity": "높다",
- "text": "해당하는 경우 표준 SKU 및 영역 중복 IP를 사용하며, Azure의 공용 IP 주소는 비영역, 영역 또는 영역 중복으로 사용할 수 있는 표준 SKU일 수 있습니다. 영역 중복 IP는 모든 영역에서 액세스할 수 있으므로 단일 영역 오류에 저항하여 더 높은 복원력을 제공합니다. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "신뢰도"
+ "text": "공용 네트워크 액세스 사용 안 함",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
"severity": "보통",
- "text": "Azure의 이름 확인만 필요한 환경의 경우 이름 확인을 위해 위임된 영역(예: 'azure.contoso.com')을 사용하여 Azure 프라이빗 DNS를 확인합니다.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "PowerShell 자동화 스크립트로 관리 간소화",
"waf": "작업"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
"severity": "보통",
- "text": "Azure 및 온-프레미스에서 이름 확인이 필요하고 Active Directory와 같은 기존 엔터프라이즈 DNS 서비스가 없는 환경의 경우 Azure DNS Private Resolver를 사용하여 DNS 요청을 Azure 또는 온-프레미스 DNS 서버로 라우팅합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "안전"
+ "text": "Infrastructure-as-code를 통해 APIM을 구성합니다. Cloud Adaption Framework APIM 랜딩 존 가속기에서 DevOps 모범 사례 검토",
+ "waf": "작업"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
- "severity": "낮다",
- "text": "자체 DNS(예: Red Hat OpenShift)를 요구하고 배포하는 특수 워크로드는 선호하는 DNS 솔루션을 사용해야 합니다.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "더 빠른 API 개발을 위해 Visual Studio Code APIM 확장 사용 촉진",
"waf": "작업"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
- "severity": "높다",
- "text": "Azure DNS에 대한 자동 등록을 사용하도록 설정하여 가상 네트워크 내에 배포된 가상 머신에 대한 DNS 레코드의 수명 주기를 자동으로 관리합니다.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "워크플로에서 DevOps 및 CI/CD 구현",
"waf": "작업"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
"severity": "보통",
- "text": "여러 Azure 지역 간의 DNS 확인을 관리하기 위한 계획과 서비스가 다른 지역으로 장애 조치(failover)되는 경우 계획 구현",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "신뢰도"
+ "text": "클라이언트 인증서 인증을 사용하여 API 보안",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"severity": "보통",
- "text": "Azure Bastion을 사용하여 네트워크에 안전하게 연결합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "text": "클라이언트 인증서 인증을 사용한 보안 백엔드 서비스",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
"severity": "보통",
- "text": "서브넷 /26 이상에서 Azure Bastion을 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "text": "'OWASP API 보안 상위 10개 위협을 완화하기 위한 권장 사항' 문서를 검토하고 API에 적용할 수 있는 항목을 확인합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"severity": "보통",
- "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역 전체에서 글로벌 보호를 제공합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "권한 부여 기능을 사용하여 백엔드 API에 대한 OAuth 2.0 토큰 관리 간소화",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
+ "severity": "높다",
+ "text": "전송 중인 정보를 암호화할 때 최신 TLS 버전을 사용합니다. 가능한 경우 오래되고 불필요한 프로토콜과 암호를 사용하지 않도록 설정합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "낮다",
- "text": "Azure Front Door 및 Azure Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure Front Door에서만 트래픽을 수신하도록 Azure Application Gateway를 잠급니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
+ "severity": "높다",
+ "text": "비밀(명명된 값)이 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되었는지 확인합니다.",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "높다",
- "text": "인바운드 HTTP/S 연결에 WAF 및 기타 역방향 프록시가 필요한 경우 랜딩 존 가상 네트워크 내에 배포하고 보호하고 인터넷에 노출하는 앱과 함께 배포합니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
+ "severity": "보통",
+ "text": "가능할 때마다 관리 ID를 사용하여 다른 Azure 리소스에 인증",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"severity": "높다",
- "text": "Azure DDoS 네트워크 또는 IP 보호 계획을 사용하여 가상 네트워크 내의 공용 IP 주소 엔드포인트를 보호할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "APIM 앞에 Application Gateway를 배포하여 WAF(웹 애플리케이션 방화벽) 사용Use Web Application Firewall (WAF) by deploying Application Gateway in of APIM",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"severity": "높다",
- "text": "예정된 호환성이 손상되는 변경 전에 네트워크 아웃바운드 트래픽 구성 및 전략을 관리하는 방법을 계획합니다. 2025년 9월 30일에 새 배포에 대한 기본 아웃바운드 액세스가 사용 중지되고 명시적 액세스 구성만 허용됩니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
"severity": "높다",
- "text": "보호된 모든 공용 IP 주소(DDoS IP 또는 네트워크 보호)에 대한 DDoS 관련 로그를 저장하는 진단 설정을 추가합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"severity": "높다",
- "text": "Virtual Machines에 직접 연결된 공용 IP 주소를 거부하는 정책 할당이 있는지 확인합니다. 특정 VM에서 공용 IP가 필요한 경우 제외를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "안전"
+ "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
- "severity": "보통",
- "text": "ExpressRoute를 Azure에 대한 기본 연결로 사용합니다. VPN을 백업 연결의 소스로 사용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "공연"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
+ "severity": "높다",
+ "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "description": "AS-path 접두사 및 연결 가중치를 사용하여 Azure에서 온-프레미스로의 트래픽에 영향을 주고, 자체 라우터의 전체 BGP 특성 범위를 사용하여 온-프레미스에서 Azure로의 트래픽에 영향을 줄 수 있습니다.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "보통",
- "text": "여러 ExpressRoute 회로 또는 여러 온-프레미스 위치를 사용하는 경우 BGP 특성을 사용하여 라우팅을 최적화합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.",
+ "waf": "작업"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "대역폭 및 성능 요구 사항에 따라 ExpressRoute/VPN 게이트웨이에 적합한 SKU를 선택합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "공연"
+ "text": "'스토리지에 대한 Azure 보안 기준'을 고려합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "비용을 정당화하는 대역폭에 도달하는 경우에만 무제한 데이터 ExpressRoute 회로를 사용하고 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "비용"
+ "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "새로 만든 스토리지 계정은 ARM 배포 모델을 사용하여 생성되므로 RBAC, 감사 등이 모두 활성화됩니다. 구독에 클래식 배포 모델을 사용하는 이전 저장소 계정이 없는지 확인합니다.",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아보세요.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "회로 피어링 위치가 로컬 SKU에 대한 Azure 지역을 지원하는 경우 ExpressRoute의 로컬 SKU를 활용하여 회로 비용을 줄입니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "비용"
+ "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "지원되는 Azure 지역에 영역 중복 ExpressRoute 게이트웨이를 배포합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "10Gbps보다 높은 대역폭 또는 전용 10/100Gbps 포트가 필요한 시나리오의 경우 ExpressRoute Direct를 사용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "공연"
+ "text": "Blob에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 복구할 수 있습니다(예: 실수로 삭제한 작업에서 복구).",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "짧은 대기 시간이 필요하거나 온-프레미스에서 Azure로의 처리량이 10Gbps보다 커야 하는 경우 FastPath를 사용하여 데이터 경로에서 ExpressRoute 게이트웨이를 우회할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "공연"
+ "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 스토리지 계정의 우발적인 삭제를 방지합니다.",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
- "severity": "보통",
- "text": "영역 중복 VPN 게이트웨이를 사용하여 분기 또는 원격 위치를 Azure(사용 가능한 경우)에 연결합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능한'은 실제로 '불가능한'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함되면 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "변경할 수 없는 Blob 고려",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
- "severity": "보통",
- "text": "온-프레미스에서 중복 VPN 어플라이언스(활성/활성 또는 활성/수동)를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하여 모든 데이터 전송이 암호화되고 무결성이 보호되며 서버가 인증되도록 하는 것이 좋습니다. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 확인합니다. 이 경우 스토리지 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "ExpressRoute Direct를 사용하는 경우 비용을 절감하기 위해 로컬 Azure 지역에 대한 ExpressRoute 로컬 회로를 사용하는 것이 좋습니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "비용"
+ "text": "HTTPS를 적용(HTTP 사용 안 함)할 때 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "트래픽 격리 또는 전용 대역폭이 필요한 경우(예: 프로덕션 환경과 비프로덕션 환경을 분리하기 위해) 다른 ExpressRoute 회로를 사용합니다. 이는 격리된 라우팅 도메인을 보장하고 시끄러운 이웃 위험을 완화하는 데 도움이 됩니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
- "severity": "보통",
- "text": "기본 제공 Express Route Insights를 사용하여 ExpressRoute 가용성 및 사용률을 모니터링합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "작업"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". 최신 TLS 버전을 적용하면 이전 버전을 사용하는 클라이언트의 요청이 거부됩니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대한 최신 TLS 버전 적용Enforce the latest TLS version for a storage account",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "보통",
- "text": "네트워크를 통한 연결, 특히 온-프레미스와 Azure 간의 연결을 모니터링하기 위해 연결 모니터를 사용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "작업"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "가능한 경우 Microsoft Entra ID 토큰을 공유 액세스 서명보다 선호해야 합니다",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Blob 액세스에 Microsoft Entra ID 토큰 사용Use Microsoft Entra ID tokens for blob access",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "중복성을 위해 서로 다른 피어링 위치의 ExpressRoute 회로를 사용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "IaM 권한의 최소 권한",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
- "severity": "보통",
- "text": "단일 ExpressRoute 회로만 사용하는 경우 사이트 간 VPN을 ExpressRoute의 장애 조치(failover)로 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 대해 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 복사본을 가져왔는지 모니터링할 수 있지만 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시킬 수 없습니다. Entra ID 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "GatewaySubnet에서 경로 테이블을 사용하는 경우 게이트웨이 경로가 전파되었는지 확인합니다.",
- "waf": "신뢰도"
+ "text": "Microsoft Entra ID 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 '언제', '누가', '무엇을' 및 '어떻게' 확인하거나 변경합니다(예: 스토리지 계정 키, 액세스 정책 등).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "ExpressRoute를 사용하는 경우 온-프레미스 라우팅은 동적이어야 하며, 연결 오류가 발생할 경우 회로의 나머지 연결로 수렴해야 합니다. 로드는 두 연결 모두에서 액티브/액티브로 이상적으로 공유되어야 하지만 액티브/패시브도 지원됩니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "키 만료 정책을 사용하면 계정 액세스 키의 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "ExpressRoute 회로의 두 물리적 링크가 네트워크에 있는 두 개의 고유한 에지 디바이스에 연결되어 있는지 확인합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효성 간격으로 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "BFD(Bidirectional Forwarding Detection)가 고객 또는 프로바이더 에지 라우팅 디바이스에서 활성화되고 구성되도록 보장합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
- "severity": "높다",
- "text": "복원력을 높이기 위해 ExpressRoute 게이트웨이를 서로 다른 피어링 위치에서 둘 이상의 회로에 연결합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "신뢰도"
+ "text": "SAS 만료 정책을 구성하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 사용 권한을 취소할 수 있는 옵션을 제공합니다. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "ExpressRoute 가상 네트워크 게이트웨이에 대한 진단 로그 및 경고를 구성합니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "작업"
+ "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "VNet 간 통신에 ExpressRoute 회로를 사용하지 마세요.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "공연"
+ "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
+ "waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
- "severity": "낮다",
- "text": "검사를 위해 Azure 트래픽을 하이브리드 위치로 보내지 마세요. 대신 'Azure의 트래픽이 Azure에 유지' 원칙을 따라 Azure의 리소스 간 통신이 Microsoft 백본 네트워크를 통해 발생하도록 합니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 가능하지 않은 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 가까운 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 Blob에 업로드할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "글로벌 Azure Firewall 정책을 만들어 글로벌 네트워크 환경에서 보안 태세를 제어하고 모든 Azure Firewall 인스턴스에 할당합니다. Azure 역할 기반 액세스 제어를 통해 증분 방화벽 정책을 로컬 보안 팀에 위임하여 특정 지역의 요구 사항을 충족하는 세분화된 정책을 허용합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "SAS에 좁은 범위 적용",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
- "severity": "낮다",
- "text": "조직에서 아웃바운드 연결을 보호하기 위해 이러한 솔루션을 사용하려는 경우 Firewall Manager 내에서 지원되는 파트너 SaaS 보안 공급자를 구성합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "가능한 경우 SAS 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
- "severity": "높다",
- "text": "응용 프로그램 규칙을 사용하여 지원되는 프로토콜에 대한 대상 호스트 이름에서 아웃바운드 트래픽을 필터링합니다. FQDN 기반 네트워크 규칙 및 DNS 프록시와 함께 Azure Firewall을 사용하여 다른 프로토콜을 통해 인터넷으로의 송신 트래픽을 필터링합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 감안할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "낮다",
+ "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "Azure Firewall 프리미엄을 사용하여 추가 보안 기능을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "SFTP: SFTP 액세스를 위한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
- "severity": "높다",
- "text": "추가 보호를 위해 Azure Firewall 위협 인텔리전스 모드를 경고 및 거부로 구성합니다.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹 앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정하는 경우 CorsRules를 최소 권한으로 유지합니다.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "추가 보호를 위해 Azure Firewall IDPS 모드를 거부로 구성합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "지나치게 광범위한 CORS 정책 방지",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하도록 하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "Virtual WAN에 연결되지 않은 VNet의 서브넷의 경우 인터넷 트래픽이 Azure Firewall 또는 네트워크 가상 어플라이언스로 리디렉션되도록 경로 테이블을 연결합니다.",
+ "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "모든 Azure Firewall 배포에 대해 리소스별 대상 테이블을 사용하여 로그를 저장하는 진단 설정을 추가합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "작업"
+ "text": "어떤 플랫폼 암호화를 사용해야 하는지 확인합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
- "severity": "중요하다",
- "text": "Azure Firewall 클래식 규칙(있는 경우)에서 방화벽 정책으로 마이그레이션합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "작업"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "클라이언트 쪽 암호화를 사용해야 하는지 여부를 결정합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "리소스 그래프 탐색기(리소스 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"severity": "높다",
- "text": "Azure Firewall 서브넷에 /26 접두사를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "공용 Blob 익명 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
- "severity": "보통",
- "text": "방화벽 정책 내의 규칙을 Rule Collection Groups(규칙 수집 그룹) 및 Rule Collections(규칙 컬렉션)로 정렬하고 사용 빈도에 따라 정렬합니다.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "공연"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "성능 및 안정성 향상을 위해 storagev2 계정 유형 활용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
- "severity": "보통",
- "text": "IP 그룹 또는 IP 접두사를 사용하여 IP 테이블 규칙의 수를 줄입니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "최고의 가용성을 위해 GRS, ZRS 또는 GZRS 스토리지 활용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "와일드카드를 DNAT의 소스 IP로 사용하지 마십시오(예: * 또는 any). 들어오는 DNAT에 대한 소스 IP를 지정해야 합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "공연"
+ "text": "장애 조치(failover) 후 쓰기 작업의 경우 고객 관리 장애 조치(failover)를 사용합니다. ",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"severity": "보통",
- "text": "SNAT 포트 사용량을 모니터링하고, NAT 게이트웨이 설정을 평가하고, 원활한 장애 조치(failover)를 보장하여 SNAT 포트 고갈을 방지합니다. 포트 수가 제한에 가까워지면 SNAT 고갈이 임박했을 수 있다는 신호입니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "공연"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
- "severity": "높다",
- "text": "Azure Firewall 프리미엄을 사용하는 경우 TLS 검사를 사용하도록 설정합니다.",
- "waf": "공연"
+ "text": "Microsoft 관리 장애 조치(failover) 세부 정보 이해",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
- "severity": "낮다",
- "text": "웹 범주를 사용하여 특정 주제에 대한 아웃바운드 액세스를 허용하거나 거부할 수 있습니다.",
- "waf": "공연"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "일시 삭제 사용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"severity": "보통",
- "text": "TLS 검사의 일환으로 검사를 위해 Azure App Gateway에서 트래픽 수신을 계획합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "공연"
+ "text": "유연한 서버 활용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
+ "severity": "높다",
+ "text": "지역적으로 적용 가능한 경우 가용 영역 활용Leverage Availability Zones where regionally applicable",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"severity": "보통",
- "text": "Azure Firewall DNS 프록시 구성을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "안전"
+ "text": "지역 간 DR 시나리오에 입력 데이터 복제 활용",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "Azure Firewall을 Azure Monitor와 통합하고 진단 로깅을 사용하도록 설정하여 방화벽 로그 및 메트릭을 저장하고 분석합니다.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "작업"
+ "text": "공명형 AI를 위한 Metaprompting 가드레일 따르기",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "낮다",
- "text": "방화벽 규칙에 대한 백업 구현Implement backups for your firewall rules",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "더 나은 속도 제한, 부하 분산, 인증 및 로깅을 위해 APIM 또는 AI Central과 같은 솔루션을 사용하여 게이트웨이 패턴을 고려합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "여러 가용성 영역에 Azure Firewall을 배포합니다. Azure Firewall은 배포에 따라 다른 SLA를 제공합니다. 단일 가용 영역 또는 여러 가용 영역에서 작동하여 안정성과 성능을 향상시킬 수 있습니다.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "신뢰도"
+ "text": "AOAI 인스턴스에 대한 모니터링 활성화",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "Azure Firewall VNet에서 DDoS Protection을 구성하고, DDoS 보호 계획을 Azure Firewall을 호스트하는 가상 네트워크와 연결하여 DDoS 공격에 대한 향상된 완화를 제공합니다. Azure Firewall Manager는 방화벽 인프라 및 DDoS 보호 계획 생성을 통합합니다. ",
- "waf": "신뢰도"
+ "text": "리소스에 대해 수행된 작업(예: 구독 키 다시 생성) 또는 메트릭 임계값(예: 한 시간에 10을 초과하는 오류 수)에 의해 생성된 활동 로그의 항목과 같은 이벤트를 팀에 알리는 경고를 만듭니다",
+ "waf": "운영 우수성"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "컨트롤 플레인 트래픽을 차단하는 0.0.0.0/0 경로 또는 NSG 규칙과 같이 가상 네트워크에 삽입된 Azure PaaS 서비스에 대한 컨트롤 플레인 통신을 중단하지 마세요.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "안전"
+ "text": "용량으로 인한 서비스 중단을 방지하기 위해 토큰 사용량을 모니터링합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "프라이빗 엔드포인트 및 ExpressRoute 프라이빗 피어링을 통해 온-프레미스에서 Azure PaaS 서비스에 액세스하세요. 이 방법을 사용하면 공용 인터넷을 통해 전송하지 않아도 됩니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "안전"
+ "text": "처리된 추론 토큰, 생성된 완료 토큰, 속도 제한 모니터링과 같은 메트릭 관찰",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
+ "severity": "낮다",
+ "text": "진단이 충분하지 않은 경우 Azure OpenAI 앞에 있는 Azure API Managements와 같은 게이트웨이를 사용하여 허용되는 경우 들어오는 프롬프트와 나가는 응답을 모두 기록하는 것이 좋습니다",
+ "waf": "운영 우수성"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "모든 서브넷에서 기본적으로 가상 네트워크 서비스 엔드포인트를 사용하도록 설정하지 마세요.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "안전"
+ "text": "Infrastructure as code를 사용하여 Azure OpenAI Service, 모델 배포 및 모든 관련 리소스를 배포합니다",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
- "severity": "보통",
- "text": "Azure Firewall 또는 NVA의 IP 주소 대신 FQDN을 사용하여 Azure PaaS 서비스에 대한 송신 트래픽을 필터링하여 데이터 반출을 방지합니다. Private Link를 사용하는 경우 모든 FQDN을 차단할 수 있으며, 그렇지 않으면 필요한 PaaS 서비스만 허용할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "API 키 대신 관리 ID로 Microsoft Entra 인증 사용",
"waf": "안전"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "게이트웨이 서브넷에 /27 접두사 이상을 사용합니다.",
- "waf": "안전"
+ "text": "입력과 정답이 있는 알려진 골든 데이터 세트를 사용하여 시스템의 성능/정확도를 평가합니다. 평가를 위해 PromptFlow의 기능을 활용합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "VirtualNetwork 서비스 태그를 사용하여 연결을 제한하는 NSG 인바운드 기본 규칙에 의존하지 마세요.",
- "waf": "안전"
+ "text": "프로비저닝된 처리량 모델의 사용 평가 ",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure AI 콘텐츠 안전성 검토 및 구현",
+ "waf": "운영 우수성"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "분당 토큰 및 응답을 기반으로 시스템의 처리량을 정의 및 평가하고 요구 사항에 맞춥니다.",
+ "waf": "공연"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "NSG를 사용하여 서브넷 전체의 트래픽과 플랫폼 전체의 동쪽/서쪽 트래픽(랜딩 존 간 트래픽)을 보호할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "안전"
+ "text": "토큰 크기, 스트리밍 옵션을 제한하여 시스템의 대기 시간을 개선합니다.",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 랜딩 존 내의 트래픽을 마이크로 세그먼트화하고 중앙 NVA를 사용하여 트래픽 흐름을 필터링하지 않도록 합니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "안전"
+ "text": "탄력성 요구를 예측하여 우선 순위에 따라 동기 및 일괄 처리 요청 분리를 결정합니다. 우선 순위가 높은 경우 동기 접근 방식을 사용하고 낮은 우선 순위의 경우 큐를 사용한 비동기 일괄 처리가 선호됩니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "severity": "보통",
- "text": "VNet 흐름 로그를 사용하도록 설정하고 트래픽 분석에 제공하여 내부 및 외부 트래픽 흐름에 대한 인사이트를 얻을 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "안전"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "소비자의 예상 수요를 기반으로 토큰 사용 요구 사항을 벤치마킹합니다. 프로비저닝된 처리량 단위 배포를 사용하는 경우 처리량의 유효성을 검사하는 데 도움이 되도록 Azure OpenAI 벤치마킹 도구를 사용하는 것이 좋습니다",
+ "waf": "공연"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "1,000개의 규칙 제한으로 인해 NSG당 900개 이상의 NSG 규칙을 구현하지 마세요.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "waf": "신뢰도"
+ "text": "PTU(프로비저닝된 처리량 단위)를 사용하는 경우 오버플로 요청에 대한 TPM(분당 토큰) 배포를 배포하는 것이 좋습니다. 게이트웨이를 사용하여 PTU 제한에 도달할 때 TPM 배포로 요청을 라우팅합니다.",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "severity": "보통",
- "text": "시나리오가 Virtual WAN 라우팅 디자인 목록에 명시적으로 설명된 경우 Virtual WAN을 사용합니다.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "올바른 작업에 적합한 모델을 선택하십시오. 속도, 응답 품질 및 출력 복잡성 간에 적절한 절충점이 있는 모델 선택",
+ "waf": "공연"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Azure 지역당 Virtual WAN 허브를 사용하여 공통 글로벌 Azure Virtual WAN을 통해 Azure 지역 간에 여러 랜딩 존을 함께 연결합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "미세 조정으로 모델 성능이 향상되었는지 여부를 파악하기 위해 미세 조정 없이 성능에 대한 기준이 있습니다.",
"waf": "공연"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
- "severity": "보통",
- "text": "아웃바운드 인터넷 트래픽 보호 및 필터링을 위해 보안 허브에 Azure Firewall을 배포합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "안전"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "낮다",
+ "text": "여러 지역에 여러 OAI 인스턴스 배포",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
- "severity": "보통",
- "text": "Virtual WAN 네트워크 아키텍처가 식별된 아키텍처 시나리오에 맞는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "APIM과 같은 게이트웨이 패턴을 사용하여 재시도 및 상태 확인 구현Implement retry & healthchecks with gateway pattern like APIM",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Virtual WAN용 Azure Monitor Insights를 사용하여 Virtual WAN의 엔드투엔드 토폴로지, 상태 및 주요 메트릭을 모니터링합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "작업"
+ "text": "워크로드에 대한 TPM 및 RPM의 적절한 할당량이 있는지 확인합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "이러한 흐름을 명시적으로 차단해야 하는 경우가 아니면 Virtual WAN에서 분기 간 트래픽을 사용하지 않도록 설정하지 마세요.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "신뢰도"
+ "text": "HAI 도구 키트 지침의 고려 사항을 검토하고 slution에 대한 이러한 상호 작용 방법을 적용합니다",
+ "waf": "운영 우수성"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "AS-Path는 ExpressRoute 또는 VPN보다 유연하므로 허브 라우팅 기본 설정으로 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "미세 조정이 사용되는 경우 지역 간에 별도의 미세 조정된 모델을 배포합니다.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Virtual WAN에서 레이블 기반 전파를 구성하지 않으면 가상 허브 간의 연결이 손상됩니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "중요한 데이터를 정기적으로 백업 및 복제하여 데이터 손실 또는 시스템 장애 발생 시 데이터 가용성과 복구 가능성을 보장합니다. Azure의 백업 및 재해 복구 서비스를 활용하여 데이터를 보호하세요.",
"waf": "신뢰도"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "가상 허브에 /23 이상의 접두사를 할당하여 충분한 IP 공간을 사용할 수 있도록 합니다.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "SLA를 갖도록 Azure AI 검색 서비스 계층을 선택해야 합니다. ",
"waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "severity": "낮다",
+ "text": "임베딩을 생성하기 전에 데이터 및 민감도를 분류하고 Microsoft Purview를 사용하여 레이블을 지정하고 생성된 임베딩을 동일한 민감도 및 분류로 처리해야 합니다",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "Azure Policy를 전략적으로 활용하고, 정책 이니셔티브를 사용하여 관련 정책을 그룹화하여 환경에 대한 컨트롤을 정의합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "BYOK(옵션)를 사용한 SSE/디스크 암호화로 RAG에 사용되는 데이터 암호화",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "데이터 소스 간 전송 중인 데이터, RAG(Retrieval-Augmented Generation) 및 LLM 통신에 사용되는 AI 검색에 TLS가 적용되는지 확인합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "RBAC를 사용하여 Azure OpenAI 서비스에 대한 액세스를 관리합니다. 사용자에게 적절한 권한을 할당하고 사용자의 역할과 책임에 따라 액세스를 제한합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "규정 및 규정 준수 요구 사항을 Azure Policy 정의 및 Azure 역할 할당에 매핑합니다.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "text": "데이터 암호화, 마스킹 또는 수정 기술을 구현하여 비프로덕션 환경에서 또는 테스트 또는 문제 해결을 위해 데이터를 공유할 때 민감한 데이터를 숨기거나 난독화된 값으로 대체합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure Defender를 활용하여 보안 위협을 탐지 및 대응하고 의심스러운 활동 또는 위반을 식별하기 위한 모니터링 및 경고 메커니즘을 설정합니다. 고급 위협 탐지 및 대응을 위해 Azure Sentinel 활용",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "상속된 범위에서 할당할 수 있도록 중간 루트 관리 그룹에서 Azure Policy 정의를 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "규정 준수 규정을 준수하기 위해 데이터 보존 및 폐기 정책을 수립합니다. 더 이상 필요하지 않은 데이터에 대한 안전한 삭제 방법을 구현하고 데이터 보존 및 폐기 활동에 대한 감사 추적을 유지 관리합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Content Safety를 사용하여 Prompt shields 및 groundedness detection 구현 ",
+ "waf": "운영 우수성"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "필요한 경우 최하위 수준에서 제외를 사용하여 가장 적절한 수준에서 정책 할당을 관리합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "개인 정보 보호 제어를 구현하고 데이터 처리 활동에 필요한 동의 또는 권한을 얻어 GDPR 또는 HIPAA와 같은 관련 데이터 보호 규정을 준수하도록 합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "낮다",
- "text": "Azure Policy를 사용하여 사용자가 구독/관리 그룹 수준에서 프로비전할 수 있는 서비스를 제어합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
+ "severity": "보통",
+ "text": "데이터 보안 모범 사례, 데이터 안전한 처리의 중요성, 데이터 침해와 관련된 잠재적 위험에 대해 직원을 교육합니다. 데이터 보안 프로토콜을 성실히 따르도록 권장합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "가능한 경우 기본 제공 정책을 사용하여 운영 오버헤드를 최소화합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "생산 데이터를 개발 및 테스트 데이터와 분리합니다. 프로덕션에서는 실제 민감한 데이터만 사용하고 개발 및 테스트 환경에서는 익명 또는 합성 데이터를 활용합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "Resource Policy Contributor 역할을 특정 범위에 할당하면 정책 관리를 관련 팀에 위임할 수 있습니다. 예를 들어 중앙 IT 팀은 관리 그룹 수준 정책을 감독할 수 있고, 응용 프로그램 팀은 구독에 대한 정책을 처리하여 조직 표준을 준수하는 분산 거버넌스를 가능하게 할 수 있습니다.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "특정 범위에서 기본 제공 Resource Policy Contributor 역할을 할당하여 응용 프로그램 수준 거버넌스를 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "데이터 민감도 수준이 다양하다면 각 수준에 대해 별도의 인덱스를 만드는 것이 좋습니다. 예를 들어, 일반 데이터에 대한 인덱스와 민감한 데이터에 대한 인덱스가 있을 수 있으며, 각각 다른 액세스 프로토콜에 의해 제어됩니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "상속된 범위에서 제외를 통해 관리하지 않도록 루트 관리 그룹 범위에서 수행된 Azure Policy 할당 수를 제한합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "한 단계 더 나아가 중요한 데이터 세트를 서비스의 다른 인스턴스에 배치합니다. 각 인스턴스는 고유한 특정 RBAC 정책 집합으로 제어할 수 있습니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
- "severity": "보통",
- "text": "데이터 주권 요구 사항이 있는 경우 이를 적용하기 위해 Azure 정책을 배포해야 합니다.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "민감한 정보에서 생성된 임베딩과 벡터는 그 자체로 민감하다는 점을 인식해야 합니다. 이 데이터에는 원본 자료와 동일한 보호 조치가 제공되어야 합니다",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
- "severity": "보통",
- "text": "Sovereign Landing Zone의 경우 주권 정책 기준을 배포하고 올바른 관리 그룹 수준에서 할당합니다.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "임베딩 및 벡터가 있는 데이터 저장소에 RBAC를 적용하고 역할의 액세스 요구 사항에 따라 액세스 범위를 지정합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
- "severity": "보통",
- "text": "Sovereign Landing Zone의 경우 정책 매핑에 대한 Sovereign Control 목표를 문서화합니다.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "AI 서비스에 대한 프라이빗 엔드포인트를 구성하여 네트워크 내 서비스 액세스를 제한합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
- "severity": "보통",
- "text": "Sovereign Landing Zone의 경우 'Sovereign Control 목표를 정책 매핑에 적용'을 관리하기 위한 프로세스가 마련되어 있는지 확인합니다.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure Firewall 및 UDR을 사용하여 엄격한 인바운드 및 아웃바운드 트래픽 제어를 적용하고 외부 통합 지점을 제한합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
- "severity": "보통",
- "text": "Azure RBAC(Azure 역할 기반 액세스 제어), 데이터 주권 요구 사항 또는 데이터 보존 정책에 따라 별도의 작업 영역이 필요한 경우를 제외하고 단일 모니터 로그 작업 영역을 사용하여 플랫폼을 중앙에서 관리합니다.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "네트워크 세분화 및 액세스 제어를 구현하여 LLM 애플리케이션에 대한 액세스를 인증된 사용자 및 시스템으로만 제한하고 측면 이동을 방지합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "모든 지역에 대해 단일 Azure Monitor 로그 작업 영역을 사용할지 또는 다양한 지리적 지역을 포괄하는 여러 작업 영역을 만들지 여부를 결정합니다. 각 접근 방식에는 잠재적인 지역 간 네트워킹 요금을 포함하여 장점과 단점이 있습니다",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "신뢰도"
+ "text": "LLMLingua 또는 gprtrim과 같은 프롬프트 압축 도구 사용",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "로그 보존 요구 사항이 12년을 초과하는 경우 로그를 Azure Storage로 내보냅니다. Write-Once, Read-Many 정책과 함께 변경할 수 없는 스토리지를 사용하여 사용자가 지정한 간격 동안 데이터를 지우거나 수정할 수 없도록 합니다.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "작업"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
- "severity": "보통",
- "text": "Azure Policy를 사용하여 OS 수준 VM(가상 머신) 구성 드리프트를 모니터링합니다. 정책을 통해 Azure Automanage Machine Configuration 감사 기능을 사용하도록 설정하면 애플리케이션 팀 워크로드가 적은 노력으로 기능 기능을 즉시 사용할 수 있습니다.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "작업"
+ "text": "LLM 애플리케이션에서 사용하는 API 및 엔드포인트가 관리 ID, API 키 또는 OAuth와 같은 인증 및 권한 부여 메커니즘으로 적절하게 보호되어 무단 액세스를 방지해야 합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Azure에서 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure 업데이트 관리자를 사용합니다.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "작업"
+ "text": "다단계 인증(multi-factor authentication)과 같은 강력한 최종 사용자 인증 메커니즘을 적용하여 LLM 애플리케이션 및 관련 네트워크 리소스에 대한 무단 액세스를 방지합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Azure Arc를 사용하여 Azure 외부의 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure 업데이트 관리자를 사용합니다.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "작업"
+ "text": "네트워크 모니터링 도구를 구현하여 의심스럽거나 악의적인 활동에 대한 네트워크 트래픽을 탐지하고 분석합니다. 로깅을 활성화하여 네트워크 이벤트를 캡처하고 보안 사고 발생 시 포렌식 분석을 용이하게 합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Network Watcher를 사용하여 트래픽 흐름을 사전에 모니터링합니다.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "작업"
+ "text": "보안 감사 및 침투 테스트를 수행하여 LLM 애플리케이션의 네트워크 인프라에서 네트워크 보안 약점 또는 취약성을 식별하고 해결합니다.",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
- "severity": "보통",
- "text": "인사이트 및 보고를 위해 Azure Monitor 로그를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "severity": "낮다",
+ "text": "Azure AI 서비스는 더 나은 관리를 위해 적절하게 태그가 지정됩니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
- "severity": "보통",
- "text": "Azure Monitor 경고를 사용하여 운영 경고를 생성합니다.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "낮다",
+ "text": "Azure AI Service 계정은 조직의 명명 규칙을 따릅니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
- "severity": "보통",
- "text": "Azure Automation 계정을 통해 변경 및 인벤토리 추적을 사용하는 경우 Log Analytics 작업 영역과 자동화 계정을 함께 연결하는 데 지원되는 지역을 선택했는지 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure AI Services 리소스의 진단 로그를 사용하도록 설정해야 함",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
- "severity": "낮다",
- "text": "Azure Backup을 사용하는 경우 기본 설정은 GRS이므로 백업에 올바른 백업 유형(GRS, ZRS & LRS)을 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "신뢰도"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "키 액세스(로컬 인증)는 보안을 위해 사용하지 않도록 설정하는 것이 좋습니다. 키 기반 액세스를 사용하지 않도록 설정하면 Microsoft Entra ID가 유일한 액세스 방법이 되어 최소 권한 원칙과 세분화된 제어를 유지할 수 있습니다. ",
+ "waf": "안전"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
- "severity": "보통",
- "text": "Azure 게스트 정책을 사용하여 VM 확장을 통해 소프트웨어 구성을 자동으로 배포하고 규격 기준 VM 구성을 적용합니다.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure Key Vault를 사용하여 키를 안전하게 저장하고 관리하세요. LLM 애플리케이션의 코드 내에 중요한 키를 하드 코딩하거나 포함하지 않도록 하고 관리 ID를 사용하여 Azure Key Vault에서 안전하게 검색합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "Azure Policy의 게스트 구성 기능을 사용하여 컴퓨터 설정(예: OS, 애플리케이션, 환경)을 감사하고 수정하여 리소스가 예상 구성에 맞는지 확인하고, 업데이트 관리는 VM에 대한 패치 관리를 적용할 수 있습니다.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
- "severity": "보통",
- "text": "Azure Policy를 통해 VM 보안 구성 드리프트를 모니터링합니다.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure Key Vault에 저장된 키를 정기적으로 회전하고 만료하여 무단 액세스의 위험을 최소화합니다.",
"waf": "안전"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
- "severity": "보통",
- "text": "Azure-to-Azure Virtual Machines 재해 복구 시나리오에는 Azure Site Recovery를 사용합니다. 이렇게 하면 지역 간에 워크로드를 복제할 수 있습니다.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "tiktoken을 사용하여 대화 모드에서 토큰 최적화를 위한 토큰 크기 이해",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
- "severity": "보통",
- "text": "Azure 네이티브 백업 기능 또는 Azure 호환 타사 백업 솔루션을 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "작업"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "보안 코딩 관행에 따라 주입 공격, XSS(교차 사이트 스크립팅) 또는 보안 구성 오류와 같은 일반적인 취약성을 방지합니다",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "진단 설정을 추가하여 Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 WAF 로그를 저장합니다. 로그를 정기적으로 검토하여 공격 및 가양성 탐지를 확인합니다.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "작업"
+ "text": "LLM 라이브러리와 다른 시스템 컴포넌트를 정기적으로 업데이트하고 패치하는 프로세스를 설정합니다.",
+ "waf": "안전"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "Azure OpenAI 또는 기타 LLM 사용 약관, 정책 및 지침, 허용되는 사용 사례 준수",
+ "waf": "운영 우수성"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 Microsoft Sentinel로 WAF 로그를 보냅니다. 공격을 탐지하고 WAF 텔레메트리를 전체 Azure 환경에 통합합니다.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
- "waf": "작업"
+ "text": "기본 모델과 미세 조정된 모델 및 토큰 단계 크기의 비용 차이를 이해합니다.",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "Azure Key Vault를 사용하여 비밀과 자격 증명을 저장합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "안전"
+ "text": "가능한 경우 호출당 오버헤드를 최소화하여 전체 비용을 줄일 수 있는 일괄 처리 요청. 배치 크기를 최적화해야 합니다.",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "서로 다른 애플리케이션 및 지역에 대해 서로 다른 Azure Key Vault를 사용하여 트랜잭션 규모 제한을 방지하고 비밀에 대한 액세스를 제한합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "안전"
+ "text": "모델 사용을 모니터링하는 비용 추적 시스템을 설정하고 해당 정보를 사용하여 모델 선택 및 프롬프트 크기를 알립니다",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "안전"
+ "text": "모델 응답당 토큰 수에 대한 최대 제한을 설정합니다. 유효한 응답에 사용할 수 있을 만큼 충분히 큰지 확인하기 위해 크기를 최적화합니다",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "키, 비밀 및 인증서를 영구적으로 삭제할 수 있는 권한 부여를 특수 사용자 지정 Microsoft Entra ID 역할로 제한하여 최소 권한 모델을 따릅니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "안전"
+ "text": "안정성을 위한 AI 검색 설정에 대해 제공된 지침을 검토합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "공용 인증 기관을 통해 인증서 관리 및 갱신 프로세스를 자동화하여 관리를 용이하게 합니다.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "안전"
+ "text": "AI Search Vector 스토리지 계획 및 관리",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "키 및 인증서 교체를 위한 자동화된 프로세스를 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "안전"
+ "text": "LLMOps 사례를 적용하여 GenAI 애플리케이션의 라이프사이클 관리를 자동화합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "보통",
- "text": "자격 증명 모음에서 방화벽 및 가상 네트워크 서비스 엔드포인트 또는 프라이빗 엔드포인트를 사용하도록 설정하여 키 자격 증명 모음에 대한 액세스를 제어합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
- "waf": "안전"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "severity": "높다",
+ "text": "청구 모델 사용 평가 - PAYG 대 PTU",
+ "waf": "비용 최적화"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "플랫폼 중앙 Azure Monitor Log Analytics 작업 영역을 사용하여 Key Vault의 각 인스턴스 내에서 키, 인증서 및 비밀 사용을 감사합니다.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "안전"
+ "text": "모델 버전 간에 전환할 때 프롬프트와 응용 프로그램의 품질을 평가합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Key Vault 인스턴스화 및 권한 있는 액세스를 위임하고 Azure Policy를 사용하여 일관된 규정 준수 구성을 적용합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
- "waf": "안전"
+ "text": "GenAI 앱을 평가, 모니터링 및 개선하여 근거, 관련성, 정확성, 일관성, 유창성 등의 기능을 제공합니다.",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "애플리케이션당 환경, 지역별 Azure Key Vault를 사용합니다.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "안전"
+ "text": "다양한 검색 매개 변수를 기반으로 Azure AI Search 결과를 평가합니다",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "사용자 고유의 키를 가져오려는 경우 고려되는 모든 서비스에서 지원되지 않을 수 있습니다. 불일치가 원하는 결과를 방해하지 않도록 관련 완화를 구현합니다. 대기 시간을 최소화하는 적절한 지역 쌍 및 재해 복구 지역을 선택합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "안전"
+ "text": "데이터를 사용하여 프롬프트 엔지니어링 및 RAG와 같은 다른 기본 접근 방식을 시도한 경우에만 모델을 미세 조정하여 정확도를 높이는 방법으로 살펴보십시오",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Sovereign Landing Zone의 경우 Azure Key Vault 관리형 HSM을 사용하여 비밀과 자격 증명을 저장합니다.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "안전"
+ "text": "프롬프트 엔지니어링 기법을 사용하여 LLM 응답의 정확도 향상",
+ "waf": "운영 우수성"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
"severity": "보통",
- "text": "Microsoft Entra ID 보고 기능을 사용하여 액세스 제어 감사 보고서를 생성합니다.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "text": "GenAI 애플리케이션을 위한 레드 팀",
"waf": "안전"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
- "severity": "높다",
- "text": "모든 구독에 대해 Defender 클라우드 보안 태세 관리를 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
- "waf": "안전"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
+ "severity": "보통",
+ "text": "최종 사용자에게 LLM 응답에 대한 점수 매기기 옵션을 제공하고 이러한 점수를 추적합니다. ",
+ "waf": "운영 우수성"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "높다",
- "text": "모든 구독의 서버에 대해 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "안전"
+ "text": "할당량 관리 방법 고려",
+ "waf": "비용 최적화"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
- "severity": "높다",
- "text": "모든 구독에서 Azure 리소스에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "안전"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
+ "severity": "보통",
+ "text": "APIM 기반 게이트웨이와 같은 Load Balancer 솔루션을 사용하여 서비스 및 지역 간에 부하와 용량을 분산합니다",
+ "waf": "운영 우수성"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
- "severity": "높다",
- "text": "IaaS 서버에서 Endpoint Protection을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
- "waf": "안전"
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "장기 취소 가능 토큰을 사용하고, 토큰을 캐시하고, Microsoft ID 라이브러리를 사용하여 자동으로 획득합니다.",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "보통",
- "text": "Azure Monitor 로그 및 클라우드용 Defender를 통해 기본 운영 체제 패치 드리프트를 모니터링합니다.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
- "waf": "안전"
+ "text": "로그인 사용자 흐름이 백업되고 복원력이 있는지 확인합니다. 사용자를 로그인하는 데 사용하는 코드가 백업되고 복구 가능한지 확인합니다. 외부 프로세스와의 복원력 있는 인터페이스",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"severity": "보통",
- "text": "기본 리소스 구성을 중앙 집중식 Azure Monitor Log Analytics 작업 영역에 연결합니다.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "안전"
+ "text": "사용자 지정 브랜드 자산은 CDN에서 호스팅되어야 합니다.",
+ "waf": "공연"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
- "severity": "높다",
- "text": "상관 관계가 있는 로그를 통한 중앙 집중식 위협 탐지 - SIEM(보안 정보 및 이벤트 관리)을 통해 다양한 서비스 간에 상관 관계를 파악할 수 있는 중앙 위치에 보안 데이터를 통합합니다.",
- "waf": "안전"
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "낮다",
+ "text": "여러 ID 공급자가 있어야 합니다(예: Microsoft, Google, Facebook 계정으로 로그인).",
+ "waf": "신뢰도"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "보통",
- "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 투명 로그를 사용하도록 설정합니다.",
- "waf": "안전"
+ "text": "VM 수준에서 고가용성을 위한 VM 규칙(프리미엄 디스크, 서로 다른 가용성 영역에 있는 지역에 두 개 이상)을 따릅니다.",
+ "waf": "신뢰도"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "보통",
- "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 고객 Lockbox를 사용하도록 설정합니다.",
- "waf": "안전"
+ "text": "복제하지 마세요! 복제로 인해 디렉터리 동기화에 문제가 발생할 수 있습니다",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
- "severity": "높다",
- "text": "스토리지 계정에 대한 보안 전송을 사용하도록 설정합니다.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
- "waf": "안전"
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "보통",
+ "text": "다중 지역에 대해 활성-활성 상태 보유",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
- "severity": "높다",
- "text": "스토리지 계정에 대해 컨테이너 일시 삭제를 사용하도록 설정하여 삭제된 컨테이너와 해당 콘텐츠를 복구합니다.",
- "waf": "안전"
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "추가 지역 및 위치에 Azure AD 도메인 서비스 스탬프 추가Add Azure AD Domain service stamps to additional regions and locations",
+ "waf": "신뢰도"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
- "severity": "높다",
- "text": "Key Vault 비밀을 사용하여 자격 증명(가상 머신 사용자 암호), 인증서 또는 키와 같은 중요한 정보를 하드 코딩하지 않도록 합니다.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "작업"
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
+ "severity": "보통",
+ "text": "DR에 복제본 세트 사용",
+ "waf": "신뢰도"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
@@ -10007,7 +10007,7 @@
"name": "성취"
},
{
- "description": "권장 사항을 이해하지만 현재 요구 사항에 필요하지 않음",
+ "description": "권장 사항은 이해되었지만 현재 요구 사항에 필요하지 않음",
"name": "필요 없음"
},
{
diff --git a/checklists/waf_checklist.pt.json b/checklists/waf_checklist.pt.json
index c3a7d671e..bc268a800 100644
--- a/checklists/waf_checklist.pt.json
+++ b/checklists/waf_checklist.pt.json
@@ -1,8211 +1,8490 @@
{
"items": [
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"severity": "Alto",
- "text": "Habilite a redundância de zona para o Cache do Azure para Redis. O Cache do Azure para Redis dá suporte a configurações redundantes de zona nas camadas Premium e Enterprise. Um cache redundante de zona pode colocar seus nós em diferentes zonas de disponibilidade do Azure na mesma região. Ele elimina a interrupção do data center ou AZ como um único ponto de falha e aumenta a disponibilidade geral do cache.",
- "waf": "Fiabilidade"
+ "text": "Verifique se os controladores de domínio ADDS estão implantados na assinatura de identidade no Azure nativo",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"severity": "Média",
- "text": "Configure a persistência de dados para uma instância do Cache do Azure para Redis. Como os dados do cache são armazenados na memória, uma falha rara e não planejada de vários nós pode fazer com que todos os dados sejam descartados. Para evitar a perda completa de dados, a persistência do Redis permite que você tire instantâneos periódicos de dados na memória e os armazene em sua conta de armazenamento.",
- "waf": "Fiabilidade"
+ "text": "Verifique se os sites e serviços do ADDS estão configurados para manter as solicitações de autenticação de recursos baseados no Azure (incluindo a Solução VMware do Azure) locais para o Azure",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
- "severity": "Média",
- "text": "Use a conta de armazenamento com redundância geográfica para persistir o Cache do Azure para dados Redis ou zonalmente redundante onde a redundância geográfica não está disponível",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Verifique se o vCenter está conectado ao ADDS para habilitar a autenticação com base em 'contas de usuário nomeadas'",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"severity": "Média",
- "text": "Configure a replicação geográfica passiva para instâncias do Cache Premium do Azure para Redis. A replicação geográfica é um mecanismo para vincular duas ou mais instâncias do Cache do Azure para Redis, normalmente abrangendo duas regiões do Azure. A replicação geográfica foi projetada principalmente para recuperação de desastres entre regiões. Duas instâncias de cache de camada Premium são conectadas por meio de replicação geográfica de uma forma que fornece leituras e gravações no cache primário e que os dados são replicados para o cache secundário.",
- "waf": "Fiabilidade"
+ "text": "Verifique se a conexão do vCenter com o ADDS está usando um protocolo seguro (LDAPS)",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"severity": "Média",
- "text": "Verifique se você está usando o SKU do Gateway de Aplicativo v2",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "A conta do CloudAdmin no vCenter IdP é usada apenas como uma conta de emergência (break-glass)",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
- "severity": "Média",
- "text": "Verifique se você está usando o SKU Standard para seus Azure Load Balancers",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Certifique-se de que o NSX-Manager esteja integrado a um provedor de identidade externo (LDAPS)",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"severity": "Média",
- "text": "Verifique se os endereços IP de front-end dos Load Balancers têm redundância de zona (a menos que você precise de front-ends zonais).",
+ "text": "Foi criado um modelo RBAC para uso no VMware vSphere",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"severity": "Média",
- "text": "Seus Gateways de Aplicativo v2 devem ser implantados em sub-redes com prefixos IP iguais ou maiores que /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "As permissões RBAC devem ser concedidas em grupos ADDS e não em usuários específicos",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "description": "A administração de proxies reversos em geral e WAF em particular está mais próxima do aplicativo do que da rede, portanto, eles pertencem à mesma assinatura que o aplicativo. Centralizar o Gateway de Aplicativo e o WAF na assinatura de conectividade pode ser OK se ele for gerenciado por uma única equipe.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Implante o Gateway de Aplicativo do Azure v2 ou NVAs de parceiros usados para proxy de conexões HTTP(S) de entrada na rede virtual da zona de destino e com os aplicativos que eles estão protegendo.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "As permissões RBAC no recurso Solução VMware do Azure no Azure são 'bloqueadas' apenas para um conjunto limitado de proprietários",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Use uma rede DDoS ou planos de proteção de IP para todos os endereços IP públicos em zonas de destino do aplicativo.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Certifique-se de que todas as funções personalizadas tenham escopo com autorizações permitidas do CloudAdmin",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Configure o dimensionamento automático com uma quantidade mínima de instâncias de duas.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "O modelo de conectividade correto da Solução VMware do Azure está selecionado para o caso de uso do cliente em mãos?",
+ "waf": "Desempenho"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Garantir que as conexões de Rota Expressa ou VPN do local para o Azure sejam monitoradas usando o 'monitor de conexão'",
+ "waf": "Operações"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"severity": "Média",
- "text": "Implantar o Gateway de Aplicativo em Zonas de Disponibilidade",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Fiabilidade"
+ "text": "Verifique se um monitor de conexão foi criado a partir de um recurso nativo do Azure para uma máquina virtual da Solução VMware do Azure para monitorar a conexão de Rota Expressa de back-end da Solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"severity": "Média",
- "text": "Ao usar o Front Door e o Gateway de Aplicativo para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Front Door. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
+ "text": "Verifique se um monitor de conexão é criado a partir de um recurso local para uma máquina virtual da Solução VMware do Azure para monitorar a conectividade de ponta 2",
+ "waf": "Operações"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"severity": "Alto",
- "text": "Use o Gerenciador de Tráfego para fornecer aplicativos globais que abrangem protocolos diferentes de HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Fiabilidade"
+ "text": "Quando o servidor de rotas for usado, certifique-se de que não mais de 1000 rotas sejam propagadas do servidor de rotas para o gateway ExR para o local (limite ARS).",
+ "waf": "Operações"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
- "severity": "Baixo",
- "text": "Se os usuários precisarem apenas de acesso a aplicativos internos, o Proxy de Aplicativo de ID do Microsoft Entra foi considerado como uma alternativa à AVD (Área de Trabalho Virtual) do Azure?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "O Gerenciamento de Identidades Privilegiadas é implementado para funções que gerenciam o recurso da Solução VMware do Azure no Portal do Azure (não são permitidas permissões permanentes)",
"waf": "Segurança"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Os relatórios de auditoria do Gerenciamento de Identidades Privilegiadas devem ser implementados para as funções PIM da Solução VMware do Azure",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"severity": "Média",
- "text": "Para reduzir o número de portas de firewall abertas para conexões de entrada em sua rede, considere usar o Proxy de Aplicativo de ID do Microsoft Entra para fornecer aos usuários remotos acesso seguro e autenticado a aplicativos internos.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "text": "Se o uso do Gerenciamento de Identidades Privilegiadas estiver sendo usado, certifique-se de que uma conta válida habilitada para ID do Entra seja criada com um registro SMTP válido para notificações de substituição automática do Host da Solução VMware do Azure. (permissões permanentes necessárias)",
"waf": "Segurança"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
"severity": "Alto",
- "text": "Usar o Gateway NAT do Azure em vez das regras de saída do Load Balancer para melhorar a escalabilidade SNAT",
- "waf": "Fiabilidade"
+ "text": "Limitar o uso da conta do CloudAdmin apenas ao acesso de emergência",
+ "waf": "Segurança"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
- "severity": "Alto",
- "text": "Habilite o conjunto de regras de proteção contra bot do WAF do Gateway de Aplicativo do Azure. As regras de bot detectam bots bons e ruins.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Criar funções RBAC personalizadas no vCenter para implementar um modelo de privilégios mínimos dentro do vCenter",
"waf": "Segurança"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
- "severity": "Alto",
- "text": "Verifique se o recurso de inspeção do corpo da solicitação está habilitado na política WAF do Gateway de Aplicativo do Azure.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "É um processo definido para alternar regularmente as credenciais cloudadmin (vCenter) e admin (NSX)",
"waf": "Segurança"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"severity": "Alto",
- "text": "Ajuste o WAF do Gateway de Aplicativo do Azure no modo de detecção para sua carga de trabalho. Reduza as detecções de falsos positivos.",
+ "text": "Usar um provedor de identidade centralizado a ser usado para cargas de trabalho (VMs) em execução na Solução VMware do Azure",
"waf": "Segurança"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
- "severity": "Alto",
- "text": "Implante sua política de WAF para Gateway de Aplicativo no modo 'Prevenção'.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "A filtragem de tráfego Leste-Oeste é implementada no NSX-T",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Adicione a limitação de taxa ao WAF do Gateway de Aplicativo do Azure. A limitação de taxa bloqueia os clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "As cargas de trabalho na Solução VMware do Azure não são diretamente expostas à Internet. O tráfego é filtrado e inspecionado pelo Gateway de Aplicativo do Azure, pelo Firewall do Azure ou por soluções de terceiros",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Use um limite alto para os limites de taxa do WAF do Gateway de Aplicativo do Azure. Os limites de limite de taxa altos evitam o bloqueio do tráfego legítimo, ao mesmo tempo em que fornecem proteção contra números extremamente altos de solicitações que podem sobrecarregar sua infraestrutura. ",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "A auditoria e o registro em log são implementados para solicitações de entrada da Internet para cargas de trabalho baseadas na Solução VMware do Azure e na Solução VMware do Azure",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
- "severity": "Baixo",
- "text": "Se você não estiver esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "O monitoramento de sessão é implementado para conexões de saída da Internet a partir da Solução VMware do Azure ou cargas de trabalho baseadas na Solução VMware do Azure para identificar atividades suspeitas/mal-intencionadas",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"severity": "Média",
- "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Gateway de Aplicativo do Azure. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.",
+ "text": "A proteção padrão contra DDoS está habilitada na sub-rede do Gateway ExR/VPN no Azure",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"severity": "Média",
- "text": "Use a versão mais recente do conjunto de regras do WAF do Gateway de Aplicativo do Azure. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário de ameaças atual.",
+ "text": "Usar uma estação de trabalho de acesso privilegiado (PAW) dedicada para gerenciar a Solução VMware do Azure, o vCenter, o gerenciador NSX e o gerenciador HCX",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"severity": "Média",
- "text": "Adicione configurações de diagnóstico para salvar os logs do WAF do Gateway de Aplicativo do Azure.",
- "waf": "Operações"
+ "text": "Habilitar a Detecção Avançada de Ameaças (Microsoft Defender for Cloud, também conhecido como ASC) para cargas de trabalho em execução na Solução VMware do Azure",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"severity": "Média",
- "text": "Envie logs do WAF do Gateway de Aplicativo do Azure para o Microsoft Sentinel.",
- "waf": "Operações"
+ "text": "Usar o Azure ARC for Servers para controlar corretamente as cargas de trabalho em execução na Solução VMware do Azure usando tecnologias nativas do Azure (o Azure ARC for Azure VMware Solution ainda não está disponível)",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Defina a configuração do WAF do Gateway de Aplicativo do Azure como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.",
- "waf": "Operações"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Garanta que as cargas de trabalho na Solução VMware do Azure usem criptografia de dados suficiente durante o tempo de execução (como criptografia de disco convidado e SQL TDE). (a criptografia vSAN em repouso é padrão)",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Use as Políticas do WAF em vez da configuração herdada do WAF.",
- "waf": "Operações"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Quando a criptografia no convidado é usada, armazene chaves de criptografia no cofre de chaves do Azure quando possível",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"severity": "Média",
- "text": "Filtre o tráfego de entrada nos back-ends para que eles aceitem apenas conexões da sub-rede do Gateway de Aplicativo, por exemplo, com NSGs.",
+ "text": "Considere usar o suporte estendido de atualização de segurança para cargas de trabalho em execução na Solução VMware do Azure (a Solução VMware do Azure é qualificada para ESU)",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"severity": "Alto",
- "text": "Você deve criptografar o tráfego para os servidores de back-end.",
- "waf": "Segurança"
+ "text": "Certifique-se de que o método de redundância de dados vSAN apropriado seja usado (especificação RAID)",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"severity": "Alto",
- "text": "Você deve usar um Web Application Firewall.",
- "waf": "Segurança"
+ "text": "Certifique-se de que a política de falha na tolerância esteja em vigor para atender às suas necessidades de armazenamento vSAN",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Redirecionar HTTP para HTTPS",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Certifique-se de ter solicitado cota suficiente, garantindo que você tenha considerado o crescimento e o requisito de recuperação de desastres",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"severity": "Média",
- "text": "Use cookies gerenciados por gateway para direcionar o tráfego de uma sessão de usuário para o mesmo servidor para processamento",
+ "text": "Certifique-se de que as restrições de acesso ao ESXi sejam compreendidas, há limites de acesso que podem afetar as soluções de terceiros 3rd.",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
- "severity": "Alto",
- "text": "Habilitar a drenagem de conexão durante atualizações de serviço planejadas para evitar a perda de conexão para membros existentes do pool de back-end",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
- "severity": "Baixo",
- "text": "Crie páginas de erro personalizadas para exibir uma experiência de usuário personalizada",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Certifique-se de ter uma política em torno da densidade e eficiência do host ESXi, tendo em mente o prazo de espera para solicitar novos nós",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"severity": "Média",
- "text": "Edite solicitações HTTP e cabeçalhos de resposta para facilitar o roteamento e a troca de informações entre o cliente e o servidor",
- "waf": "Segurança"
+ "text": "Garantir que um bom processo de gerenciamento de custos esteja em vigor para a Solução VMware do Azure - o Gerenciamento de Custos do Azure pode ser usado",
+ "waf": "Custar"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Configure o Front Door para otimizar o roteamento de tráfego da Web global e o desempenho e a confiabilidade do usuário final de nível superior por meio de failover global rápido",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "As instâncias reservadas do Azure são usadas para otimizar o custo de uso da Solução VMware do Azure",
+ "waf": "Custar"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"severity": "Média",
- "text": "Usar o balanceamento de carga da camada de transporte",
- "waf": "Desempenho"
+ "text": "Considere o uso do Azure Private-Link ao usar outros Serviços Nativos do Azure",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
- "severity": "Média",
- "text": "Configurar o roteamento com base no host ou no nome de domínio para vários aplicativos Web em um único gateway",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Verifique se todos os recursos necessários residem na(s) mesma(s) zona(s) de disponibilidade do Azure",
+ "waf": "Desempenho"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"severity": "Média",
- "text": "Centralize o gerenciamento de certificados SSL para reduzir a sobrecarga de criptografia e descriptografia de um farm de servidores de back-end",
+ "text": "Habilitar cargas de trabalho de VM convidada do Microsoft Defender for Cloud for Azure VMware Solution",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "Baixo",
- "text": "Usar o Gateway de Aplicativo para obter suporte nativo para protocolos WebSocket e HTTP/2",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Usar servidores habilitados para Arc do Azure para gerenciar suas cargas de trabalho de VM convidada da Solução VMware do Azure",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
- "severity": "Média",
- "text": "Os Aplicativos Spring do Azure permitem duas implantações para cada aplicativo, apenas um dos quais recebe tráfego de produção. Você pode obter tempo de inatividade zero com estratégias de implantação em verde azul. A implantação verde azul só está disponível nas camadas Standard e Enterprise. Você pode automatizar a implantação usando CI/CD com ações do ADO/GitHub",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Habilitar o log de diagnóstico e de métrica na solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
"severity": "Média",
- "text": "As instâncias do Azure Spring Apps podem ser criadas em várias regiões para seus aplicativos e o tráfego pode ser roteado pelo Gerenciador de Tráfego/Front Door.",
- "waf": "Fiabilidade"
+ "text": "Implantar os agentes do Log Analytics nas cargas de trabalho da VM convidada da Solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
"severity": "Média",
- "text": "Na região com suporte, os Aplicativos Spring do Azure podem ser implantados como zona redundante, o que significa que as instâncias são distribuídas automaticamente entre zonas de disponibilidade. Esse recurso só está disponível nas camadas Standard e Enterprise.",
- "waf": "Fiabilidade"
+ "text": "Verifique se você tem uma política e uma solução de backup documentadas e implementadas para cargas de trabalho de VM da Solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"severity": "Média",
- "text": "Usar mais de 1 instância de aplicativo para seus aplicativos",
- "waf": "Fiabilidade"
+ "text": "Usar o Microsoft Defender for Cloud para monitoramento de conformidade de cargas de trabalho em execução no Azure VMware Solution",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
"severity": "Média",
- "text": "Monitore os Aplicativos Spring do Azure com logs, métricas e rastreamento. Integre o ASA com insights de aplicativos e rastreie falhas e crie pastas de trabalho.",
- "waf": "Fiabilidade"
+ "text": "São as linhas de base de conformidade aplicáveis adicionadas ao Microsoft Defender for Cloud",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
- "severity": "Média",
- "text": "Configurar o dimensionamento automático no Spring Cloud Gateway",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "A residência de dados foi avaliada ao selecionar regiões do Azure a serem usadas para a implantação da Solução VMware do Azure",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
- "severity": "Baixo",
- "text": "Habilite o dimensionamento automático para os aplicativos com o plano de consumo padrão e dedicado.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "As implicações do processamento de dados (modelo de prestador de serviços / consumidor de serviços) são claras e documentadas",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
- "checklist": "Azure Spring Apps Review",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"severity": "Média",
- "text": "Use o plano Enterprise para suporte comercial de inicialização spring para aplicativos de missão crítica. Com outras camadas, você obtém suporte a OSS.",
- "waf": "Fiabilidade"
+ "text": "Considere o uso de CMK (Customer Managed Key) para vSAN somente se necessário por motivo(s) de conformidade.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
"severity": "Alto",
- "text": "Siga as proteções do Metaprompting para uma IA razoável",
- "waf": "Excelência Operacional"
+ "text": "Criar painéis para habilitar os principais insights de monitoramento da Solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"severity": "Alto",
- "text": "Considere padrões de gateway com APIM ou soluções como AI central para melhor limitação de taxa, balanceamento de carga, autenticação e registro",
- "waf": "Excelência Operacional"
+ "text": "Criar alertas de aviso para limites críticos para alertas automáticos sobre o desempenho da solução VMware do Azure (CPU >80%, memória média >80%, vSAN >70%)",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
"severity": "Alto",
- "text": "Habilitar o monitoramento para suas instâncias AOAI",
- "waf": "Excelência Operacional"
+ "text": "Certifique-se de que o alerta crítico seja criado para monitorar se o consumo de vSAN está abaixo de 75%, pois esse é um limite de suporte do VMware",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"severity": "Alto",
- "text": "Crie alertas para notificar as equipes sobre eventos, como uma entrada no log de atividades criada por uma ação executada no recurso, como regenerar suas chaves de assinatura ou um limite de métrica, como o número de erros que excedem 10 em uma hora",
- "waf": "Excelência Operacional"
+ "text": "Verifique se os alertas estão configurados para alertas e notificações de Integridade do Serviço do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Monitore o uso do token para evitar interrupções de serviço devido à capacidade",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Configurar o log da Solução VMware do Azure para ser enviado a uma conta de Armazenamento do Azure ou ao Azure EventHub para processamento",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Observe métricas como tokens de inferência processados, monitoramento de tokens de conclusão gerados para limite de taxa",
- "waf": "Excelência Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
"severity": "Baixo",
- "text": "Se o diagnóstico não for suficiente para você, considere usar um gateway como o Gerenciamento de API do Azure na frente do Azure OpenAI para registrar prompts de entrada e respostas de saída, quando permitido",
- "waf": "Excelência Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Usar a infraestrutura como código para implantar o serviço OpenAI do Azure, implantações de modelo e todos os recursos relacionados",
- "waf": "Excelência Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Usar a autenticação do Microsoft Entra com identidade gerenciada em vez de chave de API",
- "waf": "Segurança"
+ "text": "Se for necessário um insight profundo no VMware vSphere: o vRealize Operations e/ou o vRealize Network Insights são usados na solução?",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"severity": "Alto",
- "text": "Avalie o desempenho/precisão do sistema com um conjunto de dados dourado conhecido que tenha as entradas e as respostas corretas. Aproveite os recursos do PromptFlow para avaliação.",
- "waf": "Excelência Operacional"
+ "text": "Verifique se a política de armazenamento vSAN para VMs NÃO é a política de armazenamento padrão, pois essa política aplica provisionamento espesso",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Avaliar o uso do modelo de taxa de transferência provisionada ",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Verifique se as bibliotecas de conteúdo do vSphere não são colocadas no vSAN, pois o vSAN é um recurso finito",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Examinar e implementar a segurança de conteúdo do Azure AI",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Certifique-se de que os repositórios de dados da solução de backup sejam armazenados fora do armazenamento vSAN. No nativo do Azure ou em um armazenamento de dados com backup de pool de discos",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Defina e avalie a taxa de transferência do sistema com base em tokens e resposta por minuto e alinhe-se aos requisitos",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam gerenciadas de forma híbrida usando o Azure Arc for Servers (a Solução VMware do Arc for Azure está em visualização)",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"severity": "Média",
- "text": "Melhore a latência do sistema limitando os tamanhos dos tokens, as opções de streaming",
- "waf": "Desempenho"
+ "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam monitoradas usando o Azure Log Analytics e o Azure Monitor",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"severity": "Média",
- "text": "Estime as demandas de elasticidade para determinar a segregação de solicitações síncronas e em lote com base na prioridade. Para alta prioridade, use a abordagem síncrona e, para baixa prioridade, o processamento em lote assíncrono com fila é preferível",
- "waf": "Desempenho"
+ "text": "Incluir cargas de trabalho em execução na Solução VMware do Azure nas ferramentas de gerenciamento de atualizações existentes ou no Gerenciamento de Atualizações do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Compare os requisitos de consumo de token com base nas demandas estimadas dos consumidores. Considere usar a ferramenta de benchmarking OpenAI do Azure para ajudá-lo a validar a taxa de transferência se você estiver usando implantações de Unidade de Produtividade Provisionada",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Usar a Política do Azure para integrar cargas de trabalho da Solução VMware do Azure nas soluções de Gerenciamento, Monitoramento e Segurança do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
"severity": "Média",
- "text": "Se você estiver usando PTUs (Unidades de Produtividade Provisionadas), considere implantar uma implantação de token por minuto (TPM) para solicitações de estouro. Use um gateway para rotear solicitações para a implantação do TPM quando os limites de PTU forem atingidos.",
- "waf": "Desempenho"
+ "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam integradas ao Microsoft Defender for Cloud",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Escolha o modelo certo para a tarefa certa. Escolha modelos com a compensação certa entre velocidade, qualidade de resposta e complexidade de saída",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Certifique-se de que os backups não sejam armazenados no vSAN, pois o vSAN é um recurso finito",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"severity": "Média",
- "text": "Tenha uma linha de base para o desempenho sem ajuste fino para saber se o ajuste fino melhorou ou não o desempenho do modelo",
- "waf": "Desempenho"
+ "text": "Todas as soluções de DR foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "Baixo",
- "text": "Implantar várias instâncias de OAI em regiões",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Usar o Azure Site Recovery quando a tecnologia de Recuperação de Desastres for IaaS nativa do Azure",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
"severity": "Alto",
- "text": "Implemente novas tentativas e verificações de integridade com o padrão de Gateway como APIM",
+ "text": "Use planos de recuperação automatizados com qualquer uma das soluções de desastre, evite ao máximo tarefas manuais",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"severity": "Média",
- "text": "Garantir que tenha cotas adequadas de TPM e RPM para a carga de trabalho",
+ "text": "Usar o par de regiões geopolíticas como o ambiente secundário de recuperação de desastres",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Revise as considerações nas diretrizes do kit de ferramentas HAI e aplique essas práticas de interação para a análise",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Use 2 espaços de endereço diferentes entre as regiões, por exemplo: 10.0.0.0/16 e 192.168.0.0/16 para as diferentes regiões",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
"severity": "Média",
- "text": "Implantar modelos ajustados separados entre regiões se o ajuste fino for empregado",
+ "text": "O ExpressRoute Global Reach será usado para conectividade entre as Nuvens Privadas da Solução VMware do Azure primária e secundária ou o roteamento é feito por meio de dispositivos virtuais de rede?",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
"severity": "Média",
- "text": "Faça backup e replique regularmente dados críticos para garantir a disponibilidade e a capacidade de recuperação dos dados em caso de perda de dados ou falhas do sistema. Aproveite os serviços de backup e recuperação de desastre do Azure para proteger seus dados.",
+ "text": "Todas as soluções de backup foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [ MABS/CommVault/Metallic.io/Veeam/ . ]",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "As camadas de serviço de pesquisa de IA do Azure devem ser escolhidas para ter um SLA ",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Implante sua solução de backup na mesma região que sua nuvem privada da Solução VMware do Azure",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Implante sua solução de backup fora do vSan, em componentes nativos do Azure",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
"severity": "Baixo",
- "text": "Classifique os dados e a confidencialidade, rotulando com o Microsoft Purview antes de gerar as inserções e certifique-se de tratar as inserções geradas com a mesma confidencialidade e classificação",
- "waf": "Segurança"
+ "text": "Existe um processo para solicitar uma restauração dos componentes VMware gerenciados pela Plataforma Azure?",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Criptografar dados usados para RAG com criptografia SSE/Disco com BYOK opcional",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Para implantações manuais, todas as configurações e implantações devem ser documentadas",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Certifique-se de que o TLS seja aplicado para dados em trânsito entre fontes de dados, pesquisa de IA usada para RG (Geração Aumentada por Recuperação) e comunicação LLM",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Para implantações manuais, considere implementar bloqueios de recursos para evitar ações acidentais em sua nuvem privada de solução VMware do Azure",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Use o RBAC para gerenciar o acesso aos serviços do OpenAI do Azure. Atribua permissões apropriadas aos usuários e restrinja o acesso com base em suas funções e responsabilidades",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Para implantações automatizadas, implante uma nuvem privada mínima e dimensione conforme necessário",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Implemente técnicas de criptografia, mascaramento ou redação de dados para ocultar dados confidenciais ou substituí-los por valores ofuscados em ambientes de não produção ou ao compartilhar dados para fins de teste ou solução de problemas",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Para implantações automatizadas, solicite ou reserve cota antes de iniciar a implantação",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Utilize o Azure Defender para detectar e responder a ameaças de segurança e configurar mecanismos de monitoramento e alerta para identificar atividades suspeitas ou violações. Aproveite o Azure Sentinel para detecção e resposta avançadas a ameaças",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Para implantação automatizada, verifique se os bloqueios de recursos relevantes são criados por meio da automação ou da Política do Azure para uma governança adequada",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Estabeleça políticas de retenção e descarte de dados para cumprir os regulamentos de conformidade. Implemente métodos de exclusão segura para dados que não são mais necessários e mantenha uma trilha de auditoria das atividades de retenção e descarte de dados",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Implemente nomes humanos compreensíveis para chaves de autorização ExR para permitir a fácil identificação da finalidade/uso das chaves",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Implementar proteções imediatas e detecção de aterramento usando a Segurança de conteúdo ",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Usar o Cofre de chaves para armazenar segredos e chaves de autorização quando Princípios de Serviço separados são usados para implantar a Solução VMware do Azure e a Rota Expressa",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Garanta a conformidade com os regulamentos de proteção de dados relevantes, como GDPR ou HIPAA, implementando controles de privacidade e obtendo os consentimentos ou permissões necessários para atividades de processamento de dados.",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Defina dependências de recursos para serializar ações no IaC quando muitos recursos precisarem ser implantados no/na Solução VMware do Azure, pois a Solução VMware do Azure oferece suporte apenas a um número limitado de operações paralelas.",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Eduque seus funcionários sobre as melhores práticas de segurança de dados, a importância de lidar com dados com segurança e os possíveis riscos associados a violações de dados. Incentive-os a seguir os protocolos de segurança de dados diligentemente.",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
+ "severity": "Baixo",
+ "text": "Ao executar a configuração automatizada de segmentos NSX-T com um único gateway de Camada 1, use as APIs do Portal do Azure em vez das APIs do NSX-Manager",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Mantenha os dados de produção separados dos dados de desenvolvimento e teste. Use apenas dados confidenciais reais na produção e utilize dados anônimos ou sintéticos em ambientes de desenvolvimento e teste.",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Ao pretender usar a expansão automatizada, certifique-se de aplicar cota suficiente da Solução VMware do Azure para as assinaturas que executam a Solução VMware do Azure",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"severity": "Média",
- "text": "Se você tiver níveis variados de confidencialidade de dados, considere criar índices separados para cada nível. Por exemplo, você pode ter um índice para dados gerais e outro para dados confidenciais, cada um regido por diferentes protocolos de acesso",
- "waf": "Segurança"
+ "text": "Ao pretender usar o scale-in automatizado, certifique-se de levar em consideração os requisitos da política de armazenamento antes de executar essa ação",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"severity": "Média",
- "text": "Leve a segregação um passo adiante, colocando conjuntos de dados confidenciais em diferentes instâncias do serviço. Cada instância pode ser controlada com seu próprio conjunto específico de políticas RBAC",
- "waf": "Segurança"
+ "text": "As operações de dimensionamento sempre precisam ser serializadas em um único SDDC, pois apenas uma operação de escala pode ser executada por vez (mesmo quando vários clusters são usados)",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Reconheça que incorporações e vetores gerados a partir de informações confidenciais são eles próprios sensíveis. Esses dados devem receber as mesmas medidas de proteção que o material de origem",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Considerar e validar operações de dimensionamento em soluções de terceiros 3rd usadas na arquitetura (suportadas ou não)",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Aplique o RBAC aos armazenamentos de dados com incorporações e vetores e acesso ao escopo com base nos requisitos de acesso da função",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Definir e impor limites máximos de entrada/saída de escala para seu ambiente nas automações",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Configurar o ponto de extremidade privado para serviços de IA para restringir o acesso ao serviço em sua rede",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Implementar regras de monitoramento para monitorar operações de dimensionamento automatizadas e monitorar o sucesso e a falha para habilitar respostas apropriadas (automatizadas)",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Imponha um controle estrito de tráfego de entrada e saída com o Firewall do Azure e UDRs e limite os pontos de integração externos",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Ao usar o MON, esteja ciente dos limites de VMs configuradas simulataneamente (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"severity": "Alto",
- "text": "Implemente segmentação de rede e controles de acesso para restringir o acesso ao aplicativo LLM apenas a usuários e sistemas autorizados e evitar movimentos laterais",
- "waf": "Segurança"
+ "text": "Ao usar o MON, você não pode habilitar o MON em mais de 100 extensões de rede",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"severity": "Média",
- "text": "Use ferramentas de compactação imediatas como LLMLingua ou gprtrim",
- "waf": "Otimização de custos"
+ "text": "Se estiver usando uma conexão VPN para migrações, ajuste o tamanho da MTU de acordo.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Certifique-se de que as APIs e os endpoints usados pelo aplicativo LLM estejam devidamente protegidos com mecanismos de autenticação e autorização, como identidades gerenciadas, chaves de API ou OAuth, para impedir o acesso não autorizado.",
- "waf": "Segurança"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Para regiões de baixa conectividade conectadas ao Azure (500Mbps ou menos), considere implantar o dispositivo de otimização de WAN HCX",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
"severity": "Média",
- "text": "Aplique mecanismos fortes de autenticação do usuário final, como autenticação multifator, para impedir o acesso não autorizado ao aplicativo LLM e aos recursos de rede associados",
- "waf": "Segurança"
+ "text": "Certifique-se de que as migrações sejam iniciadas a partir do dispositivo local e NÃO do dispositivo em nuvem (NÃO execute uma migração reversa)",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"severity": "Média",
- "text": "Implemente ferramentas de monitoramento de rede para detectar e analisar o tráfego de rede em busca de atividades suspeitas ou maliciosas. Habilite o registro para capturar eventos de rede e facilitar a análise forense em caso de incidentes de segurança",
- "waf": "Segurança"
+ "text": "Quando o Azure Netapp Files for usado para estender o armazenamento para a Solução VMware do Azure, considere usá-lo como um armazenamento de dados VMware em vez de anexá-lo diretamente a uma VM.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"severity": "Média",
- "text": "Realize auditorias de segurança e testes de penetração para identificar e resolver quaisquer pontos fracos ou vulnerabilidades de segurança de rede na infraestrutura de rede do aplicativo LLM",
- "waf": "Segurança"
+ "text": "Verifique se um ExpressRoute Gateway dedicado está sendo usado para soluções de armazenamento de dados externos",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "severity": "Baixo",
- "text": "Os Serviços de IA do Azure são marcados corretamente para melhor gerenciamento",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
+ "severity": "Média",
+ "text": "Verifique se o FastPath está habilitado no ExpressRoute Gateway que está sendo usado para soluções de armazenamento de dados externos",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
- "severity": "Baixo",
- "text": "As contas do Serviço de IA do Azure seguem as convenções de nomenclatura organizacional",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
+ "severity": "Alto",
+ "text": "Se estiver usando cluster estendido, verifique se a solução de recuperação de desastres selecionada é suportada pelo fornecedor",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
"severity": "Alto",
- "text": "Os logs de diagnóstico nos recursos de serviços de IA do Azure devem ser habilitados",
- "waf": "Excelência Operacional"
+ "text": "Se estiver usando cluster estendido, verifique se o SLA fornecido atenderá aos seus requisitos",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
"severity": "Alto",
- "text": "Recomenda-se que o acesso à chave (autenticação local) seja desabilitado por segurança. Depois de desabilitar o acesso baseado em chave, o Microsoft Entra ID se torna o único método de acesso, o que permite manter o princípio de privilégio mínimo e o controle granular. ",
- "waf": "Segurança"
+ "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa estão conectados ao hub de conectividade.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"severity": "Alto",
- "text": "Armazene e gerencie chaves com segurança usando o Azure Key Vault. Evite codificar ou inserir chaves confidenciais no código do aplicativo LLM e recuperá-las com segurança do Azure Key Vault usando identidades gerenciadas",
- "waf": "Segurança"
+ "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa têm o GlobalReach habilitado.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
"severity": "Alto",
- "text": "Gire e expire regularmente as chaves armazenadas no Azure Key Vault para minimizar o risco de acesso não autorizado.",
- "waf": "Segurança"
+ "text": "Faça com que as configurações de tolerância a desastres do site tenham sido devidamente consideradas e alteradas para sua empresa, se necessário.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Use tiktoken para entender os tamanhos de token para otimizações de token no modo de conversação",
- "waf": "Otimização de custos"
+ "text": "Familiarize-se com as práticas recomendadas do Key Vault, como recomendações de isolamento, controle de acesso, proteção de dados, backup e registro em log.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Siga práticas de codificação segura para evitar vulnerabilidades comuns, como ataques de injeção, cross-site scripting (XSS) ou configurações incorretas de segurança",
- "waf": "Segurança"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "O Key Vault é um serviço gerenciado e a Microsoft lidará com o failover dentro e entre regiões. Familiarize-se com a disponibilidade e a redundância do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Configure um processo para atualizar e corrigir regularmente as bibliotecas LLM e outros componentes do sistema",
- "waf": "Segurança"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "O conteúdo do cofre de chaves é replicado dentro da região e para uma região secundária a pelo menos 150 milhas de distância, mas dentro da mesma geografia para manter a alta durabilidade de suas chaves e segredos. Familiarize-se com a replicação de dados do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
- "severity": "Alto",
- "text": "Aderir aos termos de uso, políticas e diretrizes do Azure OpenAI ou de outros LLMs e casos de uso permitidos",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Durante o failover, as configurações e configurações de política de acesso ou firewall não podem ser alteradas. O cofre de chaves estará no modo somente leitura durante o failover. Familiarize-se com as diretrizes de failover do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Entender a diferença no custo de modelos básicos e modelos ajustados e tamanhos de etapa de token",
- "waf": "Otimização de custos"
+ "text": "Quando você faz backup de um objeto do cofre de chaves, como um segredo, uma chave ou um certificado, a operação de backup baixa o objeto como um blob criptografado. Esse blob não pode ser descriptografado fora do Azure. Para obter dados utilizáveis desse blob, você deve restaurar o blob em um cofre de chaves dentro da mesma assinatura do Azure e da mesma geografia do Azure. Familiarize-se com as diretrizes de backup e restauração do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Solicitações em lote, sempre que possível, para minimizar a sobrecarga por chamada, o que pode reduzir os custos gerais. Certifique-se de otimizar o tamanho do lote",
- "waf": "Otimização de custos"
+ "text": "Se você quiser proteção contra exclusão acidental ou mal-intencionada de seus segredos, configure recursos de proteção de exclusão reversível e limpeza em seu cofre de chaves.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Configure um sistema de rastreamento de custos que monitore o uso do modelo e use essas informações para ajudar a informar as escolhas do modelo e solicitar tamanhos",
- "waf": "Otimização de custos"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "Baixo",
+ "text": "Os recursos excluídos temporariamente do Key Vault são retidos por um período definido de 90 dias corridos. Familiarize-se com as diretrizes de exclusão reversível do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Defina um limite máximo para o número de tokens por resposta do modelo. Otimize o tamanho para garantir que seja grande o suficiente para uma resposta válida",
- "waf": "Otimização de custos"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Baixo",
+ "text": "Entenda as limitações de backup do Key Vault. O Key Vault não dá suporte à capacidade de fazer backup de mais de 500 versões anteriores de um objeto de chave, segredo ou certificado. A tentativa de fazer backup de uma chave, segredo ou objeto de certificado pode resultar em um erro. Não é possível excluir versões anteriores de uma chave, segredo ou certificado.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Examine as diretrizes fornecidas sobre como configurar a pesquisa de IA para confiabilidade",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "Baixo",
+ "text": "Atualmente, o Key Vault não fornece uma maneira de fazer backup de um cofre de chaves inteiro em uma única operação e chaves, segredos e certificados devem ser copiados individualmente. Familiarize-se com as diretrizes de backup e restauração do Key Vault.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Planejar e gerenciar o armazenamento de vetores do AI Search",
- "waf": "Excelência Operacional"
+ "text": "A proteção contra limpeza é recomendada ao usar chaves para criptografia para evitar a perda de dados. A proteção contra limpeza é um comportamento opcional do Key Vault e não está habilitada por padrão. A proteção contra limpeza só pode ser habilitada depois que a exclusão reversível estiver habilitada. Ele pode ser ativado via CLI, PowerShell ou Portal.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Aplique as práticas do LLMOps para automatizar o gerenciamento do ciclo de vida de seus aplicativos GenAI",
- "waf": "Excelência Operacional"
+ "text": "O RBAC é recomendado para controlar o acesso ao cofre de chaves. Familiarize-se com as diretrizes de controle de acesso do Key Vault.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "Alto",
- "text": "Avalie o uso de modelos de faturamento - PAYG vs PTU",
- "waf": "Otimização de custos"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Avaliar a qualidade de prompts e aplicativos ao alternar entre versões de modelo",
- "waf": "Excelência Operacional"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Avalie, monitore e refine seus aplicativos GenAI para recursos como fundamentação, relevância, precisão, coerência, fluência,",
- "waf": "Excelência Operacional"
+ "text": "Permitir que 2 réplicas tenham 99,9% de disponibilidade para operações de leitura",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "Média",
- "text": "Avaliar os resultados do Azure AI Search com base em diferentes parâmetros de pesquisa",
- "waf": "Excelência Operacional"
+ "text": "Permitir que 3 réplicas tenham 99,9% de disponibilidade para operações de leitura/gravação",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Olhe para os modelos de ajuste fino como forma de aumentar a precisão somente quando você tiver tentado outras abordagens básicas, como engenharia rápida e RAG com seus dados",
- "waf": "Excelência Operacional"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "severity": "Alto",
+ "text": "Aproveite as zonas de disponibilidade habilitando réplicas de leitura e/ou gravação",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "Média",
- "text": "Use técnicas de engenharia rápida para melhorar a precisão das respostas do LLM",
- "waf": "Excelência Operacional"
+ "text": "Para redução regional, crie manualmente serviços em 2 ou mais regiões para a Pesquisa, pois não fornece um método automatizado de replicação de índices de pesquisa entre regiões geográficas",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"severity": "Média",
- "text": "Equipe vermelha de seus aplicativos GenAI",
- "waf": "Segurança"
+ "text": "Para sincronizar dados em vários serviços: Use indexadores para atualizar conteúdo em vários serviços ou Use APIs REST para enviar atualizações de conteúdo em vários serviços",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"severity": "Média",
- "text": "Forneça aos usuários finais opções de pontuação para respostas LLM e acompanhe essas pontuações. ",
- "waf": "Excelência Operacional"
+ "text": "Usar o Gerenciador de Tráfego do Azure para coordenar solicitações",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"severity": "Alto",
- "text": "Considere as práticas de gerenciamento de cotas",
- "waf": "Otimização de custos"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
- "severity": "Média",
- "text": "Use soluções de balanceador de carga, como gateway baseado em APIM, para balancear carga e capacidade entre serviços e regiões",
- "waf": "Excelência Operacional"
+ "text": "Backup e restauração de um índice de pesquisa cognitiva do Azure. Use este código de exemplo para fazer backup da definição de índice e instantâneo em uma série de arquivos Json",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
"severity": "Média",
- "text": "Aproveite o servidor flexível",
+ "text": "Aproveite o Manual de Resiliência de FTA para o Azure Data Factory",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "Alto",
- "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente",
+ "text": "Usar pipelines redundantes de zona em regiões que oferecem suporte a zonas de disponibilidade",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
"severity": "Média",
- "text": "Aproveite a replicação de dados para cenários de DR entre regiões",
+ "text": "Usar DevOps para fazer backup dos modelos ARM com a integração Github/Azure DevOps ",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
- "severity": "Alto",
- "text": "Verifique se os controladores de domínio ADDS estão implantados na assinatura de identidade no Azure nativo",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "Média",
- "text": "Verifique se os sites e serviços do ADDS estão configurados para manter as solicitações de autenticação de recursos baseados no Azure (incluindo a Solução VMware do Azure) locais para o Azure",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
- "severity": "Alto",
- "text": "Verifique se o vCenter está conectado ao ADDS para habilitar a autenticação com base em 'contas de usuário nomeadas'",
- "waf": "Segurança"
+ "text": "Certifique-se de replicar as VMs do Self-Hosted Integration Runtime em outra região ",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "Média",
- "text": "Verifique se a conexão do vCenter com o ADDS está usando um protocolo seguro (LDAPS)",
- "waf": "Segurança"
+ "text": "Certifique-se de replicar ou duplicar sua rede na região irmã. Você tem que fazer uma cópia do seu Vnet em outra região",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
- "severity": "Média",
- "text": "A conta do CloudAdmin no vCenter IdP é usada apenas como uma conta de emergência (break-glass)",
- "waf": "Segurança"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "Se seus pipelines do ADF usarem o Cofre de Chaves, você não precisará fazer nada para replicar o Cofre de Chaves. O Cofre de Chaves é um serviço gerenciado e a Microsoft cuida dele para você",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
+ "severity": "Baixo",
+ "text": "Se estiver usando a integração do Keyvault, use o SLA do Keyvault para entender sua disponibilidade",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"severity": "Alto",
- "text": "Certifique-se de que o NSX-Manager esteja integrado a um provedor de identidade externo (LDAPS)",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
- "severity": "Média",
- "text": "Foi criado um modelo RBAC para uso no VMware vSphere",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
- "severity": "Média",
- "text": "As permissões RBAC devem ser concedidas em grupos ADDS e não em usuários específicos",
- "waf": "Segurança"
+ "text": "Selecione o plano de hospedagem de função certo com base em seus requisitos de negócios e SLO",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"severity": "Alto",
- "text": "As permissões RBAC no recurso Solução VMware do Azure no Azure são 'bloqueadas' apenas para um conjunto limitado de proprietários",
- "waf": "Segurança"
+ "text": "Aproveitar zonas de disponibilidade quando aplicável regionalmente (não disponível para a camada de consumo)",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
- "severity": "Alto",
- "text": "Certifique-se de que todas as funções personalizadas tenham escopo com autorizações permitidas do CloudAdmin",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
+ "severity": "Média",
+ "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
"severity": "Alto",
- "text": "O modelo de conectividade correto da Solução VMware do Azure está selecionado para o caso de uso do cliente em mãos?",
- "waf": "Desempenho"
+ "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "Azure Functions",
"severity": "Alto",
- "text": "Garantir que as conexões de Rota Expressa ou VPN do local para o Azure sejam monitoradas usando o 'monitor de conexão'",
- "waf": "Operações"
+ "text": "Verifique se 'Sempre Ativado' está habilitado para todos os Aplicativos de Função em execução no Plano do Serviço de Aplicativo",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"severity": "Média",
- "text": "Verifique se um monitor de conexão foi criado a partir de um recurso nativo do Azure para uma máquina virtual da Solução VMware do Azure para monitorar a conexão de Rota Expressa de back-end da Solução VMware do Azure",
- "waf": "Operações"
+ "text": "Emparelhe um aplicativo de função com sua própria conta de armazenamento. Tente não reutilizar contas de armazenamento para aplicativos de função, a menos que eles estejam firmemente acoplados",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
"severity": "Média",
- "text": "Verifique se um monitor de conexão é criado a partir de um recurso local para uma máquina virtual da Solução VMware do Azure para monitorar a conectividade de ponta 2",
+ "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código do Aplicativo de Função",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
- "severity": "Alto",
- "text": "Quando o servidor de rotas for usado, certifique-se de que não mais de 1000 rotas sejam propagadas do servidor de rotas para o gateway ExR para o local (limite ARS).",
- "waf": "Operações"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "O Hub de Eventos do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "Baixo",
+ "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
- "severity": "Alto",
- "text": "O Gerenciamento de Identidades Privilegiadas é implementado para funções que gerenciam o recurso da Solução VMware do Azure no Portal do Azure (não são permitidas permissões permanentes)",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Os namespaces dos Hubs de Eventos do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace dos Hubs de Eventos para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS. Se um namespace de Hubs de Eventos exigir uma versão mínima do TLS, todas as solicitações feitas com uma versão mais antiga falharão. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
+ "severity": "Média",
+ "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
- "severity": "Alto",
- "text": "Os relatórios de auditoria do Gerenciamento de Identidades Privilegiadas devem ser implementados para as funções PIM da Solução VMware do Azure",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Quando você cria um namespace de Hubs de Eventos, uma regra de política chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
+ "severity": "Média",
+ "text": "Evite usar conta root quando não for necessário",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "As identidades gerenciadas para recursos do Azure podem autorizar o acesso a recursos dos Hubs de Eventos usando credenciais do Azure AD de aplicativos em execução em VMs (Máquinas Virtuais) do Azure, aplicativos de Função, Conjuntos de Dimensionamento de Máquina Virtual e outros serviços. Usando identidades gerenciadas para recursos do Azure junto com a autenticação do Azure AD, você pode evitar o armazenamento de credenciais com seus aplicativos executados na nuvem. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "Se o uso do Gerenciamento de Identidades Privilegiadas estiver sendo usado, certifique-se de que uma conta válida habilitada para ID do Entra seja criada com um registro SMTP válido para notificações de substituição automática do Host da Solução VMware do Azure. (permissões permanentes necessárias)",
+ "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Hub de Eventos do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre de Chaves do Azure ou em um serviço equivalente",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Hub de Eventos do Azure. As permissões no Hub de Eventos do Azure podem e devem ter o escopo definido para o nível de recurso individual, por exemplo, grupo de consumidores, entidade de hub de eventos, namespaces de hub de eventos, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"severity": "Alto",
- "text": "Limitar o uso da conta do CloudAdmin apenas ao acesso de emergência",
+ "text": "Usar RBAC do plano de dados de privilégios mínimos",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Os logs de recursos do Hub de Eventos do Azure incluem logs operacionais, logs de rede virtual e logs de Kafka. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para todas as operações de acesso ao plano de dados (como eventos de envio ou recebimento) nos Hubs de Eventos.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "Criar funções RBAC personalizadas no vCenter para implementar um modelo de privilégios mínimos dentro do vCenter",
+ "text": "Habilite o registro em log para investigação de segurança. Use o Azure Monitor para capturar métricas e logs como logs de recursos, logs de auditoria de tempo de execução e logs Kafka",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Por padrão, o Hub de Eventos do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Hub de Eventos do Azure percorra a rede de backbone da Microsoft. Além disso, você deve desabilitar os pontos de extremidade públicos se eles não forem usados. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "É um processo definido para alternar regularmente as credenciais cloudadmin (vCenter) e admin (NSX)",
+ "text": "Considere o uso de pontos de extremidade privados para acessar o Hub de Eventos do Azure e desabilitar o acesso à rede pública quando aplicável.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
- "severity": "Alto",
- "text": "Usar um provedor de identidade centralizado a ser usado para cargas de trabalho (VMs) em execução na Solução VMware do Azure",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Com o firewall IP, você pode restringir ainda mais o ponto de extremidade público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
+ "severity": "Média",
+ "text": "Considere permitir apenas o acesso ao namespace do Hub de Eventos do Azure a partir de endereços IP ou intervalos específicos",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "A filtragem de tráfego Leste-Oeste é implementada no NSX-T",
- "waf": "Segurança"
+ "text": "Aproveite o Manual de Resilência do FTA",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": " Isso será ativado automaticamente para um novo namespace de EH criado a partir do portal com SKUs Premium, Dedicado ou Standard em uma região habilitada para região. Os metadados do EH e os próprios dados do evento são replicados entre zonas",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"severity": "Alto",
- "text": "As cargas de trabalho na Solução VMware do Azure não são diretamente expostas à Internet. O tráfego é filtrado e inspecionado pelo Gateway de Aplicativo do Azure, pelo Firewall do Azure ou por soluções de terceiros",
- "waf": "Segurança"
+ "text": "Aproveite as zonas de disponibilidade, se aplicável regionalmente",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
+ "severity": "Média",
+ "text": "Use os SKUs Premium ou Dedicado para desempenho previsível",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "O recurso interno de recuperação de desastres geográficos, quando habilitado, garante que toda a configuração de um namespace (Hubs de Eventos, Grupos de Consumidores e configurações) seja replicada continuamente de um namespace primário para um namespace secundário e permite uma movimentação de failover única do primário para o secundário a qualquer momento. O recurso Ativo/Passivo foi projetado para facilitar a recuperação e o abandono de uma região do Azure com falha sem precisar alterar as configurações do aplicativo",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"severity": "Alto",
- "text": "A auditoria e o registro em log são implementados para solicitações de entrada da Internet para cargas de trabalho baseadas na Solução VMware do Azure e na Solução VMware do Azure",
- "waf": "Segurança"
+ "text": "Planejar a recuperação de desastres geográficos usando a configuração passiva ativa",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Deve ser usado para configurações de DR em que uma interrupção ou perda de dados de eventos na região derrubada não pode ser tolerada. Para esses casos, siga as diretrizes de replicação e não use o recurso interno de recuperação de desastres geográficos (ativo/passivo). Com Ativo/Ativo, mantenha vários Hubs de Eventos em diferentes regiões e namespaces, e os eventos serão replicados entre os hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "O monitoramento de sessão é implementado para conexões de saída da Internet a partir da Solução VMware do Azure ou cargas de trabalho baseadas na Solução VMware do Azure para identificar atividades suspeitas/mal-intencionadas",
- "waf": "Segurança"
+ "text": "Para aplicativos críticos para os negócios, use a configuração ativa",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "Média",
- "text": "A proteção padrão contra DDoS está habilitada na sub-rede do Gateway ExR/VPN no Azure",
- "waf": "Segurança"
+ "text": "Projetar Hubs de Eventos Resilientes",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"severity": "Média",
- "text": "Usar uma estação de trabalho de acesso privilegiado (PAW) dedicada para gerenciar a Solução VMware do Azure, o vCenter, o gerenciador NSX e o gerenciador HCX",
- "waf": "Segurança"
+ "text": "Implementar uma política de tratamento de erros em nível global",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"severity": "Média",
- "text": "Habilitar a Detecção Avançada de Ameaças (Microsoft Defender for Cloud, também conhecido como ASC) para cargas de trabalho em execução na Solução VMware do Azure",
- "waf": "Segurança"
+ "text": "Certifique-se de que todas as políticas de APIs incluam um elemento .",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"severity": "Média",
- "text": "Usar o Azure ARC for Servers para controlar corretamente as cargas de trabalho em execução na Solução VMware do Azure usando tecnologias nativas do Azure (o Azure ARC for Azure VMware Solution ainda não está disponível)",
- "waf": "Segurança"
+ "text": "Usar fragmentos de política para evitar a repetição das mesmas definições de políticas em várias APIs",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Garanta que as cargas de trabalho na Solução VMware do Azure usem criptografia de dados suficiente durante o tempo de execução (como criptografia de disco convidado e SQL TDE). (a criptografia vSAN em repouso é padrão)",
- "waf": "Segurança"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Se você estiver planejando monetizar suas APIs, consulte o artigo 'suporte à monetização' para obter as práticas recomendadas",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Quando a criptografia no convidado é usada, armazene chaves de criptografia no cofre de chaves do Azure quando possível",
- "waf": "Segurança"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Habilitar Configurações de Diagnóstico para exportar logs para o Azure Monitor",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "Média",
- "text": "Considere usar o suporte estendido de atualização de segurança para cargas de trabalho em execução na Solução VMware do Azure (a Solução VMware do Azure é qualificada para ESU)",
- "waf": "Segurança"
+ "text": "Habilite o Application Insights para telemetria mais detalhada",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "Alto",
- "text": "Certifique-se de que o método de redundância de dados vSAN apropriado seja usado (especificação RAID)",
- "waf": "Fiabilidade"
+ "text": "Configurar alertas sobre as métricas mais críticas",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"severity": "Alto",
- "text": "Certifique-se de que a política de falha na tolerância esteja em vigor para atender às suas necessidades de armazenamento vSAN",
- "waf": "Fiabilidade"
+ "text": "Certifique-se de que os certificados SSL personalizados sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"severity": "Alto",
- "text": "Certifique-se de ter solicitado cota suficiente, garantindo que você tenha considerado o crescimento e o requisito de recuperação de desastres",
- "waf": "Fiabilidade"
+ "text": "Proteger solicitações de entrada para APIs (plano de dados) com o Azure AD",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"severity": "Média",
- "text": "Certifique-se de que as restrições de acesso ao ESXi sejam compreendidas, há limites de acesso que podem afetar as soluções de terceiros 3rd.",
- "waf": "Operações"
+ "text": "Usar o Microsoft Entra ID para autenticar usuários no Portal do Desenvolvedor",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"severity": "Média",
- "text": "Certifique-se de ter uma política em torno da densidade e eficiência do host ESXi, tendo em mente o prazo de espera para solicitar novos nós",
- "waf": "Operações"
+ "text": "Criar grupos apropriados para controlar a visibilidade dos produtos",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"severity": "Média",
- "text": "Garantir que um bom processo de gerenciamento de custos esteja em vigor para a Solução VMware do Azure - o Gerenciamento de Custos do Azure pode ser usado",
- "waf": "Custar"
+ "text": "Use o recurso Back-ends para eliminar configurações redundantes de back-end de API",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
- "severity": "Baixo",
- "text": "As instâncias reservadas do Azure são usadas para otimizar o custo de uso da Solução VMware do Azure",
- "waf": "Custar"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Usar Valores Nomeados para armazenar valores comuns que podem ser usados em políticas",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"severity": "Média",
- "text": "Considere o uso do Azure Private-Link ao usar outros Serviços Nativos do Azure",
- "waf": "Segurança"
+ "text": "Para DR, aproveite o nível premium com implantações dimensionadas em duas ou mais regiões para um SLA de 99,99%",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
- "severity": "Alto",
- "text": "Verifique se todos os recursos necessários residem na(s) mesma(s) zona(s) de disponibilidade do Azure",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Implante pelo menos uma unidade em duas ou mais zonas de disponibilidade para um SLA aumentado de 99,99%",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
- "severity": "Média",
- "text": "Habilitar cargas de trabalho de VM convidada do Microsoft Defender for Cloud for Azure VMware Solution",
- "waf": "Segurança"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Verifique se há uma rotina de backup automatizada",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "Média",
- "text": "Usar servidores habilitados para Arc do Azure para gerenciar suas cargas de trabalho de VM convidada da Solução VMware do Azure",
- "waf": "Segurança"
+ "text": "Use Políticas para adicionar uma URL de back-end de failover e cache para reduzir chamadas com falha.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
- "severity": "Alto",
- "text": "Habilitar o log de diagnóstico e de métrica na solução VMware do Azure",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
+ "severity": "Baixo",
+ "text": "Se você precisar registrar em níveis de alto desempenho, considere a política de Hubs de Eventos",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"severity": "Média",
- "text": "Implantar os agentes do Log Analytics nas cargas de trabalho da VM convidada da Solução VMware do Azure",
- "waf": "Operações"
+ "text": "Aplicar políticas de limitação para controlar o número de solicitações por segundo",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"severity": "Média",
- "text": "Verifique se você tem uma política e uma solução de backup documentadas e implementadas para cargas de trabalho de VM da Solução VMware do Azure",
- "waf": "Operações"
+ "text": "Configurar o dimensionamento automático para dimensionar o número de instâncias quando a carga aumenta",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"severity": "Média",
- "text": "Usar o Microsoft Defender for Cloud para monitoramento de conformidade de cargas de trabalho em execução no Azure VMware Solution",
- "waf": "Segurança"
+ "text": "Implante gateways auto-hospedados onde o Azure não tem uma região próxima às APIs de back-end.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"severity": "Média",
- "text": "São as linhas de base de conformidade aplicáveis adicionadas ao Microsoft Defender for Cloud",
- "waf": "Segurança"
+ "text": "Use a camada premium para cargas de trabalho de produção.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "No modelo de várias regiões, use Políticas para rotear as solicitações para back-ends regionais com base na disponibilidade ou latência.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
"severity": "Alto",
- "text": "A residência de dados foi avaliada ao selecionar regiões do Azure a serem usadas para a implantação da Solução VMware do Azure",
- "waf": "Segurança"
+ "text": "Esteja atento aos limites da APIM",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"severity": "Alto",
- "text": "As implicações do processamento de dados (modelo de prestador de serviços / consumidor de serviços) são claras e documentadas",
+ "text": "Certifique-se de que as implantações de gateway auto-hospedado sejam resilientes.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Usar o Azure Front Door na frente do APIM para implantação em várias regiões",
+ "waf": "Desempenho"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Implantar o serviço em uma rede virtual (VNet)",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
"severity": "Média",
- "text": "Considere o uso de CMK (Customer Managed Key) para vSAN somente se necessário por motivo(s) de conformidade.",
+ "text": "Implante NSG (grupos de segurança de rede) em suas sub-redes para restringir ou monitorar o tráfego de/para APIM.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
- "severity": "Alto",
- "text": "Criar painéis para habilitar os principais insights de monitoramento da Solução VMware do Azure",
- "waf": "Operações"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Implante pontos de extremidade privados para filtrar o tráfego de entrada quando o APIM não for implantado em uma rede virtual.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"severity": "Alto",
- "text": "Criar alertas de aviso para limites críticos para alertas automáticos sobre o desempenho da solução VMware do Azure (CPU >80%, memória média >80%, vSAN >70%)",
- "waf": "Operações"
+ "text": "Desabilitar o acesso à rede pública",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
- "severity": "Alto",
- "text": "Certifique-se de que o alerta crítico seja criado para monitorar se o consumo de vSAN está abaixo de 75%, pois esse é um limite de suporte do VMware",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Simplifique o gerenciamento com scripts de automação do PowerShell",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
- "severity": "Alto",
- "text": "Verifique se os alertas estão configurados para alertas e notificações de Integridade do Serviço do Azure",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Configure APIM via Infrastructure-as-code. Analise as práticas recomendadas de DevOps do Cloud Adaption Framework APIM Landing Zone Accelerator",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
"severity": "Média",
- "text": "Configurar o log da Solução VMware do Azure para ser enviado a uma conta de Armazenamento do Azure ou ao Azure EventHub para processamento",
+ "text": "Promover o uso da extensão API do Visual Studio Code para um desenvolvimento de API mais rápido",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Se for necessário um insight profundo no VMware vSphere: o vRealize Operations e/ou o vRealize Network Insights são usados na solução?",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "Implemente DevOps e CI/CD em seu fluxo de trabalho",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
- "severity": "Alto",
- "text": "Verifique se a política de armazenamento vSAN para VMs NÃO é a política de armazenamento padrão, pois essa política aplica provisionamento espesso",
- "waf": "Operações"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
+ "severity": "Média",
+ "text": "APIs seguras usando autenticação de certificado de cliente",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"severity": "Média",
- "text": "Verifique se as bibliotecas de conteúdo do vSphere não são colocadas no vSAN, pois o vSAN é um recurso finito",
- "waf": "Operações"
+ "text": "Serviços de back-end seguros usando autenticação de certificado de cliente",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
"severity": "Média",
- "text": "Certifique-se de que os repositórios de dados da solução de backup sejam armazenados fora do armazenamento vSAN. No nativo do Azure ou em um armazenamento de dados com backup de pool de discos",
- "waf": "Operações"
+ "text": "Consulte o artigo \"Recomendações para mitigar as 10 principais ameaças da segurança da API OWASP\" e verifique o que é aplicável às suas APIs",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"severity": "Média",
- "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam gerenciadas de forma híbrida usando o Azure Arc for Servers (a Solução VMware do Arc for Azure está em visualização)",
- "waf": "Operações"
+ "text": "Usar o recurso Autorizações para simplificar o gerenciamento do token OAuth 2.0 para suas APIs de back-end",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
- "severity": "Média",
- "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam monitoradas usando o Azure Log Analytics e o Azure Monitor",
- "waf": "Operações"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Use a versão mais recente do TLS ao criptografar informações em trânsito. Desative protocolos e cifras desatualizados e desnecessários quando possível.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
- "severity": "Média",
- "text": "Incluir cargas de trabalho em execução na Solução VMware do Azure nas ferramentas de gerenciamento de atualizações existentes ou no Gerenciamento de Atualizações do Azure",
- "waf": "Operações"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Certifique-se de que os segredos (valores nomeados) sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
"severity": "Média",
- "text": "Usar a Política do Azure para integrar cargas de trabalho da Solução VMware do Azure nas soluções de Gerenciamento, Monitoramento e Segurança do Azure",
- "waf": "Operações"
+ "text": "Use identidades gerenciadas para autenticar em outros recursos do Azure sempre que possível",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
- "severity": "Média",
- "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam integradas ao Microsoft Defender for Cloud",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
+ "severity": "Alto",
+ "text": "Usar o WAF (Web Application Firewall) implantando o Application Gateway na frente do APIM",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"severity": "Média",
- "text": "Certifique-se de que os backups não sejam armazenados no vSAN, pois o vSAN é um recurso finito",
+ "text": "Use o token revogável de longa duração, armazene seu token em cache e adquira o token silenciosamente usando a Microsoft Identity Library",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "Média",
- "text": "Todas as soluções de DR foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [SRM/JetStream/Zerto/Veeam/...]",
+ "text": "Certifique-se de que os fluxos de usuário de entrada sejam armazenados em backup e resilientes. Certifique-se de que o código que você usa para entrar em seus usuários é de backup e recuperável. Interfaces resilientes com processos externos",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"severity": "Média",
- "text": "Usar o Azure Site Recovery quando a tecnologia de Recuperação de Desastres for IaaS nativa do Azure",
- "waf": "Fiabilidade"
+ "text": "Os ativos de marca personalizados devem ser hospedados em uma CDN",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
- "severity": "Alto",
- "text": "Use planos de recuperação automatizados com qualquer uma das soluções de desastre, evite ao máximo tarefas manuais",
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "Baixo",
+ "text": "Ter vários provedores de identidade (ou seja, fazer login com suas contas da Microsoft, Google, Facebook)",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Média",
- "text": "Usar o par de regiões geopolíticas como o ambiente secundário de recuperação de desastres",
+ "text": "Siga as regras de VM para alta disponibilidade no nível da VM (discos premium, dois ou mais em uma região, em zonas de disponibilidade diferentes)",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
- "severity": "Alto",
- "text": "Use 2 espaços de endereço diferentes entre as regiões, por exemplo: 10.0.0.0/16 e 192.168.0.0/16 para as diferentes regiões",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "Média",
+ "text": "Não replique! A replicação pode criar problemas com a sincronização de diretórios",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "Média",
- "text": "O ExpressRoute Global Reach será usado para conectividade entre as Nuvens Privadas da Solução VMware do Azure primária e secundária ou o roteamento é feito por meio de dispositivos virtuais de rede?",
+ "text": "Ter ativo-ativo para várias regiões",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Média",
- "text": "Todas as soluções de backup foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [ MABS/CommVault/Metallic.io/Veeam/ . ]",
+ "text": "Adicionar carimbos de serviço de Domínio do Azure AD a regiões e locais adicionais",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "Média",
- "text": "Implante sua solução de backup na mesma região que sua nuvem privada da Solução VMware do Azure",
+ "text": "Usar conjuntos de réplicas para DR",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
- "severity": "Média",
- "text": "Implante sua solução de backup fora do vSan, em componentes nativos do Azure",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
+ "severity": "Alto",
+ "text": "Habilite a redundância de zona para o Cache do Azure para Redis. O Cache do Azure para Redis dá suporte a configurações redundantes de zona nas camadas Premium e Enterprise. Um cache redundante de zona pode colocar seus nós em diferentes zonas de disponibilidade do Azure na mesma região. Ele elimina a interrupção do data center ou AZ como um único ponto de falha e aumenta a disponibilidade geral do cache.",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Existe um processo para solicitar uma restauração dos componentes VMware gerenciados pela Plataforma Azure?",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Para implantações manuais, todas as configurações e implantações devem ser documentadas",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Para implantações manuais, considere implementar bloqueios de recursos para evitar ações acidentais em sua nuvem privada de solução VMware do Azure",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Para implantações automatizadas, implante uma nuvem privada mínima e dimensione conforme necessário",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Para implantações automatizadas, solicite ou reserve cota antes de iniciar a implantação",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Para implantação automatizada, verifique se os bloqueios de recursos relevantes são criados por meio da automação ou da Política do Azure para uma governança adequada",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Implemente nomes humanos compreensíveis para chaves de autorização ExR para permitir a fácil identificação da finalidade/uso das chaves",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Usar o Cofre de chaves para armazenar segredos e chaves de autorização quando Princípios de Serviço separados são usados para implantar a Solução VMware do Azure e a Rota Expressa",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Defina dependências de recursos para serializar ações no IaC quando muitos recursos precisarem ser implantados no/na Solução VMware do Azure, pois a Solução VMware do Azure oferece suporte apenas a um número limitado de operações paralelas.",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
- "severity": "Baixo",
- "text": "Ao executar a configuração automatizada de segmentos NSX-T com um único gateway de Camada 1, use as APIs do Portal do Azure em vez das APIs do NSX-Manager",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
- "severity": "Média",
- "text": "Ao pretender usar a expansão automatizada, certifique-se de aplicar cota suficiente da Solução VMware do Azure para as assinaturas que executam a Solução VMware do Azure",
- "waf": "Desempenho"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
- "severity": "Média",
- "text": "Ao pretender usar o scale-in automatizado, certifique-se de levar em consideração os requisitos da política de armazenamento antes de executar essa ação",
- "waf": "Desempenho"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"severity": "Média",
- "text": "As operações de dimensionamento sempre precisam ser serializadas em um único SDDC, pois apenas uma operação de escala pode ser executada por vez (mesmo quando vários clusters são usados)",
- "waf": "Desempenho"
+ "text": "Configure a persistência de dados para uma instância do Cache do Azure para Redis. Como os dados do cache são armazenados na memória, uma falha rara e não planejada de vários nós pode fazer com que todos os dados sejam descartados. Para evitar a perda completa de dados, a persistência do Redis permite que você tire instantâneos periódicos de dados na memória e os armazene em sua conta de armazenamento.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"severity": "Média",
- "text": "Considerar e validar operações de dimensionamento em soluções de terceiros 3rd usadas na arquitetura (suportadas ou não)",
- "waf": "Desempenho"
+ "text": "Use a conta de armazenamento com redundância geográfica para persistir o Cache do Azure para dados Redis ou zonalmente redundante onde a redundância geográfica não está disponível",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "Média",
- "text": "Definir e impor limites máximos de entrada/saída de escala para seu ambiente nas automações",
- "waf": "Desempenho"
+ "text": "Configure a replicação geográfica passiva para instâncias do Cache Premium do Azure para Redis. A replicação geográfica é um mecanismo para vincular duas ou mais instâncias do Cache do Azure para Redis, normalmente abrangendo duas regiões do Azure. A replicação geográfica foi projetada principalmente para recuperação de desastres entre regiões. Duas instâncias de cache de camada Premium são conectadas por meio de replicação geográfica de uma forma que fornece leituras e gravações no cache primário e que os dados são replicados para o cache secundário.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Implementar regras de monitoramento para monitorar operações de dimensionamento automatizadas e monitorar o sucesso e a falha para habilitar respostas apropriadas (automatizadas)",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
- "severity": "Alto",
- "text": "Ao usar o MON, esteja ciente dos limites de VMs configuradas simulataneamente (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "text": "Os Aplicativos Spring do Azure permitem duas implantações para cada aplicativo, apenas um dos quais recebe tráfego de produção. Você pode obter tempo de inatividade zero com estratégias de implantação em verde azul. A implantação verde azul só está disponível nas camadas Standard e Enterprise. Você pode automatizar a implantação usando CI/CD com ações do ADO/GitHub",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
- "severity": "Alto",
- "text": "Ao usar o MON, você não pode habilitar o MON em mais de 100 extensões de rede",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
+ "severity": "Média",
+ "text": "As instâncias do Azure Spring Apps podem ser criadas em várias regiões para seus aplicativos e o tráfego pode ser roteado pelo Gerenciador de Tráfego/Front Door.",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Se estiver usando uma conexão VPN para migrações, ajuste o tamanho da MTU de acordo.",
- "waf": "Desempenho"
+ "text": "Na região com suporte, os Aplicativos Spring do Azure podem ser implantados como zona redundante, o que significa que as instâncias são distribuídas automaticamente entre zonas de disponibilidade. Esse recurso só está disponível nas camadas Standard e Enterprise.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Para regiões de baixa conectividade conectadas ao Azure (500Mbps ou menos), considere implantar o dispositivo de otimização de WAN HCX",
- "waf": "Desempenho"
+ "text": "Usar mais de 1 instância de aplicativo para seus aplicativos",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Certifique-se de que as migrações sejam iniciadas a partir do dispositivo local e NÃO do dispositivo em nuvem (NÃO execute uma migração reversa)",
+ "text": "Monitore os Aplicativos Spring do Azure com logs, métricas e rastreamento. Integre o ASA com insights de aplicativos e rastreie falhas e crie pastas de trabalho.",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Quando o Azure Netapp Files for usado para estender o armazenamento para a Solução VMware do Azure, considere usá-lo como um armazenamento de dados VMware em vez de anexá-lo diretamente a uma VM.",
+ "text": "Configurar o dimensionamento automático no Spring Cloud Gateway",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
- "severity": "Média",
- "text": "Verifique se um ExpressRoute Gateway dedicado está sendo usado para soluções de armazenamento de dados externos",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
+ "severity": "Baixo",
+ "text": "Habilite o dimensionamento automático para os aplicativos com o plano de consumo padrão e dedicado.",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "arm-service": "Microsoft.AppPlatform/Spring",
+ "checklist": "Azure Spring Apps Review",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"severity": "Média",
- "text": "Verifique se o FastPath está habilitado no ExpressRoute Gateway que está sendo usado para soluções de armazenamento de dados externos",
+ "text": "Use o plano Enterprise para suporte comercial de inicialização spring para aplicativos de missão crítica. Com outras camadas, você obtém suporte a OSS.",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
- "severity": "Alto",
- "text": "Se estiver usando cluster estendido, verifique se a solução de recuperação de desastres selecionada é suportada pelo fornecedor",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
- "severity": "Alto",
- "text": "Se estiver usando cluster estendido, verifique se o SLA fornecido atenderá aos seus requisitos",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "text": "Regras de coleta de dados no Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
- "severity": "Alto",
- "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa estão conectados ao hub de conectividade.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
+ "text": "Verificar instâncias de backup com a fonte de dados subjacente não encontrada",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
- "severity": "Alto",
- "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa têm o GlobalReach habilitado.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
+ "text": "Excluir ou arquivar serviços não associados (discos, nics, endereços IP etc.)",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
- "severity": "Alto",
- "text": "Faça com que as configurações de tolerância a desastres do site tenham sido devidamente consideradas e alteradas para sua empresa, se necessário.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
+ "text": "Considere um bom equilíbrio entre recuperação de local, armazenamento e backup para aplicativos não essenciais",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
- "severity": "Média",
- "text": "Implante seus recursos de conectividade de zona de destino do Azure em várias regiões, para que você possa dar suporte rapidamente a zonas de destino de aplicativos de várias regiões e cenários de recuperação de desastre.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
+ "text": "Verifique os gastos e as oportunidades de economia entre os 40 diferentes espaços de trabalho de análise de log - use retenção e coleta de dados diferentes para espaços de trabalho não prod - crie limite diário para reconhecimento e dimensionamento de camadas - Se você definir um limite diário, além de criar um alerta quando o limite for atingido, certifique-se de também criar uma regra de alerta para ser notificado quando alguma porcentagem for atingida (90%, por exemplo). - considerar a transformação do espaço de trabalho, se possível - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
- "severity": "Média",
- "text": "Use um locatário do Entra para gerenciar seus recursos do Azure, a menos que você tenha um requisito regulatório ou comercial claro para multilocatários.",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
- "waf": "Operações"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
+ "text": "Impor uma política de log de limpeza e automação (se necessário, os logs podem ser movidos para armazenamento frio)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "Baixo",
- "text": "Use a abordagem de Automação Multilocatário para gerenciar seus locatários de ID do Microsoft Entra.",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "Operações"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
+ "text": "Verifique se os discos são realmente necessários, se não: excluir. Se forem necessários, encontre níveis de armazenamento mais baixos ou use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
- "severity": "Alto",
- "text": "Use o Azure Lighthouse para gerenciamento de vários locatários com as mesmas IDs.",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
- "waf": "Operações"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "text": "Considere mover o armazenamento não utilizado para o nível inferior, com regra personalizada - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
- "severity": "Alto",
- "text": "Se você conceder a um parceiro acesso para administrar seu locatário, use o Azure Lighthouse.",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "text": "Verifique se o Advisor está configurado para o dimensionamento correto da VM ",
"waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
- "severity": "Alto",
- "text": "Aplique um modelo RBAC que se alinhe ao seu modelo operacional de nuvem. Escopo e Atribuição entre Grupos de Gerenciamento e Assinaturas.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "verifique pesquisando as Licenças de Categoria de Medidor na Análise de Custos",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "text": "executar o script em todas as VMs do Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- considere implementar uma diretiva se as VMs do Windows forem criadas com frequência",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
- "severity": "Média",
- "text": "Use apenas o tipo de autenticação Conta corporativa ou de estudante para todos os tipos de conta. Evite usar a conta da Microsoft",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "text": " isso também pode ser colocado no AHUB se você já tiver licenças https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
"link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
- "severity": "Média",
- "text": "Use apenas grupos para atribuir permissões. Adicione grupos locais ao grupo Somente ID do Entra se um sistema de gerenciamento de grupo já estiver em vigor.",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Segurança"
+ "service": "VM",
+ "text": "Consolidar famílias de VM reservadas com opção de flexibilidade (não mais do que 4-5 famílias)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
- "severity": "Alto",
- "text": "Imponha políticas de Acesso Condicional da ID do Microsoft Entra para qualquer usuário com direitos a ambientes do Azure.",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "text": "Utilize instâncias reservadas do Azure: esse recurso permite reservar VMs por um período de 1 ou 3 anos, proporcionando uma economia significativa em comparação com os preços do PAYG.",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
- "severity": "Alto",
- "text": "Imponha a autenticação multifator para qualquer usuário com direitos aos ambientes do Azure.",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "text": "Somente discos maiores podem ser reservados => 1 TiB -",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
- "severity": "Média",
- "text": "Imponha o Microsoft Entra ID Privileged Identity Management (PIM) para estabelecer acesso permanente zero e privilégios mínimos.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
+ "text": "Após a otimização do dimensionamento correto",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "Média",
- "text": "Se estiver planejando alternar dos Serviços de Domínio Active Directory para os serviços de domínio Entra, avalie a compatibilidade de todas as cargas de trabalho.",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "text": "Verifique se aplicável e aplique a política/alteração https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "Média",
- "text": "Ao usar o Microsoft Entra Domain Services, use conjuntos de réplicas. Os conjuntos de réplicas melhorarão a resiliência do domínio gerenciado e permitirão que você implante em regiões adicionais. ",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
+ "text": "O desconto da peça de licença VM + (ahub + 3YRI) é de cerca de 70% de desconto",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
- "severity": "Média",
- "text": "Integre os logs de ID do Microsoft Entra com o Azure Monitor central da plataforma. O Azure Monitor permite uma única fonte de verdade sobre dados de log e monitoramento no Azure, oferecendo às organizações opções nativas de nuvem para atender aos requisitos de coleta e retenção de logs.",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
+ "text": "Considere o uso de um VMSS para corresponder à demanda em vez de dimensionamento simples",
+ "waf": "Custar"
},
{
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
- "severity": "Alto",
- "text": "Implemente um acesso de emergência ou contas de emergência para evitar o bloqueio de conta em todo o locatário. A MFA será ativada por padrão para todos os usuários em outubro de 2024. Recomendamos atualizar essas contas para usar a chave de acesso (FIDO2) ou configurar a autenticação baseada em certificado para MFA. ",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "Segurança"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
+ "text": "Use o autoscaler AKS para corresponder ao uso de clusters (verifique se os requisitos dos pods correspondem ao dimensionador)",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
- "severity": "Média",
- "text": "Não use contas sincronizadas locais para atribuições de função de ID do Microsoft Entra, a menos que você tenha um cenário que exija isso especificamente.",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "text": "Mover pontos de recuperação para o vault-archive, quando aplicável (Validar)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
- "severity": "Média",
- "text": "Ao usar o Proxy de Aplicativo de ID do Microsoft Entra para fornecer acesso de usuários remotos a aplicativos, gerencie-o como um recurso da plataforma, pois você só pode ter uma instância por locatário.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "text": "Considere o uso de VMs spot com fallback sempre que possível. Considere o autotermination de clusters.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
- "severity": "Média",
- "text": "Use uma topologia de rede hub-and-spoke para cenários de rede que exigem flexibilidade máxima.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
+ "text": "Funções - Reutilizar conexões",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
- "severity": "Alto",
- "text": "Implante serviços de rede compartilhados, incluindo gateways do ExpressRoute, gateways de VPN e Firewall do Azure ou NVAs de parceiros na rede virtual do hub central. Se necessário, implante também serviços DNS.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
+ "text": "Funções - Armazenar dados em cache localmente",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
"waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
- "severity": "Alto",
- "text": "Use um plano de proteção de IP ou rede DDoS para todos os endereços IP públicos nas zonas de destino do aplicativo.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
+ "text": "Funções - Partidas a frio - Use a funcionalidade 'Executar do pacote'. Dessa forma, o código é baixado como um único arquivo zip. Isso pode, por exemplo, resultar em melhorias significativas com as funções Javascript, que possuem muitos módulos de nó. Use ferramentas específicas de linguagem para reduzir o tamanho do pacote, por exemplo, aplicativos Javascript que agitam árvores.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
- "severity": "Média",
- "text": "Ao implantar tecnologias de rede de parceiros ou NVAs, siga as diretrizes do fornecedor do parceiro.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "text": "Funções - Mantenha suas funções aquecidas",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Custar"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "severity": "Baixo",
- "text": "Se você precisar de trânsito entre o ExpressRoute e os gateways de VPN em cenários hub e spoke, use o Servidor de Rota do Azure.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
+ "text": "Ao usar o dimensionamento automático com funções diferentes, pode haver um que conduza todo o dimensionamento automático para todos os recursos - considere movê-lo para um plano de consumo separado (e considere um plano mais alto para a CPU)",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
- "severity": "Baixo",
- "text": "Se estiver usando o Servidor de Roteamento, use um prefixo /27 para a sub-rede do Servidor de Roteamento.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
+ "text": "Os aplicativos de função em um determinado plano são todos dimensionados juntos, portanto, quaisquer problemas com o dimensionamento podem afetar todos os aplicativos no plano.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
- "severity": "Média",
- "text": "Para arquiteturas de rede com várias topologias hub-and-spoke em regiões do Azure, use emparelhamentos de rede virtual global entre as VNets do hub para conectar as regiões entre si.",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
+ "text": "Sou cobrado por 'tempo de espera'? Essa pergunta geralmente é feita no contexto de uma função C# que faz uma operação assíncrona e aguarda o resultado, por exemplo, aguardar Task.Delay(1000) ou aguardar cliente. GetAsync('http://google.com'). A resposta é sim - o segundo cálculo de GB é baseado na hora de início e término da função e no uso de memória durante esse período. O que realmente acontece ao longo desse tempo em termos de atividade da CPU não é levado em consideração no cálculo. Uma exceção a essa regra é se você estiver usando funções duráveis. Você não é cobrado pelo tempo gasto em espera em funções de orquestrador.aplique técnicas de modelagem de demanda sempre que possível (ambientes de desenvolvimento?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
- "severity": "Média",
- "text": "Use o Azure Monitor para Redes para monitorar o estado de ponta a ponta das redes no Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "Operações"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "text": "Frontdoor - Desativar a página inicial padrãoNas configurações do aplicativo do seu aplicativo, defina AzureWebJobsDisableHomepage como true. Isso retornará um 204 (Sem Conteúdo) para o PoP para que apenas os dados de cabeçalho sejam retornados.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Média",
- "text": "Se você tiver mais de 400 redes spoke em uma região, implante um hub adicional para ignorar os limites de emparelhamento VNet (500) e o número máximo de prefixos que podem ser anunciados por meio do ExpressRoute (1000).",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "text": "Frontdoor - Rota para algo que não retorna nada. Configure uma Função, Proxy de Função ou adicione uma rota em seu WebApp que retorne 200 (OK) e envie conteúdo nulo ou mínimo. A vantagem disso é que você poderá fazer logout quando for chamado.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
- "severity": "Média",
- "text": "Limite o número de rotas por tabela de rotas a 400.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "text": "Considere níveis de arquivamento para dados menos usados",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
- "severity": "Alto",
- "text": "Use a configuração 'Permitir tráfego para rede virtual remota' ao configurar emparelhamentos VNet.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "text": "Verifique os tamanhos de disco em que o tamanho não corresponde à camada (ou seja, um disco de 513 GiB pagará um P30 (1TiB) e considere o redimensionamento",
+ "waf": "Custar"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "text": "Considere usar SSD padrão em vez de Premium ou Ultra sempre que possível",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "text": "Para contas de armazenamento, verifique se a camada escolhida não está somando encargos de transação (pode ser mais barato passar para a próxima camada)",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "text": "Para ASR, considere o uso de discos SSD padrão se o RPO/RTO e a taxa de transferência de replicação permitirem",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "text": "Contas de armazenamento: verifique o hot tier e/ou o GRS necessário",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "text": "Discos - valide o uso de discos SSD Premium em todos os lugares: por exemplo, não-prod pode trocar para SSD padrão ou SSD Premium sob demanda ",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "text": "Crie orçamentos para gerenciar custos e crie alertas que notifiquem automaticamente as partes interessadas sobre anomalias de gastos e riscos de gastos excessivos.",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "text": "Exporte dados de custo para uma conta de armazenamento para análise de dados adicionais.",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "text": "Controle os custos de um pool SQL dedicado pausando o recurso quando ele não estiver em uso.",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "text": "Habilite o recurso de pausa automática do Apache Spark sem servidor e defina seu valor de tempo limite de acordo.",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "text": "Crie várias definições de pool do Apache Spark de vários tamanhos.",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "text": "Adquira unidades de confirmação (SCU) do Azure Synapse por um ano com um plano de pré-compra para economizar nos custos do Azure Synapse Analytics.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
+ "text": "Usar VMs spot para trabalhos interruptíveis: são VMs que podem ser licitadas e compradas a um preço com desconto, fornecendo uma solução econômica para cargas de trabalho não críticas.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "text": "Dimensionamento correto de todas as VMs",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "text": "Trocar VM dimensionada com tamanhos normalizados e mais recentes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "VMs de dimensionamento correto - comece com o monitoramento do uso abaixo de 5% e, em seguida, trabalhe até 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "A conteinerização de um aplicativo pode melhorar a densidade da VM e economizar dinheiro no dimensionamento",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Custar"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "O Barramento de Serviço Premium do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "Baixo",
+ "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "A comunicação entre um aplicativo cliente e um namespace do Barramento de Serviço do Azure é criptografada usando TLS (Transport Layer Security). Os namespaces do Barramento de Serviço do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace do Barramento de Serviço para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Quando você cria um namespace do Barramento de Serviço, uma regra SAS chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. É recomendável usar o AAD como um provedor de autenticação com RBAC. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Evite usar a conta root quando não for necessário",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Um aplicativo cliente do Barramento de Serviço em execução dentro de um aplicativo do Serviço de Aplicativo do Azure ou em uma máquina virtual com entidades gerenciadas habilitadas para suporte a recursos do Azure não precisa lidar com regras e chaves SAS ou quaisquer outros tokens de acesso. O aplicativo cliente só precisa do endereço do ponto de extremidade do namespace do Sistema de Mensagens do Barramento de Serviço. ",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Quando possível, seu aplicativo deve usar uma identidade gerenciada para se autenticar no Barramento de Serviço do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial de entidade de serviço) no Azure Key Vault ou em um serviço equivalente",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Barramento de Serviço do Azure. As permissões no Barramento de Serviço do Azure podem e devem ter como escopo o nível de recurso individual, por exemplo, fila, tópico ou assinatura. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "severity": "Alto",
+ "text": "Usar o RBAC do plano de dados com privilégios mínimos",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Os logs de recursos do Barramento de Serviço do Azure incluem logs operacionais, logs de rede virtual e filtragem de IP. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para várias operações de acesso ao plano de dados (como enviar ou receber mensagens) no Barramento de Serviço.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Habilite o registro em log para investigação de segurança. Usar o Azure Monitor para rastrear logs de recursos e logs de auditoria de runtime (atualmente disponível apenas na camada premium)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Por padrão, o Barramento de Serviço do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Barramento de Serviço do Azure atravesse a rede de backbone da Microsoft. Além disso, você deve desabilitar os endpoints públicos se eles não forem usados. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Considere usar pontos de extremidade privados para acessar o Barramento de Serviço do Azure e desabilitar o acesso à rede pública quando aplicável.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Com o firewall IP, você pode restringir ainda mais o endpoint público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Classless Inter-Domain Routing). ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
+ "severity": "Média",
+ "text": "Considere permitir apenas o acesso ao namespace do Barramento de Serviço do Azure de endereços IP ou intervalos específicos",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
+ "severity": "Média",
+ "text": "Siga as recomendações de suporte de confiabilidade no Serviço de Bot do Azure",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
+ "severity": "Média",
+ "text": "Implantando bots com residência de dados local e conformidade regional",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
+ "severity": "Média",
+ "text": "O Serviço de Bot do Azure é executado no modo ativo-ativo para serviços globais e regionais. Quando ocorre uma paralisação, você não precisa detectar erros ou gerenciar o serviço. O Serviço de Bot do Azure executa automaticamente o failover automático e a recuperação automática em uma arquitetura geográfica de várias regiões. Para o serviço regional de bot da UE, o Serviço de Bot do Azure fornece duas regiões completas dentro da Europa com replicação ativa/ativa para garantir redundância. Para o serviço de bot global, todas as regiões/geografias disponíveis podem ser servidas como a presença global.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "O ACSS (Centro de Soluções SAP) do Azure é uma oferta do Azure que torna o SAP uma carga de trabalho de nível superior no Azure. O ACSS é uma solução de ponta a ponta que permite criar e executar sistemas SAP como uma carga de trabalho unificada no Azure e fornece uma base mais perfeita para a inovação. Você pode aproveitar os recursos de gerenciamento para sistemas SAP novos e existentes baseados no Azure.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operações"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "O Azure dá suporte à automação de implantações do SAP no Linux e no Windows. O SAP Deployment Automation Framework é uma ferramenta de orquestração de software livre que pode implementar, instalar e manter ambientes SAP.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operações"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Execute uma recuperação pontual para seus bancos de dados de produção a qualquer momento e em um período de tempo que atenda ao seu RTO; a recuperação point-in-time normalmente inclui erros do operador que excluem dados na camada DBMS ou por meio do SAP, incidentalmente",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Teste os tempos de backup e recuperação para verificar se eles atendem aos requisitos de RTO para restaurar todos os sistemas simultaneamente após um desastre.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Você pode replicar o armazenamento padrão entre regiões emparelhadas, mas não pode usar o armazenamento padrão para armazenar seus bancos de dados ou discos rígidos virtuais. Você pode replicar backups somente entre regiões emparelhadas que você usa. Para todos os outros dados, execute a replicação usando recursos nativos do DBMS, como SQL Server Always On ou Replicação do Sistema SAP HANA. Use uma combinação de Site Recovery, rsync ou robocopy e outros softwares de terceiros para a camada de aplicativo SAP.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Ao usar as Zonas de Disponibilidade do Azure para obter alta disponibilidade, você deve considerar a latência entre os servidores de aplicativos SAP e os servidores de banco de dados. Para zonas com altas latências, os procedimentos operacionais precisam estar em vigor para garantir que os servidores de aplicativos SAP e os servidores de banco de dados estejam em execução na mesma zona o tempo todo.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Configure conexões do ExpressRoute do local para as regiões de recuperação de desastre primárias e secundárias do Azure. Além disso, como alternativa ao uso do ExpressRoute, considere configurar conexões VPN do local para as regiões primárias e secundárias de recuperação de desastre do Azure.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Replique o conteúdo do cofre de chaves, como certificados, segredos ou chaves entre regiões, para que você possa descriptografar dados na região de recuperação de desastre.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Emparelhe as redes virtuais primárias e de recuperação de desastre. Por exemplo, para a Replicação do Sistema HANA, uma rede virtual de banco de dados do SAP HANA precisa ser emparelhada com a rede virtual de banco de dados do SAP HANA do site de recuperação de desastres.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Se você usar o armazenamento do Azure NetApp Files para suas implantações SAP, no mínimo, crie duas contas do Azure NetApp Files na camada Premium, em duas regiões.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use o SKU do Standard Load Balancer com uma implantação com redundância de zona, a seleção do SKU Standard Load Balancer aumenta a confiabilidade por meio de zonas de disponibilidade e resiliência de zona, garantindo que as implantações resistam a falhas de zona e região. Ao contrário do Basic, ele oferece suporte ao balanceamento de carga global e oferece um SLA.",
+ "text": "A tecnologia de replicação de banco de dados nativa deve ser usada para sincronizar o banco de dados em um par de HA.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
"waf": "Fiabilidade"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
"severity": "Alto",
- "text": "Verifique se os pools de back-end do balanceador de carga contêm pelo menos duas instâncias, a implantação de Azure Load Balancers com pelo menos duas instâncias no back-end evita um único ponto de falha e dá suporte à escalabilidade.",
+ "text": "O CIDR da VNet (rede virtual) primária não deve entrar em conflito ou se sobrepor ao CIDR da VNet do site de recuperação de desastre",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Quando você estiver usando o ExpressRoute Direct, configure o MACsec para criptografar o tráfego no nível da camada dois entre os roteadores da organização e o MSEE. O diagrama mostra essa criptografia no fluxo.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Use o Site Recovery para replicar um servidor de aplicativos para um site de recuperação de desastre. O Site Recovery também pode ajudar a replicar VMs de cluster de serviços centrais para o site de recuperação de desastre. Ao invocar a DR, você precisará reconfigurar o cluster do Linux Pacemaker no site de DR (por exemplo, substituir o VIP ou SBD, executar corosync.conf e muito mais).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Para cenários em que o MACsec não é uma opção (por exemplo, não usando o ExpressRoute Direct), use um gateway de VPN para estabelecer túneis IPsec no emparelhamento privado do ExpressRoute.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Considere a disponibilidade do software SAP em relação a pontos únicos de falha. Isso inclui pontos únicos de falha em aplicativos, como SGBDs utilizados nas arquiteturas SAP NetWeaver e SAP S/4HANA, SAP AP e ASCS + SCS. Além disso, outras ferramentas, como o SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"severity": "Alto",
- "text": "Verifique se nenhum espaço de endereço IP sobreposto entre regiões do Azure e locais é usado.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Segurança"
+ "text": "Para bancos de dados SAP e SAP, considere implementar clusters de failover automáticos. No Windows, o Clustering de Failover do Windows Server dá suporte ao failover. No Linux, o Linux Pacemaker ou ferramentas de terceiros, como o SIOS Protection Suite e o Veritas InfoScale, oferecem suporte ao failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "O Azure não dá suporte a arquiteturas nas quais as VMs primárias e secundárias compartilham armazenamento para dados do DBMS. Para a camada DBMS, o padrão de arquitetura comum é replicar bancos de dados ao mesmo tempo e com pilhas de armazenamento diferentes daquelas que as VMs primárias e secundárias usam.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Os dados do DBMS e os arquivos de log de transação/redo são armazenados no armazenamento em blocos com suporte do Azure ou no Azure NetApp Files. Não há suporte para Arquivos do Azure ou Arquivos Premium do Azure como armazenamento para dados do DBMS e/ou arquivos de log de restauração com carga de trabalho do SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Você pode usar discos compartilhados do Azure no Windows para componentes ASCS + SCS e cenários específicos de alta disponibilidade. Configure seus clusters de failover separadamente para os componentes da camada de aplicativo SAP e a camada DBMS. Atualmente, o Azure não dá suporte a arquiteturas de alta disponibilidade que combinam componentes da camada de aplicativo SAP e a camada DBMS em um cluster de failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "A maioria dos clusters de failover para componentes da camada de aplicativo SAP (ASCS) e a camada DBMS exigem um endereço IP virtual para um cluster de failover. O Azure Load Balancer deve lidar com o endereço IP virtual para todos os outros casos. Um princípio de design é usar um balanceador de carga por configuração de cluster. Recomendamos que você use a versão padrão do balanceador de carga (SKU do Balanceador de Carga Padrão).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Certifique-se de que o IP flutuante esteja habilitado no balanceador de carga",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Antes de implantar sua infraestrutura de alta disponibilidade e dependendo da região escolhida, determine se deseja implantar com um conjunto de disponibilidade do Azure ou uma zona de disponibilidade.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Se você quiser atender aos SLAs de infraestrutura para seus aplicativos para componentes SAP (serviços centrais, servidores de aplicativos e bancos de dados), deverá escolher as mesmas opções de alta disponibilidade (VMs, conjuntos de disponibilidade, zonas de disponibilidade) para todos os componentes.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Não misture servidores de funções diferentes no mesmo conjunto de disponibilidade. Mantenha VMs de serviços centrais, VMs de banco de dados e VMs de aplicativos em seus próprios conjuntos de disponibilidade",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "Média",
- "text": "Use endereços IP dos intervalos de alocação de endereços para Internets privadas (RFC 1918).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Segurança"
+ "text": "Você não pode implantar conjuntos de disponibilidade do Azure em uma zona de disponibilidade do Azure, a menos que use grupos de posicionamento por proximidade.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"severity": "Alto",
- "text": "Certifique-se de que o espaço de endereço IP não seja desperdiçado, não crie redes virtuais desnecessariamente grandes (por exemplo, /16).",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Desempenho"
+ "text": "Ao criar conjuntos de disponibilidade, use o número máximo de domínios de falha e atualize os domínios disponíveis. Por exemplo, se você implantar mais de duas VMs em um conjunto de disponibilidade, use o número máximo de domínios de falha (três) e domínios de atualização suficientes para limitar o efeito de possíveis falhas de hardware físico, interrupções de rede ou interrupções de energia, além da manutenção planejada do Azure. O número padrão de domínios de falha é dois e você não pode alterá-lo online posteriormente.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "Alto",
- "text": "Não use intervalos de endereços IP sobrepostos para sites de produção e recuperação de desastres.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "text": "Quando você usa grupos de posicionamento por proximidade do Azure em uma implantação de conjunto de disponibilidade, todos os três componentes SAP (serviços centrais, servidor de aplicativos e banco de dados) devem estar no mesmo grupo de posicionamento por proximidade.",
"waf": "Fiabilidade"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use SKU Standard e IPs com redundância de zona quando aplicável, os endereços IP públicos no Azure podem ser de SKU padrão, disponíveis como não zonal, zonal ou com redundância de zona. Os IPs com redundância de zona podem ser acessados em todas as zonas, resistindo a qualquer falha de zona única, fornecendo assim maior resiliência. ",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "text": "Use um grupo de posicionamento por proximidade por SID SAP. Os grupos não se estendem por Zonas de Disponibilidade ou regiões do Azure",
"waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Use um dos serviços a seguir para executar clusters de serviços centrais do SAP, dependendo do sistema operacional.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"severity": "Média",
- "text": "Para ambientes em que a resolução de nomes no Azure é tudo o que é necessário, use o DNS Privado do Azure para resolução com uma zona delegada para resolução de nomes (como 'azure.contoso.com').",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operações"
+ "text": "Atualmente, o Azure não dá suporte à combinação de ASCS e DB HA no mesmo cluster do Linux Pacemaker; separe-os em clusters individuais. No entanto, você pode combinar até cinco vários clusters de serviços centrais em um par de VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "Média",
- "text": "Para ambientes em que a resolução de nomes no Azure e no local é necessária e não há nenhum serviço DNS corporativo existente, como o Active Directory, use o Resolvedor Privado de DNS do Azure para rotear solicitações de DNS para o Azure ou para servidores DNS locais.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "Segurança"
+ "text": "Implante ambas as VMs no par de alta disponibilidade em um conjunto de disponibilidade ou em zonas de disponibilidade. Essas VMs devem ter o mesmo tamanho e a mesma configuração de armazenamento.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
- "severity": "Baixo",
- "text": "Cargas de trabalho especiais que exigem e implantam seu próprio DNS (como o Red Hat OpenShift) devem usar sua solução de DNS preferida.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
- "waf": "Operações"
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "O Azure dá suporte à instalação e configuração de instâncias do SAP HANA e ASCS/SCS e ERS no mesmo cluster de alta disponibilidade em execução no RHEL (Red Hat Enterprise Linux).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "Alto",
- "text": "Habilite o registro automático para o DNS do Azure para gerenciar automaticamente o ciclo de vida dos registros DNS para as máquinas virtuais implantadas em uma rede virtual.",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "Operações"
+ "text": "Execute todos os sistemas de produção em SSDs gerenciados Premium e use o Azure NetApp Files ou o Armazenamento em Disco Ultra. Pelo menos o disco do sistema operacional deve estar na camada Premium para que você possa obter melhor desempenho e o melhor SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
- "severity": "Média",
- "text": "Implementar um plano para gerenciar a resolução de DNS entre várias regiões do Azure e quando os serviços fazem failover para outra região",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Você deve executar o SAP HANA no Azure somente nos tipos de armazenamento certificados pelo SAP. Observe que determinados volumes devem ser executados em determinadas configurações de disco, quando aplicável. Essas configurações incluem habilitar o Acelerador de Gravação e usar o armazenamento Premium. Você também precisa garantir que o sistema de arquivos executado no armazenamento seja compatível com o DBMS executado na máquina.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
"waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
- "severity": "Média",
- "text": "Use o Azure Bastion para se conectar com segurança à sua rede.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Considere configurar a alta disponibilidade dependendo do tipo de armazenamento que você usa para suas cargas de trabalho SAP. Alguns serviços de armazenamento disponíveis no Azure não têm suporte no Azure Site Recovery, portanto, sua configuração de alta disponibilidade pode ser diferente.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
- "severity": "Média",
- "text": "Use o Azure Bastion em uma sub-rede /26 ou maior.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Diferentes serviços de armazenamento nativos do Azure (como Arquivos do Azure, Azure NetApp Files, Disco Compartilhado do Azure) podem não estar disponíveis em todas as regiões. Portanto, para ter uma configuração SAP semelhante na região de recuperação de desastre após o failover, verifique se o respectivo serviço de armazenamento é oferecido no site de recuperação de desastre.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "checklist": "SAP Checklist",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"severity": "Média",
- "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre regiões do Azure para conexões HTTP/S de entrada para uma zona de destino.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Segurança"
+ "text": "Automatize o sistema SAP Start-Stop para gerenciar custos.",
+ "waf": "Custar"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
+ "checklist": "SAP Checklist",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"severity": "Baixo",
- "text": "Ao usar o Azure Front Door e o Gateway de Aplicativo do Azure para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Azure Front Door. Bloqueie o Gateway de Aplicativo do Azure para receber tráfego somente do Azure Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Segurança"
+ "text": "No caso de usar o Armazenamento Premium do Azure com o SAP HANA, o armazenamento SSD Standard do Azure pode ser usado para selecionar uma solução de armazenamento econômica. No entanto, observe que escolher o armazenamento SSD Standard ou HDD Standard do Azure afetará o SLA das VMs individuais. Além disso, para sistemas com menor taxa de transferência de E/S e baixa latência, como ambientes de não produção, as VMs de série inferior podem ser usadas.",
+ "waf": "Custar"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "Alto",
- "text": "Quando WAFs e outros proxies reversos forem necessários para conexões HTTP/S de entrada, implante-os em uma rede virtual de zona de destino e junto com os aplicativos que eles estão protegendo e expondo à Internet.",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Como uma configuração alternativa de baixo custo (multiuso), você pode escolher um SKU de baixo desempenho para suas VMs de servidor de banco de dados HANA que não são de produção. No entanto, é importante observar que alguns tipos de VM, como a série E, não são certificados pelo HANA (Diretório de Hardware do SAP HANA) ou não podem atingir uma latência de armazenamento inferior a 1 ms.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use os planos de Rede ou Proteção de IP do Azure contra DDoS para ajudar a proteger os pontos de extremidade de endereços IP públicos nas redes virtuais.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Impor um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
- "severity": "Alto",
- "text": "Planeje como gerenciar a configuração e a estratégia de tráfego de saída da rede antes da próxima alteração significativa. Em 30 de setembro de 2025, o acesso de saída padrão para novas implantações será desativado e somente configurações de acesso explícito serão permitidas.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "Alto",
- "text": "Adicione configurações de diagnóstico para salvar logs relacionados a DDoS para todos os endereços IP públicos protegidos (IP DDoS ou Proteção de Rede).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Impor a propagação da entidade de segurança para encaminhar a identidade do aplicativo de nuvem SAP para o SAP local (incluindo IaaS) por meio do conector de nuvem",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
- "severity": "Alto",
- "text": "Verifique se há uma atribuição de política para negar endereços IP públicos diretamente vinculados a máquinas virtuais. Use exclusões se IPs públicos forem necessários em VMs específicas.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "checklist": "SAP Checklist",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Implemente SSO para aplicativos SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics e SAP C4C com Azure AD usando SAML.",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o ExpressRoute como a conexão principal com o Azure. Use VPNs como fonte de conectividade de backup.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Desempenho"
+ "text": "Implemente o SSO para aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "description": "Você pode usar o prefixo AS-path e pesos de conexão para influenciar o tráfego do Azure para o local e toda a gama de atributos BGP em seus próprios roteadores para influenciar o tráfego do local para o Azure.",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"severity": "Média",
- "text": "Ao usar vários circuitos do ExpressRoute ou vários locais locais, use atributos BGP para otimizar o roteamento.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "text": "Implemente o SSO para aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"severity": "Média",
- "text": "Selecione o SKU correto para os gateways ExpressRoute/VPN com base nos requisitos de largura de banda e desempenho.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Desempenho"
+ "text": "Você pode implementar o SSO no SAP GUI usando o SAP NetWeaver SSO ou uma solução de parceiro.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
- "severity": "Alto",
- "text": "Verifique se você está usando circuitos do ExpressRoute de dados ilimitados somente se atingir a largura de banda que justifica seu custo.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Custar"
+ "checklist": "SAP Checklist",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos/SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido à sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
- "severity": "Alto",
- "text": "Aproveite o SKU local do ExpressRoute para reduzir o custo de seus circuitos, se o local de emparelhamento de circuito der suporte às regiões do Azure para o SKU Local.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Custar"
+ "checklist": "SAP Checklist",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos/SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido à sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"severity": "Média",
- "text": "Implante um gateway do ExpressRoute com redundância de zona nas regiões do Azure com suporte.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "text": "Implemente o SSO usando o OAuth para SAP NetWeaver para permitir que aplicativos personalizados ou de terceiros acessem os serviços OData do SAP NetWeaver.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"severity": "Média",
- "text": "Para cenários que exigem largura de banda superior a 10 Gbps ou portas dedicadas de 10/100 Gbps, use o ExpressRoute Direct.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Desempenho"
+ "text": "Implementar SSO no SAP HANA",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
"severity": "Média",
- "text": "Quando a baixa latência for necessária ou a taxa de transferência do local para o Azure precisar ser maior que 10 Gbps, habilite o FastPath para ignorar o gateway do ExpressRoute do caminho de dados.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Desempenho"
+ "text": "Considere o Azure AD um provedor de identidade para sistemas SAP hospedados no RISE. Para obter mais informações, consulte Integrando o serviço ao Azure AD.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
+ "checklist": "SAP Checklist",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"severity": "Média",
- "text": "Use gateways de VPN com redundância de zona para conectar branches ou locais remotos ao Azure (quando disponível).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Fiabilidade"
+ "text": "Para aplicativos que acessam o SAP, talvez você queira usar a propagação principal para estabelecer o SSO.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
+ "checklist": "SAP Checklist",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
"severity": "Média",
- "text": "Use dispositivos VPN redundantes locais (ativo/ativo ou ativo/passivo).",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
- "waf": "Fiabilidade"
+ "text": "Se você estiver usando serviços SAP BTP ou soluções SaaS que exigem o SAP Identity Authentication Service (IAS), considere implementar o SSO entre o SAP Cloud Identity Authentication Services e o Azure AD para acessar esses serviços SAP. Essa integração permite que o SAP IAS atue como um provedor de identidade proxy e encaminhe solicitações de autenticação para o Azure AD como o repositório central de usuários e o provedor de identidade.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
- "severity": "Alto",
- "text": "Se estiver usando o ExpressRoute Direct, considere usar circuitos locais do ExpressRoute para as regiões locais do Azure para economizar custos.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Custar"
+ "checklist": "SAP Checklist",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Implementar SSO para SAP BTP",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
"severity": "Média",
- "text": "Quando o isolamento de tráfego ou a largura de banda dedicada for necessária, como para separar ambientes de produção e não produção, use circuitos diferentes do ExpressRoute. Ele ajudará você a garantir domínios de roteamento isolados e aliviar os riscos de vizinhos barulhentos.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Se você estiver usando o SAP SuccessFactors, considere usar o provisionamento automatizado de usuários do Azure AD. Com essa integração, à medida que você adiciona novos funcionários ao SAP SuccessFactors, você pode criar automaticamente suas contas de usuário no Azure AD. Opcionalmente, você pode criar contas de usuário no Microsoft 365 ou em outros aplicativos SaaS compatíveis com o Azure AD. Use o write-back do endereço de email para o SAP SuccessFactors.",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "description": "Mantenha a hierarquia do grupo de gerenciamento razoavelmente plana, não mais do que quatro.",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"severity": "Média",
- "text": "Monitore a disponibilidade e a utilização do ExpressRoute usando o Express Route Insights interno.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "impor políticas existentes do Grupo de Gerenciamento às Assinaturas SAP",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Use o Monitor da Conexão para monitoramento de conectividade em toda a rede, especialmente entre o local e o Azure.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Integre aplicativos fortemente acoplados na mesma assinatura SAP para evitar complexidade adicional de roteamento e gerenciamento",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Use circuitos do ExpressRoute de diferentes locais de emparelhamento para redundância.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Aproveite a assinatura como unidade de escala e dimensione nossos recursos, considere implantar a assinatura por ambiente, por exemplo. Caixa de areia, não-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Use a VPN site a site como failover do ExpressRoute, se estiver usando apenas um único circuito do ExpressRoute.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Garantir o aumento da cota como parte do provisionamento da assinatura (por exemplo, total de núcleos de VM disponíveis em uma assinatura)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
- "severity": "Alto",
- "text": "Se você estiver usando uma tabela de rotas no GatewaySubnet, certifique-se de que as rotas de gateway sejam propagadas.",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "A API de Cota é uma API REST que você pode usar para exibir e gerenciar cotas para serviços do Azure. Considere usá-lo, se necessário.",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
"severity": "Alto",
- "text": "Se estiver usando o ExpressRoute, o roteamento local deverá ser dinâmico: no caso de uma falha de conexão, ele deverá convergir para a conexão restante do circuito. A carga deve ser compartilhada entre ambas as conexões, idealmente como ativa/ativa, embora ativa/passiva também seja suportada.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "text": "Se estiver implantando em uma zona de disponibilidade, verifique se a implantação da zona da VM está disponível depois que a cota for aprovada. Envie uma solicitação de suporte com a assinatura, a série de VMs, o número de CPUs e a zona de disponibilidade necessárias.",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
- "severity": "Média",
- "text": "Verifique se os dois links físicos do circuito do ExpressRoute estão conectados a dois dispositivos de borda distintos em sua rede.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Certifique-se de que os serviços e recursos necessários estejam disponíveis nas regiões de implantação escolhidas, por exemplo. ANF, Zona etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"severity": "Média",
- "text": "Certifique-se de que a Detecção de Encaminhamento Bidirecional (BFD) esteja habilitada e configurada em dispositivos de roteamento de borda do cliente ou provedor.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Fiabilidade"
+ "text": "Aproveite a marca de recurso do Azure para categorização de custos e agrupamento de recursos (: BillTo, Departamento (ou Unidade de Negócios), Ambiente (Produção, Estágio, Desenvolvimento), Camada (Camada da Web, Camada de Aplicativo), Proprietário do Aplicativo, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"severity": "Alto",
- "text": "Conecte o Gateway do ExpressRoute a dois ou mais circuitos de diferentes locais de emparelhamento para maior resiliência.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Ajude a proteger seu banco de dados HANA usando o serviço de Backup do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"severity": "Média",
- "text": "Configure logs de diagnóstico e alertas para o gateway de rede virtual do ExpressRoute.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "Se você implantar o Azure NetApp Files para seu banco de dados HANA, Oracle ou DB2, use a ferramenta AzAcSnap (Instantâneo Consistente com o Aplicativo do Azure) para tirar instantâneos consistentes com o aplicativo. O AzAcSnap também oferece suporte a bancos de dados Oracle. Considere usar o AzAcSnap em uma VM central em vez de em VMs individuais.",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Garanta correspondências de fuso horário entre o sistema operacional e o sistema SAP.",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"severity": "Média",
- "text": "Não use circuitos do ExpressRoute para comunicação VNet para VNet.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Desempenho"
+ "text": "Não agrupe diferentes serviços de aplicativo no mesmo cluster. Por exemplo, não combine clusters DRBD e de serviços centrais no mesmo cluster. No entanto, você pode usar o mesmo cluster do Pacemaker para gerenciar aproximadamente cinco serviços centrais diferentes (cluster de vários SID).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
+ "checklist": "SAP Checklist",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
"severity": "Baixo",
- "text": "Não envie o tráfego do Azure para locais híbridos para inspeção. Em vez disso, siga o princípio \"o tráfego no Azure permanece no Azure\" para que a comunicação entre os recursos no Azure ocorra por meio da rede de backbone da Microsoft.",
- "waf": "Desempenho"
+ "text": "Considere executar sistemas de desenvolvimento/teste em um modelo de adiamento para economizar e otimizar os custos de execução do Azure.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Use o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir).",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Se você fizer parceria com clientes gerenciando suas propriedades SAP, considere o Azure Lighthouse. O Azure Lighthouse permite que os provedores de serviços gerenciados usem serviços de identidade nativos do Azure para se autenticar no ambiente dos clientes. Ele coloca o controle nas mãos dos clientes, pois eles podem revogar o acesso a qualquer momento e auditar as ações dos prestadores de serviços.",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Crie uma política global de Firewall do Azure para controlar a postura de segurança em todo o ambiente de rede global e atribua-a a todas as instâncias do Firewall do Azure. Permita que políticas granulares atendam aos requisitos de regiões específicas delegando políticas de firewall incrementais às equipes de segurança locais por meio do controle de acesso baseado em função do Azure.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
+ "text": "Use o Azure Update Manager para verificar o status das atualizações disponíveis para uma única VM ou várias VMs e considere agendar patches regulares.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"severity": "Baixo",
- "text": "Configure provedores de segurança SaaS de parceiros compatíveis no Firewall Manager se a organização quiser usar essas soluções para ajudar a proteger as conexões de saída.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Use regras de aplicativo para filtrar o tráfego de saída no nome do host de destino para protocolos com suporte. Use regras de rede baseadas em FQDN e Firewall do Azure com proxy DNS para filtrar o tráfego de saída para a Internet em outros protocolos.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Use o Firewall do Azure Premium para habilitar recursos de segurança adicionais.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Segurança"
+ "text": "Otimize e gerencie as operações do SAP Basis usando o SAP Landscape Management (LaMa). Use o conector SAP LaMa para Azure para realocar, copiar, clonar e atualizar sistemas SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Configure o modo de Inteligência contra Ameaças do Firewall do Azure como Alerta e Negação para proteção adicional.",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Use o Azure Monitor para soluções SAP para monitorar suas cargas de trabalho SAP (SAP HANA, clusters SUSE de alta disponibilidade e sistemas SQL) no Azure. Considere complementar o Azure Monitor para soluções SAP com o SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"severity": "Alto",
- "text": "Configure o modo IDPS do Firewall do Azure como Negar para proteção adicional.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Segurança"
+ "text": "Execute uma extensão de VM para verificação SAP. A Extensão de VM para SAP usa a identidade gerenciada atribuída de uma VM (máquina virtual) para acessar dados de monitoramento e configuração de VM. A verificação garante que todas as métricas de desempenho em seu aplicativo SAP venham da Extensão do Azure para SAP subjacente.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Para sub-redes em VNets não conectadas à WAN Virtual, anexe uma tabela de rotas para que o tráfego da Internet seja redirecionado para o Firewall do Azure ou uma Solução de Virtualização de Rede.",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Use o Azure Policy para controle de acesso e relatórios de conformidade. O Azure Policy fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a detecção rápida de violações. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Adicione configurações de diagnóstico para salvar logs, usando a tabela de destino Específico do Recurso, para todas as implantações do Firewall do Azure.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Use o Monitor da Conexão no Observador de Rede do Azure para monitorar métricas de latência para bancos de dados SAP e servidores de aplicativos. Ou colete e exiba medidas de latência de rede usando o Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
- "severity": "Importante",
- "text": "Migre das regras clássicas do Firewall do Azure (se houver) para a Política de Firewall.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "checklist": "SAP Checklist",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Execute uma verificação de qualidade para o SAP HANA na infraestrutura provisionada do Azure para verificar se as VMs provisionadas estão em conformidade com as práticas recomendadas do SAP HANA no Azure.",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use um prefixo /26 para suas sub-redes do Firewall do Azure.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
- "waf": "Segurança"
+ "text": "Para cada assinatura do Azure, execute um teste de latência nas zonas de disponibilidade do Azure antes da implantação zonal para escolher zonas de baixa latência para implantação do SAP no Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"severity": "Média",
- "text": "Organize as regras dentro da política de firewall em Grupos de Coleção de Regras e Coleções de Regras e com base em sua frequência de uso.",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "Desempenho"
+ "text": "Execute o Relatório de Resiliência para garantir que a configuração de toda a infraestrutura provisionada do Azure (Computação, Banco de Dados, Rede, Armazenamento, Site Recovery) esteja em conformidade com a configuração definida pelo Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Use grupos de IP ou prefixos de IP para reduzir o número de regras de tabela de IP.",
- "waf": "Desempenho"
+ "text": "Implemente a proteção contra ameaças usando a solução do Microsoft Sentinel para SAP. Use essa solução para monitorar seus sistemas SAP e detectar ameaças sofisticadas em toda a lógica de negócios e nas camadas de aplicativos.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "A marcação do Azure pode ser aproveitada para agrupar e rastrear recursos logicamente, automatizar suas implantações e, o mais importante, fornecer visibilidade sobre os custos incorridos.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
- "severity": "Média",
- "text": "Não use curingas como um IP de origem para DNATS, como * ou any, você deve especificar IPs de origem para DNATs de entrada.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Use o monitoramento de latência entre VMs para aplicativos sensíveis à latência.",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"severity": "Média",
- "text": "Evite o esgotamento da porta SNAT monitorando o uso da porta SNAT, avaliando as configurações do NAT Gateway e garantindo um failover contínuo. Se a contagem de portas se aproximar do limite, é um sinal de que o esgotamento do SNAT pode ser iminente.",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "Desempenho"
+ "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastre para servidores de aplicativos SAP.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Se você estiver usando o Firewall do Azure Premium, habilite a Inspeção TLS.",
+ "checklist": "SAP Checklist",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Exclua todos os sistemas de arquivos de banco de dados e programas executáveis das verificações antivírus. Incluí-los pode levar a problemas de desempenho. Verifique com os fornecedores de banco de dados os detalhes prescritivos na lista de exclusão. Por exemplo, a Oracle recomenda excluir /oracle//sapdata das verificações antivírus.",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"severity": "Baixo",
- "text": "Use categorias da Web para permitir ou negar o acesso de saída a tópicos específicos.",
+ "text": "Considere coletar estatísticas completas do banco de dados para bancos de dados não HANA após a migração. Por exemplo, implemente a nota 1020260 do SAP - Entrega de estatísticas do Oracle.",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"severity": "Média",
- "text": "Como parte da inspeção TLS, planeje o recebimento de tráfego dos Gateways de Aplicativo do Azure para inspeção.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "text": "Considere usar o ASM (Gerenciamento Automático de Armazenamento) do Oracle para todas as implantações do Oracle que usam o SAP no Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"severity": "Média",
- "text": "Habilite a configuração de proxy DNS do Firewall do Azure.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Segurança"
+ "text": "Para SAP no Azure executando Oracle, uma coleção de scripts SQL pode ajudá-lo a diagnosticar problemas de desempenho. Os relatórios do Automatic Workload Repository (AWR) contêm informações valiosas para diagnosticar problemas no sistema Oracle. Recomendamos que você execute um relatório AWR durante várias sessões e escolha horários de pico para ele, para garantir uma ampla cobertura para a análise.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Alto",
- "text": "Integre o Firewall do Azure ao Azure Monitor e habilite o log de diagnóstico para armazenar e analisar logs e métricas de firewall.",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "Baixo",
- "text": "Implementar backups para suas regras de firewall",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastre para servidores de aplicativos SAP.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Implante o Firewall do Azure em várias zonas de disponibilidade. O Firewall do Azure oferece SLAs diferentes, dependendo de sua implantação; em uma única zona de disponibilidade ou em várias, melhorando potencialmente a confiabilidade e o desempenho.",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
- "severity": "Alto",
- "text": "Configure a Proteção contra DDoS na VNet do Firewall do Azure, associe um plano de proteção contra DDoS à rede virtual que hospeda o Firewall do Azure para fornecer mitigação aprimorada contra ataques de DDoS. O Gerenciador de Firewall do Azure integra a criação de infraestrutura de firewall e planos de proteção contra DDoS. ",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
- "severity": "Alto",
- "text": "Não interrompa a comunicação do painel de controle para serviços de PaaS do Azure injetados em redes virtuais, como com uma rota 0.0.0.0/0 ou uma regra NSG que bloqueia o tráfego do painel de controle.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "checklist": "SAP Checklist",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Para entrega segura de aplicativos HTTP/S, use o Gateway de Aplicativo v2 e verifique se a proteção e as políticas do WAF estão habilitadas.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"severity": "Média",
- "text": "Acesse os serviços de PaaS do Azure localmente por meio de pontos de extremidade privados e emparelhamento privado do ExpressRoute. Esse método evita o trânsito pela Internet pública.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "Segurança"
+ "text": "Se o DNS ou o nome virtual da máquina virtual não for alterado durante a migração para o Azure, o DNS em segundo plano e os nomes virtuais conectarão muitas interfaces do sistema no cenário SAP, e os clientes só às vezes estarão cientes das interfaces que os desenvolvedores definem ao longo do tempo. Surgem desafios de conexão entre vários sistemas quando os nomes virtuais ou DNS são alterados após as migrações, e é recomendável manter os aliases DNS para evitar esses tipos de dificuldades.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
- "severity": "Alto",
- "text": "Não habilite pontos de extremidade de serviço de rede virtual por padrão em todas as sub-redes.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Use diferentes zonas DNS para distinguir cada ambiente (sandbox, desenvolvimento, pré-produção e produção) uns dos outros. A exceção é para implantações SAP com sua própria VNet; aqui, as zonas DNS privadas podem não ser necessárias.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "checklist": "SAP Checklist",
+ "description": "Ao configurar o emparelhamento VNet, use a configuração Permitir tráfego para redes virtuais remotas.",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Filtre o tráfego de saída para os serviços de PaaS do Azure usando FQDNs em vez de endereços IP no Firewall do Azure ou em uma NVA para evitar a exfiltração de dados. Se estiver usando o Link Privado, você poderá bloquear todos os FQDNs, caso contrário, permita apenas os serviços de PaaS necessários.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
- "waf": "Segurança"
+ "text": "O emparelhamento VNet local e global fornece conectividade e é a abordagem preferencial para garantir a conectividade entre zonas de destino para implantações SAP em várias regiões do Azure",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "checklist": "SAP Checklist",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"severity": "Alto",
- "text": "Utilize pelo menos um prefixo /27 para as sub-redes do Gateway.",
- "waf": "Segurança"
+ "text": "Não há suporte para implantar qualquer NVA entre o aplicativo SAP e o servidor de banco de dados SAP",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
- "severity": "Alto",
- "text": "Não confie nas regras padrão de entrada do NSG usando a marca de serviço VirtualNetwork para limitar a conectividade.",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais em que você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "checklist": "SAP Checklist",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"severity": "Média",
- "text": "Use NSGs para ajudar a proteger o tráfego entre sub-redes, bem como o tráfego leste/oeste na plataforma (tráfego entre zonas de destino).",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Segurança"
+ "text": "Considere implantar NVAs (soluções de virtualização de rede) entre regiões somente se NVAs de parceiros forem usadas. NVAs entre regiões ou VNets não serão necessárias se NVAs nativas estiverem presentes. Ao implantar tecnologias de rede de parceiros e NVAs, siga as diretrizes do fornecedor para verificar configurações conflitantes com a rede do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
+ "checklist": "SAP Checklist",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"severity": "Média",
- "text": "Use NSGs e grupos de segurança de aplicativos para microssegmentar o tráfego dentro da zona de destino e evite usar uma NVA central para filtrar fluxos de tráfego.",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "Segurança"
+ "text": "A WAN Virtual gerencia a conectividade entre VNets spoke para topologias baseadas em WAN virtual (não é necessário configurar UDR [roteamento definido pelo usuário] ou NVAs) e a taxa de transferência máxima de rede para tráfego de VNet para VNet no mesmo hub virtual é de 50 gigabits por segundo. Se necessário, as zonas de destino do SAP podem usar o emparelhamento VNet para se conectar a outras zonas de destino e superar essa limitação de largura de banda.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "severity": "Média",
- "text": "Habilite os Logs de Fluxo de VNet e alimente-os na Análise de Tráfego para obter insights sobre fluxos de tráfego internos e externos.",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "A atribuição de IP público à VM que executa a carga de trabalho SAP não é recomendada.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
- "severity": "Média",
- "text": "Não implemente mais de 900 regras de NSG por NSG, devido ao limite de 1000 regras.",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Considere reservar o endereço IP no lado da recuperação de desastre ao configurar o ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
- "severity": "Média",
- "text": "Use a WAN Virtual se o cenário estiver explicitamente descrito na lista de designs de roteamento da WAN Virtual.",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "checklist": "SAP Checklist",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Evite usar intervalos de endereços IP sobrepostos para sites de produção e DR.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Operações"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
"severity": "Média",
- "text": "Use um hub de WAN Virtual por região do Azure para conectar várias zonas de destino entre regiões do Azure por meio de uma WAN Virtual do Azure global comum.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Desempenho"
+ "text": "Embora o Azure ajude você a criar várias sub-redes delegadas em uma VNet, apenas uma sub-rede delegada pode existir em uma VNet para Azure NetApp Files. As tentativas de criar um novo volume falharão se você usar mais de uma sub-rede delegada para o Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
"severity": "Média",
- "text": "Para proteção e filtragem de tráfego de saída da Internet, implante o Firewall do Azure em hubs seguros.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "Usar o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"severity": "Média",
- "text": "Verifique se a arquitetura de rede da WAN virtual está alinhada a um cenário de arquitetura identificado.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Fiabilidade"
+ "text": "O Gateway de Aplicativo e o Firewall de Aplicativo Web têm limitações quando o Gateway de Aplicativo serve como um proxy reverso para aplicativos Web SAP, conforme mostrado na comparação entre o Gateway de Aplicativo, o SAP Web Dispatcher e outros serviços de terceiros.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o Azure Monitor Insights para WAN Virtual para monitorar a topologia de ponta a ponta da WAN Virtual, o status e as principais métricas.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Operações"
+ "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre regiões do Azure para conexões HTTP/S de entrada para uma zona de destino.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Não desabilite o tráfego branch a branch na WAN Virtual, a menos que esses fluxos devam ser bloqueados explicitamente.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Fiabilidade"
+ "text": "Aproveite as políticas de Firewall de Aplicativo Web no Azure Front Door quando estiver usando o Azure Front Door e o Gateway de Aplicativo para proteger aplicativos HTTP/S. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Use AS-Path como preferência de roteamento de hub, pois é mais flexível que ExpressRoute ou VPN.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Fiabilidade"
+ "text": "Use um firewall de aplicativo Web para verificar seu tráfego quando ele for exposto à Internet. Outra opção é usá-lo com o balanceador de carga ou com recursos que tenham recursos de firewall internos, como Gateway de Aplicativo ou soluções de terceiros.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
+ "checklist": "SAP Checklist",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Configure a propagação baseada em rótulos na WAN Virtual, caso contrário, a conectividade entre hubs virtuais será prejudicada.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Fiabilidade"
+ "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais em que você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "Desempenho"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
- "severity": "Alto",
- "text": "Atribua pelo menos um prefixo /23 a hubs virtuais para garantir que haja espaço IP suficiente disponível.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "Fiabilidade"
+ "checklist": "SAP Checklist",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Para evitar o vazamento de dados, use o Link Privado do Azure para acessar com segurança os recursos da plataforma como serviço, como Armazenamento de Blobs do Azure, Arquivos do Azure, Azure Data Lake Storage Gen2, Azure Data Factory e muito mais. O Ponto de Extremidade Privado do Azure também pode ajudar a proteger o tráfego entre VNets e serviços como Armazenamento do Azure, Backup do Azure e muito mais. O tráfego entre sua VNet e o serviço habilitado para Ponto de Extremidade Privado viaja pela rede global da Microsoft, o que impede sua exposição à Internet pública.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"severity": "Alto",
- "text": "Aproveite o Azure Policy estrategicamente, defina controles para seu ambiente, usando Iniciativas de Política para agrupar políticas relacionadas.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Segurança"
+ "text": "Verifique se a rede acelerada do Azure está habilitada nas VMs usadas no aplicativo SAP e nas camadas do DBMS.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
"severity": "Média",
- "text": "Mapeie os requisitos regulatórios e de conformidade para definições do Azure Policy e atribuições de função do Azure.",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "text": "Verifique se as implantações internas do Azure Load Balancer estão configuradas para usar o DSR (Retorno Direto do Servidor). Essa configuração (Habilitando IP Flutuante) reduzirá a latência quando as configurações do balanceador de carga interno forem usadas para configurações de alta disponibilidade na camada DBMS.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
"severity": "Média",
- "text": "Estabeleça definições do Azure Policy no grupo de gerenciamento raiz intermediário para que elas possam ser atribuídas em escopos herdados.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "Você pode usar o ASG (grupo de segurança do aplicativo) e as regras do NSG para definir listas de controle de acesso de segurança de rede entre o aplicativo SAP e as camadas do DBMS. Os ASGs agrupam máquinas virtuais para ajudar a gerenciar sua segurança.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"severity": "Alto",
- "text": "Gerencie atribuições de política no nível apropriado mais alto com exclusões nos níveis inferiores, se necessário.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Segurança"
+ "text": "Não há suporte para a colocação da camada de aplicativo SAP e do DBMS SAP em diferentes VNets do Azure que não estão emparelhadas.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "Baixo",
- "text": "Use o Azure Policy para controlar quais serviços os usuários podem provisionar no nível da assinatura/grupo de gerenciamento.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "Média",
+ "text": "Para obter a latência de rede ideal com aplicativos SAP, considere usar grupos de posicionamento por proximidade do Azure.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Desempenho"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "NÃO há suporte para executar uma camada do Servidor de Aplicativos SAP e uma camada do DBMS dividida entre o local e o Azure. Ambas as camadas precisam residir completamente no local ou no Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use políticas internas sempre que possível para minimizar a sobrecarga operacional.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Segurança"
+ "text": "Não é recomendável hospedar o DBMS (sistema de gerenciamento de banco de dados) e as camadas de aplicativo de sistemas SAP em VNets diferentes e conectá-los ao emparelhamento VNet devido aos custos substanciais que o tráfego de rede excessivo entre as camadas pode produzir. Recomendamos o uso de sub-redes na rede virtual do Azure para separar a camada de aplicativo SAP e a camada de DBMS.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "Atribuir a função Colaborador de Política de Recursos a escopos específicos permite delegar o gerenciamento de políticas a equipes relevantes. Por exemplo, uma equipe central de TI pode supervisionar as políticas no nível do grupo de gerenciamento, enquanto as equipes de aplicativos lidam com as políticas de suas assinaturas, permitindo a governança distribuída com adesão aos padrões organizacionais.",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
- "severity": "Média",
- "text": "Atribua a função interna de Colaborador de Política de Recursos em um escopo específico para habilitar a governança no nível do aplicativo.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Se estiver usando o Load Balancer com sistemas operacionais convidados Linux, verifique se o parâmetro de rede Linux net.ipv4.tcp_timestamps está definido como 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"severity": "Média",
- "text": "Limite o número de atribuições do Azure Policy feitas no escopo do grupo de gerenciamento raiz para evitar o gerenciamento por meio de exclusões em escopos herdados.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "Para implantações do SAP RISE/ECS, o emparelhamento virtual é a maneira preferencial de estabelecer conectividade com o ambiente existente do Azure do cliente. Tanto a rede virtual SAP quanto a(s) rede virtual(is) do cliente são protegidas com NSG (grupos de segurança de rede), permitindo a comunicação nas portas SAP e de banco de dados por meio do emparelhamento de rede virtual",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
- "severity": "Média",
- "text": "Se houver requisitos de soberania de dados, as Políticas do Azure deverão ser implantadas para aplicá-los.",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Examine os backups de banco de dados do SAP HANA para VMs do Azure.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"severity": "Média",
- "text": "Para a Zona de Destino Soberana, implante a linha de base da política de soberania e atribua no nível correto do grupo de gerenciamento.",
- "waf": "Segurança"
+ "text": "Examine o monitoramento interno do Site Recovery, quando usado para SAP.",
+ "waf": "Custar"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
- "severity": "Média",
- "text": "Para Zona de Aterrissagem Soberana, documente os objetivos de Controle Soberano para mapeamento de políticas.",
- "waf": "Segurança"
+ "checklist": "SAP Checklist",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Revise as diretrizes Monitorando o cenário do sistema SAP HANA.",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
+ "checklist": "SAP Checklist",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"severity": "Média",
- "text": "Para a Zona de Aterrissagem Soberana, certifique-se de que o processo esteja em vigor para o gerenciamento de 'Objetivos de Controle Soberano para mapeamento de políticas'.",
- "waf": "Segurança"
+ "text": "Examine o Oracle Database nas estratégias de backup de VM Linux do Azure.",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"severity": "Média",
- "text": "Use um workspace de logs de monitor único para gerenciar plataformas centralmente, exceto quando o RBAC (controle de acesso baseado em função) do Azure, os requisitos de soberania de dados ou as políticas de retenção de dados exigirem workspaces separados.",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "text": "Examine o uso do Armazenamento de Blobs do Azure com o SQL Server 2016.",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"severity": "Média",
- "text": "Decida se deseja usar um único workspace de Logs do Azure Monitor para todas as regiões ou criar vários workspaces para abranger várias regiões geográficas. Cada abordagem tem vantagens e desvantagens, incluindo possíveis cobranças de rede entre regiões",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "Fiabilidade"
+ "text": "Examine o uso do Backup Automatizado v2 para VMs do Azure.",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"severity": "Alto",
- "text": "Exporte logs para o Armazenamento do Azure se os requisitos de retenção de log excederem doze anos. Use o armazenamento imutável com uma política de gravação única e leitura múltipla para tornar os dados não apagáveis e não modificáveis por um intervalo especificado pelo usuário.",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "text": "Habilitando o acelerador de gravação para a série M ao usar discos premium (V1)",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"severity": "Média",
- "text": "Monitore o descompasso de configuração da VM (máquina virtual) no nível do sistema operacional usando o Azure Policy. Habilitar os recursos de auditoria da Configuração de Computador do Gerenciamento Automatizado do Azure por meio da política ajuda as cargas de trabalho da equipe de aplicativos a consumir imediatamente os recursos de recursos com pouco esforço.",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Operações"
+ "text": "Teste a latência da zona de disponibilidade.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o Azure Update Manager como um mecanismo de aplicação de patch para VMs Windows e Linux no Azure.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operações"
+ "text": "Ative o SAP EarlyWatch Alert para todos os componentes SAP.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o Gerenciador de Atualizações do Azure como um mecanismo de aplicação de patch para VMs do Windows e do Linux fora do Azure usando o Azure Arc.",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "Operações"
+ "text": "Revise a latência do servidor de aplicativos SAP para o servidor de banco de dados usando o relatório SAP ABAPMeter /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Desempenho"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "checklist": "SAP Checklist",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o Observador de Rede para monitorar proativamente os fluxos de tráfego.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Operações"
+ "text": "Revise o monitoramento de desempenho do SQL Server usando o CCMS.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
"severity": "Média",
- "text": "Use os Logs do Azure Monitor para obter insights e relatórios.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "Operações"
+ "text": "Teste a latência de rede entre VMs da camada de aplicativo SAP e VMs do DBMS (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
"severity": "Média",
- "text": "Use alertas do Azure Monitor para a geração de alertas operacionais.",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "Operações"
+ "text": "Revise os alertas do SAP HANA Studio.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "checklist": "SAP Checklist",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
"severity": "Média",
- "text": "Ao usar o Acompanhamento de Alterações e Inventário por meio de Contas de Automação do Azure, verifique se você selecionou regiões com suporte para vincular seu workspace do Log Analytics e contas de automação.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "Operações"
- },
- {
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
- "severity": "Baixo",
- "text": "Ao usar o Backup do Azure, use os tipos de backup corretos (GRS, ZRS E LRS) para o backup, pois a configuração padrão é GRS.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Fiabilidade"
+ "text": "Execute verificações de integridade do SAP HANA usando HANA_Configuration_Minichecks.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"severity": "Média",
- "text": "Use as políticas de convidado do Azure para implantar automaticamente as configurações de software por meio de extensões de VM e impor uma configuração de VM de linha de base compatível.",
+ "text": "Se você executar VMs do Windows e do Linux no Azure, localmente ou em outros ambientes de nuvem, poderá usar o Centro de gerenciamento de atualizações na Automação do Azure para gerenciar atualizações do sistema operacional, incluindo patches de segurança.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "Use os recursos de configuração de convidado do Azure Policy para auditar e corrigir as configurações do computador (por exemplo, sistema operacional, aplicativo, ambiente) para garantir que os recursos estejam alinhados com as configurações esperadas e que o Gerenciamento de Atualizações possa impor o gerenciamento de patches para VMs.",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"severity": "Média",
- "text": "Monitore o descompasso de configuração de segurança da VM por meio do Azure Policy.",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Revise rotineiramente as notas de OSS de segurança do SAP porque o SAP lança patches de segurança altamente críticos, ou hot fixes, que exigem ação imediata para proteger seus sistemas SAP.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
- "severity": "Média",
- "text": "Use o Azure Site Recovery para cenários de recuperação de desastre de Máquinas Virtuais do Azure para o Azure. Isso permite replicar cargas de trabalho entre regiões.",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "Operações"
+ "checklist": "SAP Checklist",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Para SAP no SQL Server, você pode desabilitar a conta de administrador do sistema do SQL Server porque os sistemas SAP no SQL Server não usam a conta. Certifique-se de que outro usuário com direitos de administrador do sistema possa acessar o servidor antes de desabilitar a conta original de administrador do sistema.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
- "severity": "Média",
- "text": "Use recursos de backup nativos do Azure ou uma solução de backup de terceiros compatível com o Azure.",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "Operações"
+ "checklist": "SAP Checklist",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Desative xp_cmdshell. O recurso SQL Server xp_cmdshell habilita um shell de comando do sistema operacional interno do SQL Server. É um risco potencial em auditorias de segurança.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
+ "checklist": "SAP Checklist",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"severity": "Alto",
- "text": "Adicione configurações de diagnóstico para salvar logs do WAF de serviços de entrega de aplicativos, como o Azure Front Door e o Gateway de Aplicativo do Azure. Revise regularmente os logs para verificar se há ataques e detecções de falsos positivos.",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "Operações"
+ "text": "A criptografia de servidores de banco de dados SAP HANA no Azure usa a tecnologia de criptografia nativa do SAP HANA. Além disso, se você estiver usando o SQL Server no Azure, use a TDE (Transparent Data Encryption) para proteger seus dados e arquivos de log e garantir que seus backups também sejam criptografados.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "checklist": "SAP Checklist",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
"severity": "Média",
- "text": "Envie logs do WAF de seus serviços de entrega de aplicativos, como o Azure Front Door e o Gateway de Aplicativo do Azure, para o Microsoft Sentinel. Detecte ataques e integre a telemetria do WAF ao seu ambiente geral do Azure.",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
- "waf": "Operações"
+ "text": "A criptografia do Armazenamento do Azure está habilitada para todas as contas de armazenamento clássicas e do Azure Resource Manager e não pode ser desabilitada. Como seus dados são criptografados por padrão, você não precisa modificar seu código ou aplicativos para usar a criptografia do Armazenamento do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
"link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
+ "service": "SAP",
"severity": "Alto",
- "text": "Use o Azure Key Vault para armazenar seus segredos e credenciais.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "text": "Usar o Azure Key Vault para armazenar seus segredos e credenciais",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"severity": "Média",
- "text": "Use diferentes Azure Key Vaults para diferentes aplicativos e regiões para evitar limites de escala de transação e restringir o acesso a segredos.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "text": "É recomendável BLOQUEAR os Recursos do Azure após a implantação bem-sucedida para proteger contra alterações não autorizadas. Você também pode impor restrições e regras de LOCK por assinatura usando políticas personalizadas do Azure (função personalizada).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"severity": "Média",
"text": "Provisione o Azure Key Vault com as políticas de exclusão reversível e limpeza habilitadas para permitir a proteção de retenção para objetos excluídos.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Siga um modelo de privilégios mínimos limitando a autorização para excluir permanentemente chaves, segredos e certificados a funções personalizadas especializadas de ID do Microsoft Entra.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Com base nos requisitos existentes, controles regulatórios e de conformidade (internos/externos) – determine quais políticas do Azure e a função RBAC do Azure são necessárias",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Automatize o processo de gerenciamento e renovação de certificados com autoridades de certificação públicas para facilitar a administração.",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Ao habilitar o Microsoft Defender para Ponto de Extremidade no ambiente SAP, recomendamos excluir dados e arquivos de log em servidores DBMS em vez de direcionar todos os servidores. Siga as recomendações do fornecedor do DBMS ao excluir arquivos de destino.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Estabeleça um processo automatizado para rotação de chaves e certificados.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Delegue uma função personalizada de administrador do SAP com acesso just-in-time do Microsoft Defender para Nuvem.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Habilite o firewall e o ponto de extremidade de serviço de rede virtual ou o ponto de extremidade privado no cofre para controlar o acesso ao cofre de chaves.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "checklist": "SAP Checklist",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "criptografar dados em trânsito integrando o produto de segurança de terceiros com comunicações de rede seguras (SNC) para DIAG (SAP GUI), RFC e SPNEGO para HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"severity": "Média",
- "text": "Use o workspace do Log Analytics do Azure Monitor central da plataforma para auditar o uso de chave, certificado e segredo em cada instância do Key Vault.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "text": "Padrão para chaves gerenciadas pela Microsoft para funcionalidade de criptografia principal e use chaves gerenciadas pelo cliente quando necessário.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Delegue a instanciação e o acesso privilegiado do Key Vault e use o Azure Policy para impor uma configuração consistente e compatível.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Use um Azure Key Vault por aplicativo por ambiente por região.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Para controlar e gerenciar chaves e segredos de criptografia de disco para sistemas operacionais Windows e Windows não HANA, use o Azure Key Vault. Não há suporte para o SAP HANA com o Azure Key Vault, portanto, você deve usar métodos alternativos, como chaves SAP ABAP ou SSH.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Personalizar funções RBAC (controle de acesso baseado em função) para assinaturas SAP on Azure spoke para evitar alterações acidentais relacionadas à rede",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Isole DMZs e NVAs do restante da propriedade SAP, configure o Link Privado do Azure e gerencie e controle com segurança os recursos do SAP no Azure",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Considere usar o software antimalware da Microsoft no Azure para proteger suas máquinas virtuais contra arquivos mal-intencionados, adware e outras ameaças.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Use um Azure Key Vault por aplicativo por ambiente por região.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Para obter uma proteção ainda mais poderosa, considere usar Microsoft Defender para Ponto de Extremidade.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Se você quiser trazer suas próprias chaves, isso pode não ser compatível com todos os serviços considerados. Implemente mitigação relevante para que as inconsistências não prejudiquem os resultados desejados. Escolha pares de regiões apropriados e regiões de recuperação de desastre que minimizem a latência.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
+ "severity": "Alto",
+ "text": "Isole o aplicativo SAP e os servidores de banco de dados da Internet ou da rede local passando todo o tráfego pela rede virtual do hub, que está conectada à rede spoke por emparelhamento de rede virtual. As redes virtuais emparelhadas garantem que a solução SAP no Azure seja isolada da Internet pública.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
- "severity": "Média",
- "text": "Para a Zona de Destino Soberana, use o HSM gerenciado do Azure Key Vault para armazenar seus segredos e credenciais.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "checklist": "SAP Checklist",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "Baixo",
+ "text": "Para aplicativos voltados para a Internet, como o SAP Fiori, certifique-se de distribuir a carga por requisitos do aplicativo, mantendo os níveis de segurança. Para segurança de Camada 7, você pode usar um WAF (Firewall de Aplicativo Web) de terceiros disponível no Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
"severity": "Média",
- "text": "Use os recursos de relatório de ID do Microsoft Entra para gerar relatórios de auditoria de controle de acesso.",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "text": "Para habilitar a comunicação segura no Azure Monitor para soluções SAP, você pode optar por usar um certificado raiz ou um certificado de servidor. É altamente recomendável que você use certificados raiz.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
- "severity": "Alto",
- "text": "Habilite o Gerenciamento de Postura de Segurança de Nuvem do Defender para todas as assinaturas.",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aplicar as diretrizes do parâmetro de comparação de segurança de nuvem da Microsoft relacionado ao armazenamento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Por padrão, o Armazenamento do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Habilite um Plano de Proteção de Carga de Trabalho de Nuvem do Defender para Servidores em todas as assinaturas.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "text": "Considere usar pontos de extremidade privados para o Armazenamento do Azure",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
- "severity": "Alto",
- "text": "Habilite os Planos de Proteção de Carga de Trabalho de Nuvem do Defender para Recursos do Azure em todas as assinaturas.",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação do ARM, para que o RBAC, a auditoria etc. estejam habilitados. Verifique se não há contas de armazenamento antigas com o modelo de implantação clássico em uma assinatura",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Verifique se as contas de armazenamento mais antigas não estão usando o \"modelo de implantação clássico\"",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Habilite o Endpoint Protection em servidores IaaS.",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "O mecanismo de exclusão reversível permite recuperar blobs excluídos acidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Monitore o descompasso de aplicação de patch do sistema operacional base por meio dos Logs do Azure Monitor e do Defender para Nuvem.",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "text": "Habilitar 'exclusão reversível' para blobs",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Conecte as configurações de recursos padrão a um workspace centralizado do Log Analytics do Azure Monitor.",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "text": "Desabilitar a 'exclusão reversível' para blobs",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A exclusão reversível para contêineres permite que você recupere um contêiner depois que ele foi excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Detecção centralizada de ameaças com logs correlacionados - consolide os dados de segurança em um local central onde possam ser correlacionados em vários serviços via SIEM (gerenciamento de eventos e informações de segurança)",
+ "text": "Habilitar 'exclusão reversível' para contêineres",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Para Zona de Destino Soberana, habilite os logs de transparência no locatário da ID do Entra.",
+ "text": "Desabilitar a 'exclusão reversível' para contêineres",
"waf": "Segurança"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
- "severity": "Média",
- "text": "Para Zona de Destino Soberana, habilite o Sistema de Proteção de Dados do cliente no locatário da ID do Entra.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Impede a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitar bloqueios de recursos em contas de armazenamento",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere as políticas de 'retenção legal' ou 'retenção baseada em tempo' para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Observe que 'impossível' na verdade significa 'impossível'; depois que uma conta de armazenamento contém um blob imutável, a única maneira de \"se livrar\" dessa conta de armazenamento é cancelando a assinatura do Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Habilite a transferência segura para contas de armazenamento.",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "text": "Considere blobs imutáveis",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Habilite a exclusão reversível do contêiner para a conta de armazenamento para recuperar um contêiner excluído e seu conteúdo.",
+ "text": "Exigir HTTPS, ou seja, desabilitar a porta 80 na conta de armazenamento",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; nesse caso, talvez seja necessário colocar a CDN do Azure na frente de sua conta de armazenamento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Use segredos do Key Vault para evitar codificar informações confidenciais, como credenciais (máquinas virtuais, senhas de usuário), certificados ou chaves.",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "Operações"
+ "text": "Ao impor HTTPS (desabilitando o HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Use o token revogável de longa duração, armazene seu token em cache e adquira o token silenciosamente usando a Microsoft Identity Library",
- "waf": "Fiabilidade"
+ "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) apenas a conexões HTTPS",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
- "severity": "Média",
- "text": "Certifique-se de que os fluxos de usuário de entrada sejam armazenados em backup e resilientes. Certifique-se de que o código que você usa para entrar em seus usuários é de backup e recuperável. Interfaces resilientes com processos externos",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". A imposição da versão mais recente do TLS rejeitará a solicitação de clientes que usam a versão mais antiga. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Impor a versão mais recente do TLS para uma conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Os tokens de ID do Microsoft Entra devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Usar tokens de ID do Microsoft Entra para acesso a blobs",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que ela execute suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Os ativos de marca personalizados devem ser hospedados em uma CDN",
- "waf": "Desempenho"
+ "text": "Privilégios mínimos em permissões de IaM",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "Baixo",
- "text": "Ter vários provedores de identidade (ou seja, fazer login com suas contas da Microsoft, Google, Facebook)",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Ao usar SAS, prefira 'SAS de delegação de usuário' em vez de SAS baseada em chave de conta de armazenamento.",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "Média",
- "text": "Siga as regras de VM para alta disponibilidade no nível da VM (discos premium, dois ou mais em uma região, em zonas de disponibilidade diferentes)",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As chaves da conta de armazenamento (\"chaves compartilhadas\") têm muito poucos recursos de auditoria. Embora possa ser monitorado em quem/quando buscou uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Confiar apenas na autenticação do Entra ID facilita o acesso ao armazenamento a um usuário. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere desabilitar as chaves da conta de armazenamento, para que haja suporte apenas para o acesso à ID do Microsoft Entra (e à SAS de delegação de usuário).",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "Média",
- "text": "Não replique! A replicação pode criar problemas com a sincronização de diretórios",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use os dados do Log de Atividades para identificar \"quando\", \"quem\", \"o quê\" e \"como\" a segurança da sua conta de armazenamento está sendo exibida ou alterada (ou seja, chaves da conta de armazenamento, políticas de acesso etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere usar o Azure Monitor para auditar as operações do painel de controle na conta de armazenamento",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete é exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Ter ativo-ativo para várias regiões",
- "waf": "Fiabilidade"
+ "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma política de expiração de SAS especifica um intervalo recomendado durante o qual a SAS é válida. As políticas de expiração de SAS se aplicam a uma SAS de serviço ou a uma SAS de conta. Quando um usuário gera SAS de serviço ou uma SAS de conta com um intervalo de validade maior que o intervalo recomendado, ele verá um aviso.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Adicionar carimbos de serviço de Domínio do Azure AD a regiões e locais adicionais",
- "waf": "Fiabilidade"
+ "text": "Considere configurar uma política de expiração de SAS",
+ "waf": "Segurança"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As políticas de acesso armazenadas oferecem a opção de revogar permissões para uma SAS de serviço sem precisar regenerar as chaves da conta de armazenamento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Usar conjuntos de réplicas para DR",
- "waf": "Fiabilidade"
+ "text": "Considere vincular SAS a uma política de acesso armazenada",
+ "waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Aplicar as orientações do benchmark de segurança na nuvem da Microsoft relacionadas ao armazenamento",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
"service": "Azure Storage",
"severity": "Média",
- "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
+ "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão e chaves de conta de armazenamento com check-in.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "O Armazenamento do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Idealmente, seu aplicativo deve usar uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave da conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Considere o uso de pontos de extremidade privados para o Armazenamento do Azure",
+ "text": "Considere armazenar cadeias de conexão no Azure KeyVault (em cenários em que as identidades gerenciadas não são possíveis)",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação ARM, para que o RBAC, a auditoria, etc., estejam todos habilitados. Verifique se não há contas de armazenamento antigas com modelo de implantação clássico em uma assinatura",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use tempos de expiração de curto prazo em uma SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que uma SAS seja comprometida, ela é válida apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenada. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
"service": "Azure Storage",
- "severity": "Média",
- "text": "Verifique se as contas de armazenamento mais antigas não estão usando o 'modelo de implantação clássico'",
+ "severity": "Alto",
+ "text": "Esforce-se por períodos de validade curtos para SAS ad-hoc",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao criar uma SAS, seja o mais específico e restritivo possível. Prefira uma SAS para um único recurso e operação em vez de uma SAS que oferece acesso muito mais amplo.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
+ "severity": "Média",
+ "text": "Aplicar um escopo restrito a uma SAS",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "O mecanismo soft-delete permite recuperar blobs excluídos acidentalmente.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS pode incluir parâmetros nos quais os endereços IP do cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
"service": "Azure Storage",
"severity": "Média",
- "text": "Ativar 'exclusão suave' para blobs",
+ "text": "Considere definir o escopo da SAS para um endereço IP de cliente específico, sempre que possível",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de preços da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdos maliciosamente grandes.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
"service": "Azure Storage",
- "severity": "Média",
- "text": "Desativar 'exclusão suave' para blobs",
+ "severity": "Baixo",
+ "text": "Considere verificar os dados carregados depois que os clientes usaram uma SAS para carregar um arquivo. ",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "A exclusão suave para contêineres permite que você recupere um contêiner depois que ele tenha sido excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao acessar o armazenamento de blobs por meio do SFTP usando uma \"conta de usuário local\", os controles RBAC \"usuais\" não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso SFTP. Infelizmente, a partir do início de 2023, os usuários locais são a única forma de gerenciamento de identidade com suporte atual para o endpoint SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Ativar 'exclusão suave' para contêineres",
+ "text": "SFTP: limite a quantidade de \"usuários locais\" para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
"service": "Azure Storage",
"severity": "Média",
- "text": "Desativar 'exclusão suave' para contêineres",
+ "text": "SFTP: o endpoint SFTP não oferece suporte a ACLs semelhantes a POSIX.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Evita a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "O armazenamento oferece suporte ao CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha as CorsRules com o menor privilégio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Habilitar bloqueios de recursos em contas de armazenamento",
+ "text": "Evite políticas de CORS excessivamente amplas",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere políticas de \"retenção legal\" ou \"retenção baseada em tempo\" para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Por favor, note que \"impossível\" significa na verdade \"impossível\"; uma vez que uma conta de armazenamento contém um blob imutável, a única maneira de 'se livrar' dessa conta de armazenamento é cancelando a assinatura do Azure.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode ocorrer usando uma chave gerenciada pela plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não dependendo do Armazenamento do Azure para garantias de confidencialidade.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Considere blobs imutáveis",
+ "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Exigir HTTPS, ou seja, desativar a porta 80 na conta de armazenamento",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; em caso afirmativo, talvez seja necessário colocar a CDN do Azure na frente da sua conta de armazenamento.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Ao impor HTTPS (desabilitando HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
"service": "Azure Storage",
- "severity": "Média",
- "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) somente a conexões HTTPS",
+ "severity": "Alto",
+ "text": "Considere se o acesso anônimo de blob público é necessário ou se ele pode ser desabilitado para determinadas contas de armazenamento. ",
"waf": "Segurança"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Os tokens AAD devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveite um tipo de conta storagev2 para melhor desempenho e confiabilidade",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
"service": "Azure Storage",
"severity": "Alto",
- "text": "Usar tokens do Azure Active Directory (Azure AD) para acesso de blob",
- "waf": "Segurança"
+ "text": "Aproveite o armazenamento GRS, ZRS ou GZRS para obter a mais alta disponibilidade",
+ "waf": "Fiabilidade"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que eles executem suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
"service": "Azure Storage",
"severity": "Média",
- "text": "Privilégio mínimo nas permissões do IaM",
- "waf": "Segurança"
+ "text": "Para operação de gravação após o failover, use o failover gerenciado pelo cliente ",
+ "waf": "Fiabilidade"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Ao usar o SAS, prefira o SAS de delegação de usuário ao SAS baseado em chave de conta de armazenamento.",
- "waf": "Segurança"
+ "severity": "Média",
+ "text": "Entender os detalhes do failover gerenciado pela Microsoft",
+ "waf": "Fiabilidade"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "As chaves de conta de armazenamento ('chaves compartilhadas') têm pouquíssimos recursos de auditoria. Embora possa ser monitorado em quem/quando foi obtida uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Depender exclusivamente da autenticação do AAD facilita a vinculação do acesso ao armazenamento a um usuário. ",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
"service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere desabilitar as chaves de conta de armazenamento, para que somente o acesso ao AAD (e a delegação de usuários SAS) seja suportado.",
+ "severity": "Média",
+ "text": "Habilitar exclusão reversível",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Verifique se você está usando o SKU do Gateway de Aplicativo v2",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Use os dados do Registro de atividades para identificar \"quando\", \"quem\", \"o que\" e \"como\" a segurança da sua conta de armazenamento está sendo visualizada ou alterada (ou seja, chaves de conta de armazenamento, políticas de acesso, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere usar o Azure Monitor para auditar as operações do plano de controle na conta de armazenamento",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
+ "severity": "Média",
+ "text": "Verifique se você está usando o SKU Standard para seus Azure Load Balancers",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete será exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
"severity": "Média",
- "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
+ "text": "Verifique se os endereços IP de front-end dos Load Balancers têm redundância de zona (a menos que você precise de front-ends zonais).",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Uma diretiva de expiração SAS especifica um intervalo recomendado sobre o qual a SAS é válida. As políticas de expiração do SAS se aplicam a um SAS de serviço ou a um SAS de conta. Quando um usuário gera SAS de serviço ou SAS de conta com um intervalo de validade maior do que o intervalo recomendado, ele verá um aviso.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Considere configurar uma política de expiração SAS",
+ "text": "Seus Gateways de Aplicativo v2 devem ser implantados em sub-redes com prefixos IP iguais ou maiores que /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "As políticas de acesso armazenado oferecem a opção de revogar permissões para uma SAS de serviço sem precisar gerar novamente as chaves da conta de armazenamento. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "A administração de proxies reversos em geral e WAF em particular está mais próxima do aplicativo do que da rede, portanto, eles pertencem à mesma assinatura que o aplicativo. Centralizar o Gateway de Aplicativo e o WAF na assinatura de conectividade pode ser OK se ele for gerenciado por uma única equipe.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Considere vincular o SAS a uma política de acesso armazenado",
+ "text": "Implante o Gateway de Aplicativo do Azure v2 ou NVAs de parceiros usados para proxy de conexões HTTP(S) de entrada na rede virtual da zona de destino e com os aplicativos que eles estão protegendo.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão com check-in e chaves de conta de armazenamento.",
+ "text": "Use uma rede DDoS ou planos de proteção de IP para todos os endereços IP públicos em zonas de destino do aplicativo.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Idealmente, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave de conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere armazenar cadeias de conexão no Cofre de Chaves do Azure (em cenários em que identidades gerenciadas não são possíveis)",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Configure o dimensionamento automático com uma quantidade mínima de instâncias de duas.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Implantar o Gateway de Aplicativo em Zonas de Disponibilidade",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
+ "severity": "Média",
+ "text": "Ao usar o Front Door e o Gateway de Aplicativo para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Front Door. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Use tempos de expiração de curto prazo em um SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que um SAS seja comprometido, ele é válido apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenado. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
"severity": "Alto",
- "text": "Esforce-se por curtos períodos de validade para SAS ad-hoc",
+ "text": "Use o Gerenciador de Tráfego para fornecer aplicativos globais que abrangem protocolos diferentes de HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Fiabilidade"
+ },
+ {
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "Baixo",
+ "text": "Se os usuários precisarem apenas de acesso a aplicativos internos, o Proxy de Aplicativo de ID do Microsoft Entra foi considerado como uma alternativa à AVD (Área de Trabalho Virtual) do Azure?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Ao criar um SAS, seja o mais específico e restritivo possível. Prefira um SAS para um único recurso e operação em vez de um SAS que dá acesso muito mais amplo.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "Média",
- "text": "Aplicar um escopo restrito a uma SAS",
+ "text": "Para reduzir o número de portas de firewall abertas para conexões de entrada em sua rede, considere usar o Proxy de Aplicativo de ID do Microsoft Entra para fornecer aos usuários remotos acesso seguro e autenticado a aplicativos internos.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Uma SAS pode incluir parâmetros nos quais endereços IP de cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
- "severity": "Média",
- "text": "Considere a definição do escopo do SAS para um endereço IP de cliente específico, sempre que possível",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
+ "severity": "Alto",
+ "text": "Usar o Gateway NAT do Azure em vez das regras de saída do Load Balancer para melhorar a escalabilidade SNAT",
+ "waf": "Fiabilidade"
+ },
+ {
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
+ "severity": "Alto",
+ "text": "Habilite o conjunto de regras de proteção contra bot do WAF do Gateway de Aplicativo do Azure. As regras de bot detectam bots bons e ruins.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Um SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de precificação da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdo maliciosamente grande.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "Baixo",
- "text": "Considere verificar os dados carregados, depois que os clientes usaram um SAS para carregar um arquivo. ",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
+ "severity": "Alto",
+ "text": "Verifique se o recurso de inspeção do corpo da solicitação está habilitado na política WAF do Gateway de Aplicativo do Azure.",
+ "waf": "Segurança"
+ },
+ {
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
+ "severity": "Alto",
+ "text": "Ajuste o WAF do Gateway de Aplicativo do Azure no modo de detecção para sua carga de trabalho. Reduza as detecções de falsos positivos.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Ao acessar o armazenamento de blob via SFTP usando uma 'conta de usuário local', os controles RBAC 'normais' não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso a SFTP. Infelizmente, no início de 2023, os usuários locais são a única forma de gerenciamento de identidade que atualmente é suportada para o ponto de extremidade SFTP",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
"severity": "Alto",
- "text": "SFTP: Limite a quantidade de 'usuários locais' para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
+ "text": "Implante sua política de WAF para Gateway de Aplicativo no modo 'Prevenção'.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"severity": "Média",
- "text": "SFTP: O ponto de extremidade SFTP não oferece suporte a ACLs do tipo POSIX.",
+ "text": "Adicione a limitação de taxa ao WAF do Gateway de Aplicativo do Azure. A limitação de taxa bloqueia os clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "O armazenamento oferece suporte a CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha o CorsRules com o menor privilégio.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Evite políticas CORS excessivamente amplas",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Use um limite alto para os limites de taxa do WAF do Gateway de Aplicativo do Azure. Os limites de limite de taxa altos evitam o bloqueio do tráfego legítimo, ao mesmo tempo em que fornecem proteção contra números extremamente altos de solicitações que podem sobrecarregar sua infraestrutura. ",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode acontecer usando uma chave gerenciada por plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não depende do Armazenamento do Azure para garantias de confidencialidade.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
+ "severity": "Baixo",
+ "text": "Se você não estiver esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
+ "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Gateway de Aplicativo do Azure. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
+ "text": "Use a versão mais recente do conjunto de regras do WAF do Gateway de Aplicativo do Azure. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário de ameaças atual.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere se o acesso de blob público é necessário ou se pode ser desabilitado para determinadas contas de armazenamento. ",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Adicione configurações de diagnóstico para salvar os logs do WAF do Gateway de Aplicativo do Azure.",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"severity": "Média",
- "text": "O ACSS (Centro de Soluções SAP) do Azure é uma oferta do Azure que torna o SAP uma carga de trabalho de nível superior no Azure. O ACSS é uma solução de ponta a ponta que permite criar e executar sistemas SAP como uma carga de trabalho unificada no Azure e fornece uma base mais perfeita para a inovação. Você pode aproveitar os recursos de gerenciamento para sistemas SAP novos e existentes baseados no Azure.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "text": "Envie logs do WAF do Gateway de Aplicativo do Azure para o Microsoft Sentinel.",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"severity": "Média",
- "text": "O Azure dá suporte à automação de implantações do SAP no Linux e no Windows. O SAP Deployment Automation Framework é uma ferramenta de orquestração de software livre que pode implementar, instalar e manter ambientes SAP.",
- "training": "https://github.com/Azure/sap-automation",
+ "text": "Defina a configuração do WAF do Gateway de Aplicativo do Azure como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Execute uma recuperação pontual para seus bancos de dados de produção a qualquer momento e em um período de tempo que atenda ao seu RTO; a recuperação point-in-time normalmente inclui erros do operador que excluem dados na camada DBMS ou por meio do SAP, incidentalmente",
- "waf": "Fiabilidade"
+ "text": "Use as Políticas do WAF em vez da configuração herdada do WAF.",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Teste os tempos de backup e recuperação para verificar se eles atendem aos requisitos de RTO para restaurar todos os sistemas simultaneamente após um desastre.",
- "waf": "Fiabilidade"
+ "text": "Filtre o tráfego de entrada nos back-ends para que eles aceitem apenas conexões da sub-rede do Gateway de Aplicativo, por exemplo, com NSGs.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
"severity": "Alto",
- "text": "Você pode replicar o armazenamento padrão entre regiões emparelhadas, mas não pode usar o armazenamento padrão para armazenar seus bancos de dados ou discos rígidos virtuais. Você pode replicar backups somente entre regiões emparelhadas que você usa. Para todos os outros dados, execute a replicação usando recursos nativos do DBMS, como SQL Server Always On ou Replicação do Sistema SAP HANA. Use uma combinação de Site Recovery, rsync ou robocopy e outros softwares de terceiros para a camada de aplicativo SAP.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Fiabilidade"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
- "severity": "Média",
- "text": "Ao usar as Zonas de Disponibilidade do Azure para obter alta disponibilidade, você deve considerar a latência entre os servidores de aplicativos SAP e os servidores de banco de dados. Para zonas com altas latências, os procedimentos operacionais precisam estar em vigor para garantir que os servidores de aplicativos SAP e os servidores de banco de dados estejam em execução na mesma zona o tempo todo.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Fiabilidade"
+ "text": "Você deve criptografar o tráfego para os servidores de back-end.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
"severity": "Alto",
- "text": "Configure conexões do ExpressRoute do local para as regiões de recuperação de desastre primárias e secundárias do Azure. Além disso, como alternativa ao uso do ExpressRoute, considere configurar conexões VPN do local para as regiões primárias e secundárias de recuperação de desastre do Azure.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Fiabilidade"
+ "text": "Você deve usar um Web Application Firewall.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Replique o conteúdo do cofre de chaves, como certificados, segredos ou chaves entre regiões, para que você possa descriptografar dados na região de recuperação de desastre.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Redirecionar HTTP para HTTPS",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
"severity": "Média",
- "text": "Emparelhe as redes virtuais primárias e de recuperação de desastre. Por exemplo, para a Replicação do Sistema HANA, uma rede virtual de banco de dados do SAP HANA precisa ser emparelhada com a rede virtual de banco de dados do SAP HANA do site de recuperação de desastres.",
- "waf": "Fiabilidade"
+ "text": "Use cookies gerenciados por gateway para direcionar o tráfego de uma sessão de usuário para o mesmo servidor para processamento",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
+ "severity": "Alto",
+ "text": "Habilitar a drenagem de conexão durante atualizações de serviço planejadas para evitar a perda de conexão para membros existentes do pool de back-end",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
"severity": "Baixo",
- "text": "Se você usar o armazenamento do Azure NetApp Files para suas implantações SAP, no mínimo, crie duas contas do Azure NetApp Files na camada Premium, em duas regiões.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Fiabilidade"
+ "text": "Crie páginas de erro personalizadas para exibir uma experiência de usuário personalizada",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "Alto",
- "text": "A tecnologia de replicação de banco de dados nativa deve ser usada para sincronizar o banco de dados em um par de HA.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Edite solicitações HTTP e cabeçalhos de resposta para facilitar o roteamento e a troca de informações entre o cliente e o servidor",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
- "severity": "Alto",
- "text": "O CIDR da VNet (rede virtual) primária não deve entrar em conflito ou se sobrepor ao CIDR da VNet do site de recuperação de desastre",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Configure o Front Door para otimizar o roteamento de tráfego da Web global e o desempenho e a confiabilidade do usuário final de nível superior por meio de failover global rápido",
+ "waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
- "severity": "Alto",
- "text": "Use o Site Recovery para replicar um servidor de aplicativos para um site de recuperação de desastre. O Site Recovery também pode ajudar a replicar VMs de cluster de serviços centrais para o site de recuperação de desastre. Ao invocar a DR, você precisará reconfigurar o cluster do Linux Pacemaker no site de DR (por exemplo, substituir o VIP ou SBD, executar corosync.conf e muito mais).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Usar o balanceamento de carga da camada de transporte",
+ "waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "Alto",
- "text": "Considere a disponibilidade do software SAP em relação a pontos únicos de falha. Isso inclui pontos únicos de falha em aplicativos, como SGBDs utilizados nas arquiteturas SAP NetWeaver e SAP S/4HANA, SAP AP e ASCS + SCS. Além disso, outras ferramentas, como o SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Configurar o roteamento com base no host ou no nome de domínio para vários aplicativos Web em um único gateway",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
- "severity": "Alto",
- "text": "Para bancos de dados SAP e SAP, considere implementar clusters de failover automáticos. No Windows, o Clustering de Failover do Windows Server dá suporte ao failover. No Linux, o Linux Pacemaker ou ferramentas de terceiros, como o SIOS Protection Suite e o Veritas InfoScale, oferecem suporte ao failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
+ "severity": "Média",
+ "text": "Centralize o gerenciamento de certificados SSL para reduzir a sobrecarga de criptografia e descriptografia de um farm de servidores de back-end",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
- "severity": "Alto",
- "text": "O Azure não dá suporte a arquiteturas nas quais as VMs primárias e secundárias compartilham armazenamento para dados do DBMS. Para a camada DBMS, o padrão de arquitetura comum é replicar bancos de dados ao mesmo tempo e com pilhas de armazenamento diferentes daquelas que as VMs primárias e secundárias usam.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
+ "severity": "Baixo",
+ "text": "Usar o Gateway de Aplicativo para obter suporte nativo para protocolos WebSocket e HTTP/2",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
- "severity": "Alto",
- "text": "Os dados do DBMS e os arquivos de log de transação/redo são armazenados no armazenamento em blocos com suporte do Azure ou no Azure NetApp Files. Não há suporte para Arquivos do Azure ou Arquivos Premium do Azure como armazenamento para dados do DBMS e/ou arquivos de log de restauração com carga de trabalho do SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
+ "severity": "Média",
+ "text": "Aproveite o servidor flexível",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"severity": "Alto",
- "text": "Você pode usar discos compartilhados do Azure no Windows para componentes ASCS + SCS e cenários específicos de alta disponibilidade. Configure seus clusters de failover separadamente para os componentes da camada de aplicativo SAP e a camada DBMS. Atualmente, o Azure não dá suporte a arquiteturas de alta disponibilidade que combinam componentes da camada de aplicativo SAP e a camada DBMS em um cluster de failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
- "severity": "Alto",
- "text": "A maioria dos clusters de failover para componentes da camada de aplicativo SAP (ASCS) e a camada DBMS exigem um endereço IP virtual para um cluster de failover. O Azure Load Balancer deve lidar com o endereço IP virtual para todos os outros casos. Um princípio de design é usar um balanceador de carga por configuração de cluster. Recomendamos que você use a versão padrão do balanceador de carga (SKU do Balanceador de Carga Padrão).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
+ "severity": "Média",
+ "text": "Aproveite a replicação de dados para cenários de DR entre regiões",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Certifique-se de que o IP flutuante esteja habilitado no balanceador de carga",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Antes de implantar sua infraestrutura de alta disponibilidade e dependendo da região escolhida, determine se deseja implantar com um conjunto de disponibilidade do Azure ou uma zona de disponibilidade.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Se você quiser atender aos SLAs de infraestrutura para seus aplicativos para componentes SAP (serviços centrais, servidores de aplicativos e bancos de dados), deverá escolher as mesmas opções de alta disponibilidade (VMs, conjuntos de disponibilidade, zonas de disponibilidade) para todos os componentes.",
+ "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"severity": "Alto",
- "text": "Não misture servidores de funções diferentes no mesmo conjunto de disponibilidade. Mantenha VMs de serviços centrais, VMs de banco de dados e VMs de aplicativos em seus próprios conjuntos de disponibilidade",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "Média",
- "text": "Você não pode implantar conjuntos de disponibilidade do Azure em uma zona de disponibilidade do Azure, a menos que use grupos de posicionamento por proximidade.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Fiabilidade"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Ao criar conjuntos de disponibilidade, use o número máximo de domínios de falha e atualize os domínios disponíveis. Por exemplo, se você implantar mais de duas VMs em um conjunto de disponibilidade, use o número máximo de domínios de falha (três) e domínios de atualização suficientes para limitar o efeito de possíveis falhas de hardware físico, interrupções de rede ou interrupções de energia, além da manutenção planejada do Azure. O número padrão de domínios de falha é dois e você não pode alterá-lo online posteriormente.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Fiabilidade"
+ "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "Alto",
- "text": "Quando você usa grupos de posicionamento por proximidade do Azure em uma implantação de conjunto de disponibilidade, todos os três componentes SAP (serviços centrais, servidor de aplicativos e banco de dados) devem estar no mesmo grupo de posicionamento por proximidade.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Aplicar as orientações do benchmark de segurança na nuvem da Microsoft relacionadas ao armazenamento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "O Armazenamento do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Use um grupo de posicionamento por proximidade por SID SAP. Os grupos não se estendem por Zonas de Disponibilidade ou regiões do Azure",
- "waf": "Fiabilidade"
+ "text": "Considere o uso de pontos de extremidade privados para o Armazenamento do Azure",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
- "severity": "Alto",
- "text": "Use um dos serviços a seguir para executar clusters de serviços centrais do SAP, dependendo do sistema operacional.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação ARM, para que o RBAC, a auditoria, etc., estejam todos habilitados. Verifique se não há contas de armazenamento antigas com modelo de implantação clássico em uma assinatura",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Verifique se as contas de armazenamento mais antigas não estão usando o 'modelo de implantação clássico'",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
- "severity": "Média",
- "text": "Atualmente, o Azure não dá suporte à combinação de ASCS e DB HA no mesmo cluster do Linux Pacemaker; separe-os em clusters individuais. No entanto, você pode combinar até cinco vários clusters de serviços centrais em um par de VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "O mecanismo soft-delete permite recuperar blobs excluídos acidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Implante ambas as VMs no par de alta disponibilidade em um conjunto de disponibilidade ou em zonas de disponibilidade. Essas VMs devem ter o mesmo tamanho e a mesma configuração de armazenamento.",
- "waf": "Fiabilidade"
+ "text": "Ativar 'exclusão suave' para blobs",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "O Azure dá suporte à instalação e configuração de instâncias do SAP HANA e ASCS/SCS e ERS no mesmo cluster de alta disponibilidade em execução no RHEL (Red Hat Enterprise Linux).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Fiabilidade"
+ "text": "Desativar 'exclusão suave' para blobs",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "A exclusão suave para contêineres permite que você recupere um contêiner depois que ele tenha sido excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Execute todos os sistemas de produção em SSDs gerenciados Premium e use o Azure NetApp Files ou o Armazenamento em Disco Ultra. Pelo menos o disco do sistema operacional deve estar na camada Premium para que você possa obter melhor desempenho e o melhor SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Fiabilidade"
+ "text": "Ativar 'exclusão suave' para contêineres",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
- "severity": "Alto",
- "text": "Você deve executar o SAP HANA no Azure somente nos tipos de armazenamento certificados pelo SAP. Observe que determinados volumes devem ser executados em determinadas configurações de disco, quando aplicável. Essas configurações incluem habilitar o Acelerador de Gravação e usar o armazenamento Premium. Você também precisa garantir que o sistema de arquivos executado no armazenamento seja compatível com o DBMS executado na máquina.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Desativar 'exclusão suave' para contêineres",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Evita a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Considere configurar a alta disponibilidade dependendo do tipo de armazenamento que você usa para suas cargas de trabalho SAP. Alguns serviços de armazenamento disponíveis no Azure não têm suporte no Azure Site Recovery, portanto, sua configuração de alta disponibilidade pode ser diferente.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Fiabilidade"
+ "text": "Habilitar bloqueios de recursos em contas de armazenamento",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Considere políticas de \"retenção legal\" ou \"retenção baseada em tempo\" para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Por favor, note que \"impossível\" significa na verdade \"impossível\"; uma vez que uma conta de armazenamento contém um blob imutável, a única maneira de 'se livrar' dessa conta de armazenamento é cancelando a assinatura do Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Diferentes serviços de armazenamento nativos do Azure (como Arquivos do Azure, Azure NetApp Files, Disco Compartilhado do Azure) podem não estar disponíveis em todas as regiões. Portanto, para ter uma configuração SAP semelhante na região de recuperação de desastre após o failover, verifique se o respectivo serviço de armazenamento é oferecido no site de recuperação de desastre.",
- "waf": "Fiabilidade"
+ "text": "Considere blobs imutáveis",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
- "severity": "Média",
- "text": "Automatize o sistema SAP Start-Stop para gerenciar custos.",
- "waf": "Custar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Exigir HTTPS, ou seja, desativar a porta 80 na conta de armazenamento",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Baixo",
- "text": "No caso de usar o Armazenamento Premium do Azure com o SAP HANA, o armazenamento SSD Standard do Azure pode ser usado para selecionar uma solução de armazenamento econômica. No entanto, observe que escolher o armazenamento SSD Standard ou HDD Standard do Azure afetará o SLA das VMs individuais. Além disso, para sistemas com menor taxa de transferência de E/S e baixa latência, como ambientes de não produção, as VMs de série inferior podem ser usadas.",
- "waf": "Custar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; em caso afirmativo, talvez seja necessário colocar a CDN do Azure na frente da sua conta de armazenamento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Ao impor HTTPS (desabilitando HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Como uma configuração alternativa de baixo custo (multiuso), você pode escolher um SKU de baixo desempenho para suas VMs de servidor de banco de dados HANA que não são de produção. No entanto, é importante observar que alguns tipos de VM, como a série E, não são certificados pelo HANA (Diretório de Hardware do SAP HANA) ou não podem atingir uma latência de armazenamento inferior a 1 ms.",
- "waf": "Custar"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) somente a conexões HTTPS",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Os tokens AAD devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Impor um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Usar tokens do Azure Active Directory (Azure AD) para acesso de blob",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que eles executem suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Impor a propagação da entidade de segurança para encaminhar a identidade do aplicativo de nuvem SAP para o SAP local (incluindo IaaS) por meio do conector de nuvem",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "Privilégio mínimo nas permissões do IaM",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
- "severity": "Média",
- "text": "Implemente SSO para aplicativos SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics e SAP C4C com Azure AD usando SAML.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Ao usar o SAS, prefira o SAS de delegação de usuário ao SAS baseado em chave de conta de armazenamento.",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
- "severity": "Média",
- "text": "Implemente o SSO para aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "As chaves de conta de armazenamento ('chaves compartilhadas') têm pouquíssimos recursos de auditoria. Embora possa ser monitorado em quem/quando foi obtida uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Depender exclusivamente da autenticação do AAD facilita a vinculação do acesso ao armazenamento a um usuário. ",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere desabilitar as chaves de conta de armazenamento, para que somente o acesso ao AAD (e a delegação de usuários SAS) seja suportado.",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Use os dados do Registro de atividades para identificar \"quando\", \"quem\", \"o que\" e \"como\" a segurança da sua conta de armazenamento está sendo visualizada ou alterada (ou seja, chaves de conta de armazenamento, políticas de acesso, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere usar o Azure Monitor para auditar as operações do plano de controle na conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete será exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Implemente o SSO para aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Uma diretiva de expiração SAS especifica um intervalo recomendado sobre o qual a SAS é válida. As políticas de expiração do SAS se aplicam a um SAS de serviço ou a um SAS de conta. Quando um usuário gera SAS de serviço ou SAS de conta com um intervalo de validade maior do que o intervalo recomendado, ele verá um aviso.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Você pode implementar o SSO no SAP GUI usando o SAP NetWeaver SSO ou uma solução de parceiro.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "Considere configurar uma política de expiração SAS",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "As políticas de acesso armazenado oferecem a opção de revogar permissões para uma SAS de serviço sem precisar gerar novamente as chaves da conta de armazenamento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos/SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido à sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "text": "Considere vincular o SAS a uma política de acesso armazenado",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos/SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido à sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.",
+ "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão com check-in e chaves de conta de armazenamento.",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
- "severity": "Média",
- "text": "Implemente o SSO usando o OAuth para SAP NetWeaver para permitir que aplicativos personalizados ou de terceiros acessem os serviços OData do SAP NetWeaver.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Idealmente, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave de conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere armazenar cadeias de conexão no Cofre de Chaves do Azure (em cenários em que identidades gerenciadas não são possíveis)",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
- "severity": "Média",
- "text": "Implementar SSO no SAP HANA",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Use tempos de expiração de curto prazo em um SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que um SAS seja comprometido, ele é válido apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenado. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Esforce-se por curtos períodos de validade para SAS ad-hoc",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Ao criar um SAS, seja o mais específico e restritivo possível. Prefira um SAS para um único recurso e operação em vez de um SAS que dá acesso muito mais amplo.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Considere o Azure AD um provedor de identidade para sistemas SAP hospedados no RISE. Para obter mais informações, consulte Integrando o serviço ao Azure AD.",
+ "text": "Aplicar um escopo restrito a uma SAS",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Uma SAS pode incluir parâmetros nos quais endereços IP de cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Para aplicativos que acessam o SAP, talvez você queira usar a propagação principal para estabelecer o SSO.",
+ "text": "Considere a definição do escopo do SAS para um endereço IP de cliente específico, sempre que possível",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
- "severity": "Média",
- "text": "Se você estiver usando serviços SAP BTP ou soluções SaaS que exigem o SAP Identity Authentication Service (IAS), considere implementar o SSO entre o SAP Cloud Identity Authentication Services e o Azure AD para acessar esses serviços SAP. Essa integração permite que o SAP IAS atue como um provedor de identidade proxy e encaminhe solicitações de autenticação para o Azure AD como o repositório central de usuários e o provedor de identidade.",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Um SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de precificação da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdo maliciosamente grande.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "Baixo",
+ "text": "Considere verificar os dados carregados, depois que os clientes usaram um SAS para carregar um arquivo. ",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
- "severity": "Média",
- "text": "Implementar SSO para SAP BTP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Ao acessar o armazenamento de blob via SFTP usando uma 'conta de usuário local', os controles RBAC 'normais' não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso a SFTP. Infelizmente, no início de 2023, os usuários locais são a única forma de gerenciamento de identidade que atualmente é suportada para o ponto de extremidade SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "SFTP: Limite a quantidade de 'usuários locais' para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "Média",
- "text": "Se você estiver usando o SAP SuccessFactors, considere usar o provisionamento automatizado de usuários do Azure AD. Com essa integração, à medida que você adiciona novos funcionários ao SAP SuccessFactors, você pode criar automaticamente suas contas de usuário no Azure AD. Opcionalmente, você pode criar contas de usuário no Microsoft 365 ou em outros aplicativos SaaS compatíveis com o Azure AD. Use o write-back do endereço de email para o SAP SuccessFactors.",
+ "text": "SFTP: O ponto de extremidade SFTP não oferece suporte a ACLs do tipo POSIX.",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "description": "Mantenha a hierarquia do grupo de gerenciamento razoavelmente plana, não mais do que quatro.",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
- "severity": "Média",
- "text": "impor políticas existentes do Grupo de Gerenciamento às Assinaturas SAP",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "Operações"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "O armazenamento oferece suporte a CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha o CorsRules com o menor privilégio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Integre aplicativos fortemente acoplados na mesma assinatura SAP para evitar complexidade adicional de roteamento e gerenciamento",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "Operações"
+ "text": "Evite políticas CORS excessivamente amplas",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode acontecer usando uma chave gerenciada por plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não depende do Armazenamento do Azure para garantias de confidencialidade.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Aproveite a assinatura como unidade de escala e dimensione nossos recursos, considere implantar a assinatura por ambiente, por exemplo. Caixa de areia, não-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "Operações"
+ "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Garantir o aumento da cota como parte do provisionamento da assinatura (por exemplo, total de núcleos de VM disponíveis em uma assinatura)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "Operações"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
- "severity": "Baixo",
- "text": "A API de Cota é uma API REST que você pode usar para exibir e gerenciar cotas para serviços do Azure. Considere usá-lo, se necessário.",
- "waf": "Operações"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"severity": "Alto",
- "text": "Se estiver implantando em uma zona de disponibilidade, verifique se a implantação da zona da VM está disponível depois que a cota for aprovada. Envie uma solicitação de suporte com a assinatura, a série de VMs, o número de CPUs e a zona de disponibilidade necessárias.",
- "waf": "Operações"
+ "text": "Considere se o acesso de blob público é necessário ou se pode ser desabilitado para determinadas contas de armazenamento. ",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
"severity": "Alto",
- "text": "Certifique-se de que os serviços e recursos necessários estejam disponíveis nas regiões de implantação escolhidas, por exemplo. ANF, Zona etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
- "waf": "Operações"
+ "text": "Aproveitar zonas de disponibilidade, se aplicável regionalmente (isso é habilitado automaticamente)",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "Média",
- "text": "Aproveite a marca de recurso do Azure para categorização de custos e agrupamento de recursos (: BillTo, Departamento (ou Unidade de Negócios), Ambiente (Produção, Estágio, Desenvolvimento), Camada (Camada da Web, Camada de Aplicativo), Proprietário do Aplicativo, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Operações"
+ "text": "Esteja ciente dos failovers iniciados pela Microsoft. Eles são exercidos pela Microsoft em raras situações para fazer failover de todos os hubs IoT de uma região afetada para a região geo-emparelhada correspondente.",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
"severity": "Alto",
- "text": "Ajude a proteger seu banco de dados HANA usando o serviço de Backup do Azure.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
- "severity": "Média",
- "text": "Se você implantar o Azure NetApp Files para seu banco de dados HANA, Oracle ou DB2, use a ferramenta AzAcSnap (Instantâneo Consistente com o Aplicativo do Azure) para tirar instantâneos consistentes com o aplicativo. O AzAcSnap também oferece suporte a bancos de dados Oracle. Considere usar o AzAcSnap em uma VM central em vez de em VMs individuais.",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "severity": "Alto",
+ "text": "Saiba como acionar um failover manual.",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
"severity": "Alto",
- "text": "Garanta correspondências de fuso horário entre o sistema operacional e o sistema SAP.",
- "waf": "Operações"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
- "severity": "Média",
- "text": "Não agrupe diferentes serviços de aplicativo no mesmo cluster. Por exemplo, não combine clusters DRBD e de serviços centrais no mesmo cluster. No entanto, você pode usar o mesmo cluster do Pacemaker para gerenciar aproximadamente cinco serviços centrais diferentes (cluster de vários SID).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "text": "Saiba como fazer failback após um failover.",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Considere executar sistemas de desenvolvimento/teste em um modelo de adiamento para economizar e otimizar os custos de execução do Azure.",
- "waf": "Custar"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
"severity": "Média",
- "text": "Se você fizer parceria com clientes gerenciando suas propriedades SAP, considere o Azure Lighthouse. O Azure Lighthouse permite que os provedores de serviços gerenciados usem serviços de identidade nativos do Azure para se autenticar no ambiente dos clientes. Ele coloca o controle nas mãos dos clientes, pois eles podem revogar o acesso a qualquer momento e auditar as ações dos prestadores de serviços.",
- "waf": "Operações"
+ "text": "Implante seus recursos de conectividade de zona de destino do Azure em várias regiões, para que você possa dar suporte rapidamente a zonas de destino de aplicativos de várias regiões e cenários de recuperação de desastre.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
"severity": "Média",
- "text": "Use o Azure Update Manager para verificar o status das atualizações disponíveis para uma única VM ou várias VMs e considere agendar patches regulares.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "text": "Use um locatário do Entra para gerenciar seus recursos do Azure, a menos que você tenha um requisito regulatório ou comercial claro para multilocatários.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
"severity": "Baixo",
- "text": "Otimize e gerencie as operações do SAP Basis usando o SAP Landscape Management (LaMa). Use o conector SAP LaMa para Azure para realocar, copiar, clonar e atualizar sistemas SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "text": "Use a abordagem de Automação Multilocatário para gerenciar seus locatários de ID do Microsoft Entra.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
- "severity": "Média",
- "text": "Use o Azure Monitor para soluções SAP para monitorar suas cargas de trabalho SAP (SAP HANA, clusters SUSE de alta disponibilidade e sistemas SQL) no Azure. Considere complementar o Azure Monitor para soluções SAP com o SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "Alto",
+ "text": "Use o Azure Lighthouse para gerenciamento de vários locatários com as mesmas IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"severity": "Alto",
- "text": "Execute uma extensão de VM para verificação SAP. A Extensão de VM para SAP usa a identidade gerenciada atribuída de uma VM (máquina virtual) para acessar dados de monitoramento e configuração de VM. A verificação garante que todas as métricas de desempenho em seu aplicativo SAP venham da Extensão do Azure para SAP subjacente.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "Operações"
+ "text": "Se você conceder a um parceiro acesso para administrar seu locatário, use o Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Custar"
},
{
- "checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
- "severity": "Média",
- "text": "Use o Azure Policy para controle de acesso e relatórios de conformidade. O Azure Policy fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a detecção rápida de violações. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operações"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "severity": "Alto",
+ "text": "Aplique um modelo RBAC que se alinhe ao seu modelo operacional de nuvem. Escopo e Atribuição entre Grupos de Gerenciamento e Assinaturas.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
"severity": "Média",
- "text": "Use o Monitor da Conexão no Observador de Rede do Azure para monitorar métricas de latência para bancos de dados SAP e servidores de aplicativos. Ou colete e exiba medidas de latência de rede usando o Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
- "waf": "Operações"
+ "text": "Use apenas o tipo de autenticação Conta corporativa ou de estudante para todos os tipos de conta. Evite usar a conta da Microsoft",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
"severity": "Média",
- "text": "Execute uma verificação de qualidade para o SAP HANA na infraestrutura provisionada do Azure para verificar se as VMs provisionadas estão em conformidade com as práticas recomendadas do SAP HANA no Azure.",
- "waf": "Operações"
+ "text": "Use apenas grupos para atribuir permissões. Adicione grupos locais ao grupo Somente ID do Entra se um sistema de gerenciamento de grupo já estiver em vigor.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"severity": "Alto",
- "text": "Para cada assinatura do Azure, execute um teste de latência nas zonas de disponibilidade do Azure antes da implantação zonal para escolher zonas de baixa latência para implantação do SAP no Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Desempenho"
+ "text": "Imponha políticas de Acesso Condicional da ID do Microsoft Entra para qualquer usuário com direitos a ambientes do Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
- "severity": "Média",
- "text": "Execute o Relatório de Resiliência para garantir que a configuração de toda a infraestrutura provisionada do Azure (Computação, Banco de Dados, Rede, Armazenamento, Site Recovery) esteja em conformidade com a configuração definida pelo Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Fiabilidade"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "Alto",
+ "text": "Imponha a autenticação multifator para qualquer usuário com direitos aos ambientes do Azure.",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
"severity": "Média",
- "text": "Implemente a proteção contra ameaças usando a solução do Microsoft Sentinel para SAP. Use essa solução para monitorar seus sistemas SAP e detectar ameaças sofisticadas em toda a lógica de negócios e nas camadas de aplicativos.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "text": "Imponha o Microsoft Entra ID Privileged Identity Management (PIM) para estabelecer acesso permanente zero e privilégios mínimos.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "Média",
- "text": "A marcação do Azure pode ser aproveitada para agrupar e rastrear recursos logicamente, automatizar suas implantações e, o mais importante, fornecer visibilidade sobre os custos incorridos.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
- "waf": "Operações"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Use o monitoramento de latência entre VMs para aplicativos sensíveis à latência.",
- "waf": "Desempenho"
+ "text": "Se estiver planejando alternar dos Serviços de Domínio Active Directory para os serviços de domínio Entra, avalie a compatibilidade de todas as cargas de trabalho.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "Média",
- "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastre para servidores de aplicativos SAP.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "text": "Ao usar o Microsoft Entra Domain Services, use conjuntos de réplicas. Os conjuntos de réplicas melhorarão a resiliência do domínio gerenciado e permitirão que você implante em regiões adicionais. ",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
"waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"severity": "Média",
- "text": "Exclua todos os sistemas de arquivos de banco de dados e programas executáveis das verificações antivírus. Incluí-los pode levar a problemas de desempenho. Verifique com os fornecedores de banco de dados os detalhes prescritivos na lista de exclusão. Por exemplo, a Oracle recomenda excluir /oracle//sapdata das verificações antivírus.",
- "waf": "Desempenho"
+ "text": "Integre os logs de ID do Microsoft Entra com o Azure Monitor central da plataforma. O Azure Monitor permite uma única fonte de verdade sobre dados de log e monitoramento no Azure, oferecendo às organizações opções nativas de nuvem para atender aos requisitos de coleta e retenção de logs.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Considere coletar estatísticas completas do banco de dados para bancos de dados não HANA após a migração. Por exemplo, implemente a nota 1020260 do SAP - Entrega de estatísticas do Oracle.",
- "waf": "Desempenho"
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "Alto",
+ "text": "Implemente um acesso de emergência ou contas de emergência para evitar o bloqueio de conta em todo o locatário. A MFA será ativada por padrão para todos os usuários em outubro de 2024. Recomendamos atualizar essas contas para usar a chave de acesso (FIDO2) ou configurar a autenticação baseada em certificado para MFA. ",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"severity": "Média",
- "text": "Considere usar o ASM (Gerenciamento Automático de Armazenamento) do Oracle para todas as implantações do Oracle que usam o SAP no Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Desempenho"
+ "text": "Não use contas sincronizadas locais para atribuições de função de ID do Microsoft Entra, a menos que você tenha um cenário que exija isso especificamente.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
+ "severity": "Média",
+ "text": "Ao usar o Proxy de Aplicativo de ID do Microsoft Entra para fornecer acesso de usuários remotos a aplicativos, gerencie-o como um recurso da plataforma, pois você só pode ter uma instância por locatário.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"severity": "Média",
- "text": "Para SAP no Azure executando Oracle, uma coleção de scripts SQL pode ajudá-lo a diagnosticar problemas de desempenho. Os relatórios do Automatic Workload Repository (AWR) contêm informações valiosas para diagnosticar problemas no sistema Oracle. Recomendamos que você execute um relatório AWR durante várias sessões e escolha horários de pico para ele, para garantir uma ampla cobertura para a análise.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Desempenho"
+ "text": "Use uma topologia de rede hub-and-spoke para cenários de rede que exigem flexibilidade máxima.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"severity": "Alto",
- "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastre para servidores de aplicativos SAP.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "Operações"
+ "text": "Implante serviços de rede compartilhados, incluindo gateways do ExpressRoute, gateways de VPN e Firewall do Azure ou NVAs de parceiros na rede virtual do hub central. Se necessário, implante também serviços DNS.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Custar"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
"link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
- "severity": "Média",
- "text": "Para entrega segura de aplicativos HTTP/S, use o Gateway de Aplicativo v2 e verifique se a proteção e as políticas do WAF estão habilitadas.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Use um plano de proteção de IP ou rede DDoS para todos os endereços IP públicos nas zonas de destino do aplicativo.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"severity": "Média",
- "text": "Se o DNS ou o nome virtual da máquina virtual não for alterado durante a migração para o Azure, o DNS em segundo plano e os nomes virtuais conectarão muitas interfaces do sistema no cenário SAP, e os clientes só às vezes estarão cientes das interfaces que os desenvolvedores definem ao longo do tempo. Surgem desafios de conexão entre vários sistemas quando os nomes virtuais ou DNS são alterados após as migrações, e é recomendável manter os aliases DNS para evitar esses tipos de dificuldades.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operações"
+ "text": "Ao implantar tecnologias de rede de parceiros ou NVAs, siga as diretrizes do fornecedor do parceiro.",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
- "severity": "Média",
- "text": "Use diferentes zonas DNS para distinguir cada ambiente (sandbox, desenvolvimento, pré-produção e produção) uns dos outros. A exceção é para implantações SAP com sua própria VNet; aqui, as zonas DNS privadas podem não ser necessárias.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operações"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "Baixo",
+ "text": "Se você precisar de trânsito entre o ExpressRoute e os gateways de VPN em cenários hub e spoke, use o Servidor de Rota do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "description": "Ao configurar o emparelhamento VNet, use a configuração Permitir tráfego para redes virtuais remotas.",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
- "severity": "Média",
- "text": "O emparelhamento VNet local e global fornece conectividade e é a abordagem preferencial para garantir a conectividade entre zonas de destino para implantações SAP em várias regiões do Azure",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "Baixo",
+ "text": "Se estiver usando o Servidor de Roteamento, use um prefixo /27 para a sub-rede do Servidor de Roteamento.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "Alto",
- "text": "Não há suporte para implantar qualquer NVA entre o aplicativo SAP e o servidor de banco de dados SAP",
- "training": "https://me.sap.com/notes/2731110",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
+ "severity": "Média",
+ "text": "Para arquiteturas de rede com várias topologias hub-and-spoke em regiões do Azure, use emparelhamentos de rede virtual global entre as VNets do hub para conectar as regiões entre si.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
"waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"severity": "Média",
- "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais em que você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "text": "Use o Azure Monitor para Redes para monitorar o estado de ponta a ponta das redes no Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "Média",
- "text": "Considere implantar NVAs (soluções de virtualização de rede) entre regiões somente se NVAs de parceiros forem usadas. NVAs entre regiões ou VNets não serão necessárias se NVAs nativas estiverem presentes. Ao implantar tecnologias de rede de parceiros e NVAs, siga as diretrizes do fornecedor para verificar configurações conflitantes com a rede do Azure.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operações"
+ "text": "Se você tiver mais de 400 redes spoke em uma região, implante um hub adicional para ignorar os limites de emparelhamento VNet (500) e o número máximo de prefixos que podem ser anunciados por meio do ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "Média",
- "text": "A WAN Virtual gerencia a conectividade entre VNets spoke para topologias baseadas em WAN virtual (não é necessário configurar UDR [roteamento definido pelo usuário] ou NVAs) e a taxa de transferência máxima de rede para tráfego de VNet para VNet no mesmo hub virtual é de 50 gigabits por segundo. Se necessário, as zonas de destino do SAP podem usar o emparelhamento VNet para se conectar a outras zonas de destino e superar essa limitação de largura de banda.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operações"
+ "text": "Limite o número de rotas por tabela de rotas a 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
"severity": "Alto",
- "text": "A atribuição de IP público à VM que executa a carga de trabalho SAP não é recomendada.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Segurança"
+ "text": "Use a configuração 'Permitir tráfego para rede virtual remota' ao configurar emparelhamentos VNet.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"severity": "Alto",
- "text": "Considere reservar o endereço IP no lado da recuperação de desastre ao configurar o ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operações"
+ "text": "Use o SKU do Standard Load Balancer com uma implantação com redundância de zona, a seleção do SKU Standard Load Balancer aumenta a confiabilidade por meio de zonas de disponibilidade e resiliência de zona, garantindo que as implantações resistam a falhas de zona e região. Ao contrário do Basic, ele oferece suporte ao balanceamento de carga global e oferece um SLA.",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
"severity": "Alto",
- "text": "Evite usar intervalos de endereços IP sobrepostos para sites de produção e DR.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Operações"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
- "severity": "Média",
- "text": "Embora o Azure ajude você a criar várias sub-redes delegadas em uma VNet, apenas uma sub-rede delegada pode existir em uma VNet para Azure NetApp Files. As tentativas de criar um novo volume falharão se você usar mais de uma sub-rede delegada para o Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "Operações"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
- "severity": "Média",
- "text": "Usar o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "Segurança"
+ "text": "Verifique se os pools de back-end do balanceador de carga contêm pelo menos duas instâncias, a implantação de Azure Load Balancers com pelo menos duas instâncias no back-end evita um único ponto de falha e dá suporte à escalabilidade.",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "O Gateway de Aplicativo e o Firewall de Aplicativo Web têm limitações quando o Gateway de Aplicativo serve como um proxy reverso para aplicativos Web SAP, conforme mostrado na comparação entre o Gateway de Aplicativo, o SAP Web Dispatcher e outros serviços de terceiros.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "text": "Quando você estiver usando o ExpressRoute Direct, configure o MACsec para criptografar o tráfego no nível da camada dois entre os roteadores da organização e o MSEE. O diagrama mostra essa criptografia no fluxo.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre regiões do Azure para conexões HTTP/S de entrada para uma zona de destino.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "text": "Para cenários em que o MACsec não é uma opção (por exemplo, não usando o ExpressRoute Direct), use um gateway de VPN para estabelecer túneis IPsec no emparelhamento privado do ExpressRoute.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
- "severity": "Média",
- "text": "Aproveite as políticas de Firewall de Aplicativo Web no Azure Front Door quando estiver usando o Azure Front Door e o Gateway de Aplicativo para proteger aplicativos HTTP/S. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "Alto",
+ "text": "Verifique se nenhum espaço de endereço IP sobreposto entre regiões do Azure e locais é usado.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "Média",
- "text": "Use um firewall de aplicativo Web para verificar seu tráfego quando ele for exposto à Internet. Outra opção é usá-lo com o balanceador de carga ou com recursos que tenham recursos de firewall internos, como Gateway de Aplicativo ou soluções de terceiros.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "text": "Use endereços IP dos intervalos de alocação de endereços para Internets privadas (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
- "severity": "Média",
- "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais em que você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Certifique-se de que o espaço de endereço IP não seja desperdiçado, não crie redes virtuais desnecessariamente grandes (por exemplo, /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
- "severity": "Média",
- "text": "Para evitar o vazamento de dados, use o Link Privado do Azure para acessar com segurança os recursos da plataforma como serviço, como Armazenamento de Blobs do Azure, Arquivos do Azure, Azure Data Lake Storage Gen2, Azure Data Factory e muito mais. O Ponto de Extremidade Privado do Azure também pode ajudar a proteger o tráfego entre VNets e serviços como Armazenamento do Azure, Backup do Azure e muito mais. O tráfego entre sua VNet e o serviço habilitado para Ponto de Extremidade Privado viaja pela rede global da Microsoft, o que impede sua exposição à Internet pública.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Não use intervalos de endereços IP sobrepostos para sites de produção e recuperação de desastres.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
"severity": "Alto",
- "text": "Verifique se a rede acelerada do Azure está habilitada nas VMs usadas no aplicativo SAP e nas camadas do DBMS.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Desempenho"
+ "text": "Use SKU Standard e IPs com redundância de zona quando aplicável, os endereços IP públicos no Azure podem ser de SKU padrão, disponíveis como não zonal, zonal ou com redundância de zona. Os IPs com redundância de zona podem ser acessados em todas as zonas, resistindo a qualquer falha de zona única, fornecendo assim maior resiliência. ",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"severity": "Média",
- "text": "Verifique se as implantações internas do Azure Load Balancer estão configuradas para usar o DSR (Retorno Direto do Servidor). Essa configuração (Habilitando IP Flutuante) reduzirá a latência quando as configurações do balanceador de carga interno forem usadas para configurações de alta disponibilidade na camada DBMS.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Segurança"
+ "text": "Para ambientes em que a resolução de nomes no Azure é tudo o que é necessário, use o DNS Privado do Azure para resolução com uma zona delegada para resolução de nomes (como 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
"severity": "Média",
- "text": "Você pode usar o ASG (grupo de segurança do aplicativo) e as regras do NSG para definir listas de controle de acesso de segurança de rede entre o aplicativo SAP e as camadas do DBMS. Os ASGs agrupam máquinas virtuais para ajudar a gerenciar sua segurança.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "text": "Para ambientes em que a resolução de nomes no Azure e no local é necessária e não há nenhum serviço DNS corporativo existente, como o Active Directory, use o Resolvedor Privado de DNS do Azure para rotear solicitações de DNS para o Azure ou para servidores DNS locais.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "Alto",
- "text": "Não há suporte para a colocação da camada de aplicativo SAP e do DBMS SAP em diferentes VNets do Azure que não estão emparelhadas.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Desempenho"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
- "severity": "Média",
- "text": "Para obter a latência de rede ideal com aplicativos SAP, considere usar grupos de posicionamento por proximidade do Azure.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "Baixo",
+ "text": "Cargas de trabalho especiais que exigem e implantam seu próprio DNS (como o Red Hat OpenShift) devem usar sua solução de DNS preferida.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
"severity": "Alto",
- "text": "NÃO há suporte para executar uma camada do Servidor de Aplicativos SAP e uma camada do DBMS dividida entre o local e o Azure. Ambas as camadas precisam residir completamente no local ou no Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Desempenho"
+ "text": "Habilite o registro automático para o DNS do Azure para gerenciar automaticamente o ciclo de vida dos registros DNS para as máquinas virtuais implantadas em uma rede virtual.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
- "severity": "Alto",
- "text": "Não é recomendável hospedar o DBMS (sistema de gerenciamento de banco de dados) e as camadas de aplicativo de sistemas SAP em VNets diferentes e conectá-los ao emparelhamento VNet devido aos custos substanciais que o tráfego de rede excessivo entre as camadas pode produzir. Recomendamos o uso de sub-redes na rede virtual do Azure para separar a camada de aplicativo SAP e a camada de DBMS.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Custar"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
+ "severity": "Média",
+ "text": "Implementar um plano para gerenciar a resolução de DNS entre várias regiões do Azure e quando os serviços fazem failover para outra região",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
- "severity": "Alto",
- "text": "Se estiver usando o Load Balancer com sistemas operacionais convidados Linux, verifique se o parâmetro de rede Linux net.ipv4.tcp_timestamps está definido como 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Desempenho"
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "Média",
+ "text": "Use o Azure Bastion para se conectar com segurança à sua rede.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
"severity": "Média",
- "text": "Para implantações do SAP RISE/ECS, o emparelhamento virtual é a maneira preferencial de estabelecer conectividade com o ambiente existente do Azure do cliente. Tanto a rede virtual SAP quanto a(s) rede virtual(is) do cliente são protegidas com NSG (grupos de segurança de rede), permitindo a comunicação nas portas SAP e de banco de dados por meio do emparelhamento de rede virtual",
+ "text": "Use o Azure Bastion em uma sub-rede /26 ou maior.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
- "severity": "Alto",
- "text": "Examine os backups de banco de dados do SAP HANA para VMs do Azure.",
- "waf": "Custar"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "Média",
+ "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre regiões do Azure para conexões HTTP/S de entrada para uma zona de destino.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "severity": "Média",
- "text": "Examine o monitoramento interno do Site Recovery, quando usado para SAP.",
- "waf": "Custar"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "Baixo",
+ "text": "Ao usar o Azure Front Door e o Gateway de Aplicativo do Azure para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Azure Front Door. Bloqueie o Gateway de Aplicativo do Azure para receber tráfego somente do Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"severity": "Alto",
- "text": "Revise as diretrizes Monitorando o cenário do sistema SAP HANA.",
- "waf": "Operações"
+ "text": "Quando WAFs e outros proxies reversos forem necessários para conexões HTTP/S de entrada, implante-os em uma rede virtual de zona de destino e junto com os aplicativos que eles estão protegendo e expondo à Internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
- "severity": "Média",
- "text": "Examine o Oracle Database nas estratégias de backup de VM Linux do Azure.",
- "waf": "Operações"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Use os planos de Rede ou Proteção de IP do Azure contra DDoS para ajudar a proteger os pontos de extremidade de endereços IP públicos nas redes virtuais.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
- "severity": "Média",
- "text": "Examine o uso do Armazenamento de Blobs do Azure com o SQL Server 2016.",
- "waf": "Operações"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Planeje como gerenciar a configuração e a estratégia de tráfego de saída da rede antes da próxima alteração significativa. Em 30 de setembro de 2025, o acesso de saída padrão para novas implantações será desativado e somente configurações de acesso explícito serão permitidas.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
- "severity": "Média",
- "text": "Examine o uso do Backup Automatizado v2 para VMs do Azure.",
- "waf": "Operações"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "Alto",
+ "text": "Adicione configurações de diagnóstico para salvar logs relacionados a DDoS para todos os endereços IP públicos protegidos (IP DDoS ou Proteção de Rede).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
"severity": "Alto",
- "text": "Habilitando o acelerador de gravação para a série M ao usar discos premium (V1)",
- "waf": "Operações"
+ "text": "Verifique se há uma atribuição de política para negar endereços IP públicos diretamente vinculados a máquinas virtuais. Use exclusões se IPs públicos forem necessários em VMs específicas.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Teste a latência da zona de disponibilidade.",
+ "text": "Use o ExpressRoute como a conexão principal com o Azure. Use VPNs como fonte de conectividade de backup.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Você pode usar o prefixo AS-path e pesos de conexão para influenciar o tráfego do Azure para o local e toda a gama de atributos BGP em seus próprios roteadores para influenciar o tráfego do local para o Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Ative o SAP EarlyWatch Alert para todos os componentes SAP.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Desempenho"
+ "text": "Ao usar vários circuitos do ExpressRoute ou vários locais locais, use atributos BGP para otimizar o roteamento.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Revise a latência do servidor de aplicativos SAP para o servidor de banco de dados usando o relatório SAP ABAPMeter /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
+ "text": "Selecione o SKU correto para os gateways ExpressRoute/VPN com base nos requisitos de largura de banda e desempenho.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
- "severity": "Média",
- "text": "Revise o monitoramento de desempenho do SQL Server usando o CCMS.",
- "waf": "Desempenho"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
+ "severity": "Alto",
+ "text": "Verifique se você está usando circuitos do ExpressRoute de dados ilimitados somente se atingir a largura de banda que justifica seu custo.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Custar"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
- "severity": "Média",
- "text": "Teste a latência de rede entre VMs da camada de aplicativo SAP e VMs do DBMS (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "Desempenho"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "Alto",
+ "text": "Aproveite o SKU local do ExpressRoute para reduzir o custo de seus circuitos, se o local de emparelhamento de circuito der suporte às regiões do Azure para o SKU Local.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Custar"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Revise os alertas do SAP HANA Studio.",
- "waf": "Desempenho"
+ "text": "Implante um gateway do ExpressRoute com redundância de zona nas regiões do Azure com suporte.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Execute verificações de integridade do SAP HANA usando HANA_Configuration_Minichecks.",
+ "text": "Para cenários que exigem largura de banda superior a 10 Gbps ou portas dedicadas de 10/100 Gbps, use o ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Se você executar VMs do Windows e do Linux no Azure, localmente ou em outros ambientes de nuvem, poderá usar o Centro de gerenciamento de atualizações na Automação do Azure para gerenciar atualizações do sistema operacional, incluindo patches de segurança.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "waf": "Segurança"
+ "text": "Quando a baixa latência for necessária ou a taxa de transferência do local para o Azure precisar ser maior que 10 Gbps, habilite o FastPath para ignorar o gateway do ExpressRoute do caminho de dados.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"severity": "Média",
- "text": "Revise rotineiramente as notas de OSS de segurança do SAP porque o SAP lança patches de segurança altamente críticos, ou hot fixes, que exigem ação imediata para proteger seus sistemas SAP.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "Segurança"
+ "text": "Use gateways de VPN com redundância de zona para conectar branches ou locais remotos ao Azure (quando disponível).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Para SAP no SQL Server, você pode desabilitar a conta de administrador do sistema do SQL Server porque os sistemas SAP no SQL Server não usam a conta. Certifique-se de que outro usuário com direitos de administrador do sistema possa acessar o servidor antes de desabilitar a conta original de administrador do sistema.",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
+ "severity": "Média",
+ "text": "Use dispositivos VPN redundantes locais (ativo/ativo ou ativo/passivo).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
"severity": "Alto",
- "text": "Desative xp_cmdshell. O recurso SQL Server xp_cmdshell habilita um shell de comando do sistema operacional interno do SQL Server. É um risco potencial em auditorias de segurança.",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "Segurança"
+ "text": "Se estiver usando o ExpressRoute Direct, considere usar circuitos locais do ExpressRoute para as regiões locais do Azure para economizar custos.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Custar"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Alto",
- "text": "A criptografia de servidores de banco de dados SAP HANA no Azure usa a tecnologia de criptografia nativa do SAP HANA. Além disso, se você estiver usando o SQL Server no Azure, use a TDE (Transparent Data Encryption) para proteger seus dados e arquivos de log e garantir que seus backups também sejam criptografados.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "Média",
+ "text": "Quando o isolamento de tráfego ou a largura de banda dedicada for necessária, como para separar ambientes de produção e não produção, use circuitos diferentes do ExpressRoute. Ele ajudará você a garantir domínios de roteamento isolados e aliviar os riscos de vizinhos barulhentos.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "A criptografia do Armazenamento do Azure está habilitada para todas as contas de armazenamento clássicas e do Azure Resource Manager e não pode ser desabilitada. Como seus dados são criptografados por padrão, você não precisa modificar seu código ou aplicativos para usar a criptografia do Armazenamento do Azure.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
- "waf": "Segurança"
+ "text": "Monitore a disponibilidade e a utilização do ExpressRoute usando o Express Route Insights interno.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
- "severity": "Alto",
- "text": "Usar o Azure Key Vault para armazenar seus segredos e credenciais",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "severity": "Média",
+ "text": "Use o Monitor da Conexão para monitoramento de conectividade em toda a rede, especialmente entre o local e o Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "É recomendável BLOQUEAR os Recursos do Azure após a implantação bem-sucedida para proteger contra alterações não autorizadas. Você também pode impor restrições e regras de LOCK por assinatura usando políticas personalizadas do Azure (função personalizada).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "Segurança"
+ "text": "Use circuitos do ExpressRoute de diferentes locais de emparelhamento para redundância.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Provisione o Azure Key Vault com as políticas de exclusão reversível e limpeza habilitadas para permitir a proteção de retenção para objetos excluídos.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Segurança"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
- "severity": "Alto",
- "text": "Com base nos requisitos existentes, controles regulatórios e de conformidade (internos/externos) – determine quais políticas do Azure e a função RBAC do Azure são necessárias",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
- "waf": "Segurança"
+ "text": "Use a VPN site a site como failover do ExpressRoute, se estiver usando apenas um único circuito do ExpressRoute.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
"severity": "Alto",
- "text": "Ao habilitar o Microsoft Defender para Ponto de Extremidade no ambiente SAP, recomendamos excluir dados e arquivos de log em servidores DBMS em vez de direcionar todos os servidores. Siga as recomendações do fornecedor do DBMS ao excluir arquivos de destino.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
- "waf": "Segurança"
+ "text": "Se você estiver usando uma tabela de rotas no GatewaySubnet, certifique-se de que as rotas de gateway sejam propagadas.",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
"severity": "Alto",
- "text": "Delegue uma função personalizada de administrador do SAP com acesso just-in-time do Microsoft Defender para Nuvem.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "waf": "Segurança"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Baixo",
- "text": "criptografar dados em trânsito integrando o produto de segurança de terceiros com comunicações de rede seguras (SNC) para DIAG (SAP GUI), RFC e SPNEGO para HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
- "waf": "Segurança"
+ "text": "Se estiver usando o ExpressRoute, o roteamento local deverá ser dinâmico: no caso de uma falha de conexão, ele deverá convergir para a conexão restante do circuito. A carga deve ser compartilhada entre ambas as conexões, idealmente como ativa/ativa, embora ativa/passiva também seja suportada.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Padrão para chaves gerenciadas pela Microsoft para funcionalidade de criptografia principal e use chaves gerenciadas pelo cliente quando necessário.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Segurança"
- },
- {
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
- "severity": "Alto",
- "text": "Use um Azure Key Vault por aplicativo por ambiente por região.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "Segurança"
+ "text": "Verifique se os dois links físicos do circuito do ExpressRoute estão conectados a dois dispositivos de borda distintos em sua rede.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "severity": "Alto",
- "text": "Para controlar e gerenciar chaves e segredos de criptografia de disco para sistemas operacionais Windows e Windows não HANA, use o Azure Key Vault. Não há suporte para o SAP HANA com o Azure Key Vault, portanto, você deve usar métodos alternativos, como chaves SAP ABAP ou SSH.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "severity": "Média",
+ "text": "Certifique-se de que a Detecção de Encaminhamento Bidirecional (BFD) esteja habilitada e configurada em dispositivos de roteamento de borda do cliente ou provedor.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
"severity": "Alto",
- "text": "Personalizar funções RBAC (controle de acesso baseado em função) para assinaturas SAP on Azure spoke para evitar alterações acidentais relacionadas à rede",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
- "waf": "Segurança"
+ "text": "Conecte o Gateway do ExpressRoute a dois ou mais circuitos de diferentes locais de emparelhamento para maior resiliência.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Fiabilidade"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
- "severity": "Alto",
- "text": "Isole DMZs e NVAs do restante da propriedade SAP, configure o Link Privado do Azure e gerencie e controle com segurança os recursos do SAP no Azure",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "Média",
+ "text": "Configure logs de diagnóstico e alertas para o gateway de rede virtual do ExpressRoute.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operações"
},
{
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Considere usar o software antimalware da Microsoft no Azure para proteger suas máquinas virtuais contra arquivos mal-intencionados, adware e outras ameaças.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "severity": "Média",
+ "text": "Não use circuitos do ExpressRoute para comunicação VNet para VNet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
"severity": "Baixo",
- "text": "Para obter uma proteção ainda mais poderosa, considere usar Microsoft Defender para Ponto de Extremidade.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
- "waf": "Segurança"
+ "text": "Não envie o tráfego do Azure para locais híbridos para inspeção. Em vez disso, siga o princípio \"o tráfego no Azure permanece no Azure\" para que a comunicação entre os recursos no Azure ocorra por meio da rede de backbone da Microsoft.",
+ "waf": "Desempenho"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Isole o aplicativo SAP e os servidores de banco de dados da Internet ou da rede local passando todo o tráfego pela rede virtual do hub, que está conectada à rede spoke por emparelhamento de rede virtual. As redes virtuais emparelhadas garantem que a solução SAP no Azure seja isolada da Internet pública.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
- "waf": "Segurança"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "Baixo",
- "text": "Para aplicativos voltados para a Internet, como o SAP Fiori, certifique-se de distribuir a carga por requisitos do aplicativo, mantendo os níveis de segurança. Para segurança de Camada 7, você pode usar um WAF (Firewall de Aplicativo Web) de terceiros disponível no Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "text": "Use o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "Média",
- "text": "Para habilitar a comunicação segura no Azure Monitor para soluções SAP, você pode optar por usar um certificado raiz ou um certificado de servidor. É altamente recomendável que você use certificados raiz.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Crie uma política global de Firewall do Azure para controlar a postura de segurança em todo o ambiente de rede global e atribua-a a todas as instâncias do Firewall do Azure. Permita que políticas granulares atendam aos requisitos de regiões específicas delegando políticas de firewall incrementais às equipes de segurança locais por meio do controle de acesso baseado em função do Azure.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "O Barramento de Serviço Premium do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
"severity": "Baixo",
- "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "A comunicação entre um aplicativo cliente e um namespace do Barramento de Serviço do Azure é criptografada usando TLS (Transport Layer Security). Os namespaces do Barramento de Serviço do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace do Barramento de Serviço para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
- "severity": "Média",
- "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "Configure provedores de segurança SaaS de parceiros compatíveis no Firewall Manager se a organização quiser usar essas soluções para ajudar a proteger as conexões de saída.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Quando você cria um namespace do Barramento de Serviço, uma regra SAS chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. É recomendável usar o AAD como um provedor de autenticação com RBAC. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
- "severity": "Média",
- "text": "Evite usar a conta root quando não for necessário",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "severity": "Alto",
+ "text": "Use regras de aplicativo para filtrar o tráfego de saída no nome do host de destino para protocolos com suporte. Use regras de rede baseadas em FQDN e Firewall do Azure com proxy DNS para filtrar o tráfego de saída para a Internet em outros protocolos.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Um aplicativo cliente do Barramento de Serviço em execução dentro de um aplicativo do Serviço de Aplicativo do Azure ou em uma máquina virtual com entidades gerenciadas habilitadas para suporte a recursos do Azure não precisa lidar com regras e chaves SAS ou quaisquer outros tokens de acesso. O aplicativo cliente só precisa do endereço do ponto de extremidade do namespace do Sistema de Mensagens do Barramento de Serviço. ",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
- "severity": "Média",
- "text": "Quando possível, seu aplicativo deve usar uma identidade gerenciada para se autenticar no Barramento de Serviço do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial de entidade de serviço) no Azure Key Vault ou em um serviço equivalente",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "severity": "Alto",
+ "text": "Use o Firewall do Azure Premium para habilitar recursos de segurança adicionais.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Barramento de Serviço do Azure. As permissões no Barramento de Serviço do Azure podem e devem ter como escopo o nível de recurso individual, por exemplo, fila, tópico ou assinatura. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Usar o RBAC do plano de dados com privilégios mínimos",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Configure o modo de Inteligência contra Ameaças do Firewall do Azure como Alerta e Negação para proteção adicional.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Os logs de recursos do Barramento de Serviço do Azure incluem logs operacionais, logs de rede virtual e filtragem de IP. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para várias operações de acesso ao plano de dados (como enviar ou receber mensagens) no Barramento de Serviço.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
- "severity": "Média",
- "text": "Habilite o registro em log para investigação de segurança. Usar o Azure Monitor para rastrear logs de recursos e logs de auditoria de runtime (atualmente disponível apenas na camada premium)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "Alto",
+ "text": "Configure o modo IDPS do Firewall do Azure como Negar para proteção adicional.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Por padrão, o Barramento de Serviço do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Barramento de Serviço do Azure atravesse a rede de backbone da Microsoft. Além disso, você deve desabilitar os endpoints públicos se eles não forem usados. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
- "severity": "Média",
- "text": "Considere usar pontos de extremidade privados para acessar o Barramento de Serviço do Azure e desabilitar o acesso à rede pública quando aplicável.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "Alto",
+ "text": "Para sub-redes em VNets não conectadas à WAN Virtual, anexe uma tabela de rotas para que o tráfego da Internet seja redirecionado para o Firewall do Azure ou uma Solução de Virtualização de Rede.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Com o firewall IP, você pode restringir ainda mais o endpoint público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Classless Inter-Domain Routing). ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
"severity": "Média",
- "text": "Considere permitir apenas o acesso ao namespace do Barramento de Serviço do Azure de endereços IP ou intervalos específicos",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Segurança"
+ "text": "Adicione configurações de diagnóstico para salvar logs, usando a tabela de destino Específico do Recurso, para todas as implantações do Firewall do Azure.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aplicar as diretrizes do parâmetro de comparação de segurança de nuvem da Microsoft relacionado ao armazenamento",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
- "severity": "Média",
- "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "severity": "Alto",
+ "text": "Migre das regras clássicas do Firewall do Azure (se houver) para a Política de Firewall.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Por padrão, o Armazenamento do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Considere usar pontos de extremidade privados para o Armazenamento do Azure",
+ "text": "Use um prefixo /26 para suas sub-redes do Firewall do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação do ARM, para que o RBAC, a auditoria etc. estejam habilitados. Verifique se não há contas de armazenamento antigas com o modelo de implantação clássico em uma assinatura",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
"severity": "Média",
- "text": "Verifique se as contas de armazenamento mais antigas não estão usando o \"modelo de implantação clássico\"",
- "waf": "Segurança"
+ "text": "Organize as regras dentro da política de firewall em Grupos de Coleção de Regras e Coleções de Regras e com base em sua frequência de uso.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "Média",
+ "text": "Use grupos de IP ou prefixos de IP para reduzir o número de regras de tabela de IP.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "O mecanismo de exclusão reversível permite recuperar blobs excluídos acidentalmente.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
"severity": "Média",
- "text": "Habilitar 'exclusão reversível' para blobs",
- "waf": "Segurança"
+ "text": "Não use curingas como um IP de origem para DNATS, como * ou any, você deve especificar IPs de origem para DNATs de entrada.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
"severity": "Média",
- "text": "Desabilitar a 'exclusão reversível' para blobs",
- "waf": "Segurança"
+ "text": "Evite o esgotamento da porta SNAT monitorando o uso da porta SNAT, avaliando as configurações do NAT Gateway e garantindo um failover contínuo. Se a contagem de portas se aproximar do limite, é um sinal de que o esgotamento do SNAT pode ser iminente.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "A exclusão reversível para contêineres permite que você recupere um contêiner depois que ele foi excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Habilitar 'exclusão reversível' para contêineres",
- "waf": "Segurança"
+ "text": "Se você estiver usando o Firewall do Azure Premium, habilite a Inspeção TLS.",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "Baixo",
+ "text": "Use categorias da Web para permitir ou negar o acesso de saída a tópicos específicos.",
+ "waf": "Desempenho"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
"severity": "Média",
- "text": "Desabilitar a 'exclusão reversível' para contêineres",
+ "text": "Como parte da inspeção TLS, planeje o recebimento de tráfego dos Gateways de Aplicativo do Azure para inspeção.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Desempenho"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "Média",
+ "text": "Habilite a configuração de proxy DNS do Firewall do Azure.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Impede a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Habilitar bloqueios de recursos em contas de armazenamento",
- "waf": "Segurança"
+ "text": "Integre o Firewall do Azure ao Azure Monitor e habilite o log de diagnóstico para armazenar e analisar logs e métricas de firewall.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operações"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "Baixo",
+ "text": "Implementar backups para suas regras de firewall",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere as políticas de 'retenção legal' ou 'retenção baseada em tempo' para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Observe que 'impossível' na verdade significa 'impossível'; depois que uma conta de armazenamento contém um blob imutável, a única maneira de \"se livrar\" dessa conta de armazenamento é cancelando a assinatura do Azure.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Considere blobs imutáveis",
- "waf": "Segurança"
+ "text": "Implante o Firewall do Azure em várias zonas de disponibilidade. O Firewall do Azure oferece SLAs diferentes, dependendo de sua implantação; em uma única zona de disponibilidade ou em várias, melhorando potencialmente a confiabilidade e o desempenho.",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "Alto",
- "text": "Exigir HTTPS, ou seja, desabilitar a porta 80 na conta de armazenamento",
- "waf": "Segurança"
+ "text": "Configure a Proteção contra DDoS na VNet do Firewall do Azure, associe um plano de proteção contra DDoS à rede virtual que hospeda o Firewall do Azure para fornecer mitigação aprimorada contra ataques de DDoS. O Gerenciador de Firewall do Azure integra a criação de infraestrutura de firewall e planos de proteção contra DDoS. ",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; nesse caso, talvez seja necessário colocar a CDN do Azure na frente de sua conta de armazenamento.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
"severity": "Alto",
- "text": "Ao impor HTTPS (desabilitando o HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "text": "Não interrompa a comunicação do painel de controle para serviços de PaaS do Azure injetados em redes virtuais, como com uma rota 0.0.0.0/0 ou uma regra NSG que bloqueia o tráfego do painel de controle.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "Média",
- "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) apenas a conexões HTTPS",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ". A imposição da versão mais recente do TLS rejeitará a solicitação de clientes que usam a versão mais antiga. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Impor a versão mais recente do TLS para uma conta de armazenamento",
+ "text": "Acesse os serviços de PaaS do Azure localmente por meio de pontos de extremidade privados e emparelhamento privado do ExpressRoute. Esse método evita o trânsito pela Internet pública.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Os tokens de ID do Microsoft Entra devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
"severity": "Alto",
- "text": "Usar tokens de ID do Microsoft Entra para acesso a blobs",
+ "text": "Não habilite pontos de extremidade de serviço de rede virtual por padrão em todas as sub-redes.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que ela execute suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
"severity": "Média",
- "text": "Privilégios mínimos em permissões de IaM",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Ao usar SAS, prefira 'SAS de delegação de usuário' em vez de SAS baseada em chave de conta de armazenamento.",
+ "text": "Filtre o tráfego de saída para os serviços de PaaS do Azure usando FQDNs em vez de endereços IP no Firewall do Azure ou em uma NVA para evitar a exfiltração de dados. Se estiver usando o Link Privado, você poderá bloquear todos os FQDNs, caso contrário, permita apenas os serviços de PaaS necessários.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "As chaves da conta de armazenamento (\"chaves compartilhadas\") têm muito poucos recursos de auditoria. Embora possa ser monitorado em quem/quando buscou uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Confiar apenas na autenticação do Entra ID facilita o acesso ao armazenamento a um usuário. ",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
"severity": "Alto",
- "text": "Considere desabilitar as chaves da conta de armazenamento, para que haja suporte apenas para o acesso à ID do Microsoft Entra (e à SAS de delegação de usuário).",
+ "text": "Utilize pelo menos um prefixo /27 para as sub-redes do Gateway.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use os dados do Log de Atividades para identificar \"quando\", \"quem\", \"o quê\" e \"como\" a segurança da sua conta de armazenamento está sendo exibida ou alterada (ou seja, chaves da conta de armazenamento, políticas de acesso etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"severity": "Alto",
- "text": "Considere usar o Azure Monitor para auditar as operações do painel de controle na conta de armazenamento",
+ "text": "Não confie nas regras padrão de entrada do NSG usando a marca de serviço VirtualNetwork para limitar a conectividade.",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete é exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
"severity": "Média",
- "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
+ "text": "Use NSGs para ajudar a proteger o tráfego entre sub-redes, bem como o tráfego leste/oeste na plataforma (tráfego entre zonas de destino).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Uma política de expiração de SAS especifica um intervalo recomendado durante o qual a SAS é válida. As políticas de expiração de SAS se aplicam a uma SAS de serviço ou a uma SAS de conta. Quando um usuário gera SAS de serviço ou uma SAS de conta com um intervalo de validade maior que o intervalo recomendado, ele verá um aviso.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
"severity": "Média",
- "text": "Considere configurar uma política de expiração de SAS",
+ "text": "Use NSGs e grupos de segurança de aplicativos para microssegmentar o tráfego dentro da zona de destino e evite usar uma NVA central para filtrar fluxos de tráfego.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "As políticas de acesso armazenadas oferecem a opção de revogar permissões para uma SAS de serviço sem precisar regenerar as chaves da conta de armazenamento. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"severity": "Média",
- "text": "Considere vincular SAS a uma política de acesso armazenada",
+ "text": "Habilite os Logs de Fluxo de VNet e alimente-os na Análise de Tráfego para obter insights sobre fluxos de tráfego internos e externos.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
"severity": "Média",
- "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão e chaves de conta de armazenamento com check-in.",
- "waf": "Segurança"
+ "text": "Não implemente mais de 900 regras de NSG por NSG, devido ao limite de 1000 regras.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Idealmente, seu aplicativo deve usar uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave da conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Considere armazenar cadeias de conexão no Azure KeyVault (em cenários em que as identidades gerenciadas não são possíveis)",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "severity": "Média",
+ "text": "Use a WAN Virtual se o cenário estiver explicitamente descrito na lista de designs de roteamento da WAN Virtual.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Use tempos de expiração de curto prazo em uma SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que uma SAS seja comprometida, ela é válida apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenada. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Esforce-se por períodos de validade curtos para SAS ad-hoc",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "severity": "Média",
+ "text": "Use um hub de WAN Virtual por região do Azure para conectar várias zonas de destino entre regiões do Azure por meio de uma WAN Virtual do Azure global comum.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ao criar uma SAS, seja o mais específico e restritivo possível. Prefira uma SAS para um único recurso e operação em vez de uma SAS que oferece acesso muito mais amplo.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
"severity": "Média",
- "text": "Aplicar um escopo restrito a uma SAS",
+ "text": "Para proteção e filtragem de tráfego de saída da Internet, implante o Firewall do Azure em hubs seguros.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Uma SAS pode incluir parâmetros nos quais os endereços IP do cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
"severity": "Média",
- "text": "Considere definir o escopo da SAS para um endereço IP de cliente específico, sempre que possível",
- "waf": "Segurança"
+ "text": "Verifique se a arquitetura de rede da WAN virtual está alinhada a um cenário de arquitetura identificado.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Uma SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de preços da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdos maliciosamente grandes.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "Baixo",
- "text": "Considere verificar os dados carregados depois que os clientes usaram uma SAS para carregar um arquivo. ",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "severity": "Média",
+ "text": "Use o Azure Monitor Insights para WAN Virtual para monitorar a topologia de ponta a ponta da WAN Virtual, o status e as principais métricas.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operações"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Ao acessar o armazenamento de blobs por meio do SFTP usando uma \"conta de usuário local\", os controles RBAC \"usuais\" não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso SFTP. Infelizmente, a partir do início de 2023, os usuários locais são a única forma de gerenciamento de identidade com suporte atual para o endpoint SFTP",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "SFTP: limite a quantidade de \"usuários locais\" para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "severity": "Média",
+ "text": "Não desabilite o tráfego branch a branch na WAN Virtual, a menos que esses fluxos devam ser bloqueados explicitamente.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
"severity": "Média",
- "text": "SFTP: o endpoint SFTP não oferece suporte a ACLs semelhantes a POSIX.",
- "waf": "Segurança"
+ "text": "Use AS-Path como preferência de roteamento de hub, pois é mais flexível que ExpressRoute ou VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "O armazenamento oferece suporte ao CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha as CorsRules com o menor privilégio.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "severity": "Média",
+ "text": "Configure a propagação baseada em rótulos na WAN Virtual, caso contrário, a conectividade entre hubs virtuais será prejudicada.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
"severity": "Alto",
- "text": "Evite políticas de CORS excessivamente amplas",
- "waf": "Segurança"
+ "text": "Atribua pelo menos um prefixo /23 a hubs virtuais para garantir que haja espaço IP suficiente disponível.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode ocorrer usando uma chave gerenciada pela plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não dependendo do Armazenamento do Azure para garantias de confidencialidade.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Alto",
- "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
+ "text": "Aproveite o Azure Policy estrategicamente, defina controles para seu ambiente, usando Iniciativas de Política para agrupar políticas relacionadas.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Média",
- "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
+ "text": "Mapeie os requisitos regulatórios e de conformidade para definições do Azure Policy e atribuições de função do Azure.",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Média",
- "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
+ "text": "Estabeleça definições do Azure Policy no grupo de gerenciamento raiz intermediário para que elas possam ser atribuídas em escopos herdados.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Alto",
- "text": "Considere se o acesso anônimo de blob público é necessário ou se ele pode ser desabilitado para determinadas contas de armazenamento. ",
+ "text": "Gerencie atribuições de política no nível apropriado mais alto com exclusões nos níveis inferiores, se necessário.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
- "severity": "Alto",
- "text": "Aproveite um tipo de conta storagev2 para melhor desempenho e confiabilidade",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "Baixo",
+ "text": "Use o Azure Policy para controlar quais serviços os usuários podem provisionar no nível da assinatura/grupo de gerenciamento.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Alto",
- "text": "Aproveite o armazenamento GRS, ZRS ou GZRS para obter a mais alta disponibilidade",
- "waf": "Fiabilidade"
+ "text": "Use políticas internas sempre que possível para minimizar a sobrecarga operacional.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Atribuir a função Colaborador de Política de Recursos a escopos específicos permite delegar o gerenciamento de políticas a equipes relevantes. Por exemplo, uma equipe central de TI pode supervisionar as políticas no nível do grupo de gerenciamento, enquanto as equipes de aplicativos lidam com as políticas de suas assinaturas, permitindo a governança distribuída com adesão aos padrões organizacionais.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "Média",
- "text": "Para operação de gravação após o failover, use o failover gerenciado pelo cliente ",
- "waf": "Fiabilidade"
+ "text": "Atribua a função interna de Colaborador de Política de Recursos em um escopo específico para habilitar a governança no nível do aplicativo.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "Média",
- "text": "Entender os detalhes do failover gerenciado pela Microsoft",
- "waf": "Fiabilidade"
+ "text": "Limite o número de atribuições do Azure Policy feitas no escopo do grupo de gerenciamento raiz para evitar o gerenciamento por meio de exclusões em escopos herdados.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
"severity": "Média",
- "text": "Habilitar exclusão reversível",
- "waf": "Fiabilidade"
+ "text": "Se houver requisitos de soberania de dados, as Políticas do Azure deverão ser implantadas para aplicá-los.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
- "severity": "Baixo",
- "text": "Consulte a arquitetura de aplicativo Web com redundância de zona altamente disponível da linha de base para obter as práticas recomendadas",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "severity": "Média",
+ "text": "Para a Zona de Destino Soberana, implante a linha de base da política de soberania e atribua no nível correto do grupo de gerenciamento.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
"severity": "Média",
- "text": "Use as camadas Premium e Standard. Esses níveis oferecem suporte a slots de preparo e backups automatizados.",
- "waf": "Fiabilidade"
+ "text": "Para Zona de Aterrissagem Soberana, documente os objetivos de Controle Soberano para mapeamento de políticas.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
- "severity": "Alto",
- "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente (requer a camada Premium v2 ou v3)",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "severity": "Média",
+ "text": "Para a Zona de Aterrissagem Soberana, certifique-se de que o processo esteja em vigor para o gerenciamento de 'Objetivos de Controle Soberano para mapeamento de políticas'.",
+ "waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
"severity": "Média",
- "text": "Implementar verificações de integridade",
- "waf": "Fiabilidade"
+ "text": "Use um workspace de logs de monitor único para gerenciar plataformas centralmente, exceto quando o RBAC (controle de acesso baseado em função) do Azure, os requisitos de soberania de dados ou as políticas de retenção de dados exigirem workspaces separados.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
- "severity": "Alto",
- "text": "Consulte as práticas recomendadas de backup e restauração para o Serviço de Aplicativo do Azure",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Média",
+ "text": "Decida se deseja usar um único workspace de Logs do Azure Monitor para todas as regiões ou criar vários workspaces para abranger várias regiões geográficas. Cada abordagem tem vantagens e desvantagens, incluindo possíveis cobranças de rede entre regiões",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "Alto",
- "text": "Implementar práticas recomendadas de confiabilidade do Serviço de Aplicativo do Azure",
- "waf": "Fiabilidade"
+ "text": "Exporte logs para o Armazenamento do Azure se os requisitos de retenção de log excederem doze anos. Use o armazenamento imutável com uma política de gravação única e leitura múltipla para tornar os dados não apagáveis e não modificáveis por um intervalo especificado pelo usuário.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "Baixo",
- "text": "Familiarizar-se com como mover um aplicativo do Serviço de Aplicativo para outra região durante um desastre",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "Média",
+ "text": "Monitore o descompasso de configuração da VM (máquina virtual) no nível do sistema operacional usando o Azure Policy. Habilitar os recursos de auditoria da Configuração de Computador do Gerenciamento Automatizado do Azure por meio da política ajuda as cargas de trabalho da equipe de aplicativos a consumir imediatamente os recursos de recursos com pouco esforço.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
- "severity": "Alto",
- "text": "Familiarizar-se com o suporte de confiabilidade no Serviço de Aplicativo do Azure",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "severity": "Média",
+ "text": "Use o Azure Update Manager como um mecanismo de aplicação de patch para VMs Windows e Linux no Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
"severity": "Média",
- "text": "Verifique se \"Sempre Ativo\" está habilitado para Aplicativos de Função em execução em um plano de serviço de aplicativo",
- "waf": "Fiabilidade"
+ "text": "Use o Gerenciador de Atualizações do Azure como um mecanismo de aplicação de patch para VMs do Windows e do Linux fora do Azure usando o Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
"severity": "Média",
- "text": "Monitorar instâncias do Serviço de Aplicativo usando verificações de integridade",
- "waf": "Fiabilidade"
+ "text": "Use o Observador de Rede para monitorar proativamente os fluxos de tráfego.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
"severity": "Média",
- "text": "Monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site usando testes de disponibilidade do Application Insights",
- "waf": "Fiabilidade"
+ "text": "Use os Logs do Azure Monitor para obter insights e relatórios.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "severity": "Baixo",
- "text": "Usar o teste Application Insights Standard para monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "Média",
+ "text": "Use alertas do Azure Monitor para a geração de alertas operacionais.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use o Cofre de Chaves do Azure para armazenar quaisquer segredos de que o aplicativo precisa. O Cofre de Chaves fornece um ambiente seguro e auditado para armazenar segredos e está bem integrado ao Serviço de Aplicativo por meio do SDK do Cofre de Chaves ou das Referências do Cofre de Chaves do Serviço de Aplicativo.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar o Cofre de Chaves para armazenar segredos",
- "waf": "Segurança"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "Média",
+ "text": "Ao usar o Acompanhamento de Alterações e Inventário por meio de Contas de Automação do Azure, verifique se você selecionou regiões com suporte para vincular seu workspace do Log Analytics e contas de automação.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use uma Identidade Gerenciada para se conectar ao Cofre de Chaves usando o SDK do Cofre de Chaves ou por meio das Referências do Cofre de Chaves do Serviço de Aplicativo.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar a Identidade Gerenciada para se conectar ao Cofre de Chaves",
- "waf": "Segurança"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "Baixo",
+ "text": "Ao usar o Backup do Azure, use os tipos de backup corretos (GRS, ZRS E LRS) para o backup, pois a configuração padrão é GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Armazene o certificado TLS do Serviço de Aplicativo no Cofre de Chaves.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
- "severity": "Alto",
- "text": "Use o Cofre de Chaves para armazenar o certificado TLS.",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "severity": "Média",
+ "text": "Use as políticas de convidado do Azure para implantar automaticamente as configurações de software por meio de extensões de VM e impor uma configuração de VM de linha de base compatível.",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Os sistemas que processam informações confidenciais devem ser isolados. Para fazer isso, use Planos do Serviço de Aplicativo ou Ambientes do Serviço de Aplicativo separados e considere o uso de assinaturas ou grupos de gerenciamento diferentes.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use os recursos de configuração de convidado do Azure Policy para auditar e corrigir as configurações do computador (por exemplo, sistema operacional, aplicativo, ambiente) para garantir que os recursos estejam alinhados com as configurações esperadas e que o Gerenciamento de Atualizações possa impor o gerenciamento de patches para VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
"severity": "Média",
- "text": "Isolar sistemas que processam informações confidenciais",
+ "text": "Monitore o descompasso de configuração de segurança da VM por meio do Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Os discos locais no Serviço de Aplicativo não são criptografados e os dados confidenciais não devem ser armazenados neles. (Por exemplo: D:\\\\Local e %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"severity": "Média",
- "text": "Não armazene dados confidenciais no disco local",
- "waf": "Segurança"
+ "text": "Use o Azure Site Recovery para cenários de recuperação de desastre de Máquinas Virtuais do Azure para o Azure. Isso permite replicar cargas de trabalho entre regiões.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Para aplicativos Web autenticados, use um Provedor de Identidade bem estabelecido, como o Azure AD ou o Azure AD B2C. Aproveite a estrutura de aplicativo de sua escolha para se integrar a esse provedor ou use o recurso de Autenticação/Autorização do Serviço de Aplicativo.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
"severity": "Média",
- "text": "Usar um provedor de identidade estabelecido para autenticação",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Implante código no Serviço de Aplicativo a partir de um ambiente controlado e confiável, como um pipeline de implantação de DevOps bem gerenciado e seguro. Isso evita que o código que não foi controlado por versão e verificado para ser implantado a partir de um host mal-intencionado.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
- "severity": "Alto",
- "text": "Implantar a partir de um ambiente confiável",
- "waf": "Segurança"
+ "text": "Use recursos de backup nativos do Azure ou uma solução de backup de terceiros compatível com o Azure.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Desative a autenticação básica para FTP/FTPS e WebDeploy/SCM. Isso desabilita o acesso a esses serviços e impõe o uso de pontos de extremidade protegidos do Azure AD para implantação. Observe que o site do SCM também pode ser aberto usando credenciais do Azure AD.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"severity": "Alto",
- "text": "Desabilitar a autenticação básica",
- "waf": "Segurança"
+ "text": "Adicione configurações de diagnóstico para salvar logs do WAF de serviços de entrega de aplicativos, como o Azure Front Door e o Gateway de Aplicativo do Azure. Revise regularmente os logs para verificar se há ataques e detecções de falsos positivos.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Sempre que possível, use a Identidade Gerenciada para se conectar aos recursos protegidos do Azure AD. Se isso não for possível, armazene segredos no Cofre de Chaves e conecte-se ao Cofre de Chaves usando uma Identidade Gerenciada.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar a Identidade Gerenciada para se conectar a recursos",
- "waf": "Segurança"
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
+ "severity": "Média",
+ "text": "Envie logs do WAF de seus serviços de entrega de aplicativos, como o Azure Front Door e o Gateway de Aplicativo do Azure, para o Microsoft Sentinel. Detecte ataques e integre a telemetria do WAF ao seu ambiente geral do Azure.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operações"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Onde estiver usando imagens armazenadas no Registro de Contêiner do Azure, extraia-as usando uma Identidade Gerenciada.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Extrair contêineres usando uma identidade gerenciada",
+ "text": "Use o Azure Key Vault para armazenar seus segredos e credenciais.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ao definir as configurações de diagnóstico do Serviço de Aplicativo, você pode enviar toda a telemetria para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade de tempo de execução do Serviço de Aplicativo, como logs HTTP, logs de aplicativos, logs de plataforma, ...",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Enviar logs de tempo de execução do Serviço de Aplicativo para o Log Analytics",
+ "text": "Use diferentes Azure Key Vaults para diferentes aplicativos e regiões para evitar limites de escala de transação e restringir o acesso a segredos.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure uma configuração de diagnóstico para enviar o log de atividades para o Log Analytics como o destino central para registro e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso do Serviço de Aplicativo.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Enviar logs de atividade do Serviço de Aplicativo para o Log Analytics",
+ "text": "Provisione o Azure Key Vault com as políticas de exclusão reversível e limpeza habilitadas para permitir a proteção de retenção para objetos excluídos.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Controle o acesso à rede de saída usando uma combinação de integração regional de VNet, grupos de segurança de rede e UDR's. O tráfego deve ser roteado para um NVA, como o Firewall do Azure. Certifique-se de monitorar os logs do Firewall.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "Média",
- "text": "O acesso à rede de saída deve ser controlado",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Você pode fornecer um IP de saída estável usando a integração de rede virtual e um gateway NAT de rede virtual ou um NVA como o Firewall do Azure. Isso permite que a parte receptora permita uma lista com base no IP, caso seja necessário. Observe que, para comunicações com os Serviços do Azure, geralmente não há necessidade de depender do endereço IP e mecânicas como Pontos de Extremidade de Serviço devem ser usadas. (Além disso, o uso de pontos de extremidade privados na extremidade de recebimento evita que o SNAT aconteça e fornece um intervalo de IP de saída estável.)",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
- "severity": "Baixo",
- "text": "Garantir um IP estável para comunicações de saída para endereços de Internet",
+ "text": "Siga um modelo de privilégios mínimos limitando a autorização para excluir permanentemente chaves, segredos e certificados a funções personalizadas especializadas de ID do Microsoft Entra.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Controle o acesso à rede de entrada usando uma combinação de Restrições de Acesso do Serviço de Aplicativo, Pontos de Extremidade de Serviço ou Pontos de Extremidade Privados. Diferentes restrições de acesso podem ser necessárias e configuradas para o próprio aplicativo Web e o site do SCM.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "Alto",
- "text": "O acesso à rede de entrada deve ser controlado",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Automatize o processo de gerenciamento e renovação de certificados com autoridades de certificação públicas para facilitar a administração.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Proteja-se contra tráfego de entrada mal-intencionado usando um Firewall de Aplicativo Web, como o Gateway de Aplicativo ou o Azure Front Door. Certifique-se de monitorar os logs do WAF.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar um WAF na frente do Serviço de Aplicativo",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Estabeleça um processo automatizado para rotação de chaves e certificados.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Certifique-se de que o WAF não pode ser ignorado bloqueando o acesso apenas ao WAF. Use uma combinação de Restrições de Acesso, Pontos de Extremidade de Serviço e Pontos de Extremidade Privados.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "Alto",
- "text": "Evite que o WAF seja ignorado",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Habilite o firewall e o ponto de extremidade de serviço de rede virtual ou o ponto de extremidade privado no cofre para controlar o acesso ao cofre de chaves.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Defina a política TLS mínima como 1.2 na configuração do Serviço de Aplicativo.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Definir a política TLS mínima como 1.2",
+ "text": "Use o workspace do Log Analytics do Azure Monitor central da plataforma para auditar o uso de chave, certificado e segredo em cada instância do Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Configure o Serviço de Aplicativo para usar somente HTTPS. Isso faz com que o Serviço de Aplicativo redirecione de HTTP para HTTPS. Considere fortemente o uso de HTTP Strict Transport Security (HSTS) em seu código ou a partir de seu WAF, que informa aos navegadores que o site só deve ser acessado usando HTTPS.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
- "severity": "Alto",
- "text": "Usar somente HTTPS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Delegue a instanciação e o acesso privilegiado do Key Vault e use o Azure Policy para impor uma configuração consistente e compatível.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Não use curingas em sua configuração do CORS, pois isso permite que todas as origens acessem o serviço (derrotando assim o propósito do CORS). Especificamente, permita apenas as origens que você espera poder acessar o serviço.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
- "severity": "Alto",
- "text": "Curingas não devem ser usados para CORS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Use um Azure Key Vault por aplicativo por ambiente por região.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "A depuração remota não deve ser ativada na produção, pois isso abre portas adicionais no serviço, o que aumenta a superfície de ataque. Observe que o serviço ativa a depuração remota automaticamente após 48 horas.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
- "severity": "Alto",
- "text": "Desativar a depuração remota",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Média",
+ "text": "Se você quiser trazer suas próprias chaves, isso pode não ser compatível com todos os serviços considerados. Implemente mitigação relevante para que as inconsistências não prejudiquem os resultados desejados. Escolha pares de regiões apropriados e regiões de recuperação de desastre que minimizem a latência.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Habilite o Defender para o Serviço de Aplicativo. Isso (entre outras ameaças) detecta comunicações com endereços IP mal-intencionados conhecidos. Analise as recomendações do Defender for App Service como parte de suas operações.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
"severity": "Média",
- "text": "Habilitar o Defender for Cloud - Defender for App Service",
+ "text": "Para a Zona de Destino Soberana, use o HSM gerenciado do Azure Key Vault para armazenar seus segredos e credenciais.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "O Azure fornece proteção contra DDoS Basic em sua rede, que pode ser aprimorada com recursos inteligentes de DDoS Standard que aprendem sobre padrões normais de tráfego e podem detectar comportamentos incomuns. O DDoS Standard se aplica a uma Rede Virtual, portanto, ele deve ser configurado para o recurso de rede na frente do aplicativo, como o Application Gateway ou um NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"severity": "Média",
- "text": "Habilitar o padrão de proteção DDOS na rede virtual WAF",
+ "text": "Use os recursos de relatório de ID do Microsoft Entra para gerar relatórios de auditoria de controle de acesso.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as por uma rede virtual do Registro de Contêiner do Azure usando seu ponto de extremidade privado e a configuração do aplicativo 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
- "severity": "Média",
- "text": "Extrair contêineres por uma rede virtual",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "severity": "Alto",
+ "text": "Habilite o Gerenciamento de Postura de Segurança de Nuvem do Defender para todas as assinaturas.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Realizar um teste de penetração na aplicação web seguindo as regras de teste de penetração de engajamento.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
- "severity": "Média",
- "text": "Realizar um teste de penetração",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "Alto",
+ "text": "Habilite um Plano de Proteção de Carga de Trabalho de Nuvem do Defender para Servidores em todas as assinaturas.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
- "severity": "Média",
- "text": "Implantar código validado",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "Alto",
+ "text": "Habilite os Planos de Proteção de Carga de Trabalho de Nuvem do Defender para Recursos do Azure em todas as assinaturas.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "Segurança"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportadas.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
"severity": "Alto",
- "text": "Use plataformas, linguagens, protocolos e frameworks atualizados",
+ "text": "Habilite o Endpoint Protection em servidores IaaS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "Média",
- "text": "Implementar uma política de tratamento de erros em nível global",
- "waf": "Operações"
+ "text": "Monitore o descompasso de aplicação de patch do sistema operacional base por meio dos Logs do Azure Monitor e do Defender para Nuvem.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "Média",
- "text": "Certifique-se de que todas as políticas de APIs incluam um elemento .",
- "waf": "Operações"
+ "text": "Conecte as configurações de recursos padrão a um workspace centralizado do Log Analytics do Azure Monitor.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
+ "severity": "Alto",
+ "text": "Detecção centralizada de ameaças com logs correlacionados - consolide os dados de segurança em um local central onde possam ser correlacionados em vários serviços via SIEM (gerenciamento de eventos e informações de segurança)",
+ "waf": "Segurança"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"severity": "Média",
- "text": "Usar fragmentos de política para evitar a repetição das mesmas definições de políticas em várias APIs",
- "waf": "Operações"
+ "text": "Para Zona de Destino Soberana, habilite os logs de transparência no locatário da ID do Entra.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
"severity": "Média",
- "text": "Se você estiver planejando monetizar suas APIs, consulte o artigo 'suporte à monetização' para obter as práticas recomendadas",
- "waf": "Operações"
+ "text": "Para Zona de Destino Soberana, habilite o Sistema de Proteção de Dados do cliente no locatário da ID do Entra.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
"severity": "Alto",
- "text": "Habilitar Configurações de Diagnóstico para exportar logs para o Azure Monitor",
- "waf": "Operações"
+ "text": "Habilite a transferência segura para contas de armazenamento.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
- "severity": "Média",
- "text": "Habilite o Application Insights para telemetria mais detalhada",
- "waf": "Operações"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "Alto",
+ "text": "Habilite a exclusão reversível do contêiner para a conta de armazenamento para recuperar um contêiner excluído e seu conteúdo.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
"severity": "Alto",
- "text": "Configurar alertas sobre as métricas mais críticas",
+ "text": "Use segredos do Key Vault para evitar codificar informações confidenciais, como credenciais (máquinas virtuais, senhas de usuário), certificados ou chaves.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
"waf": "Operações"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Certifique-se de que os certificados SSL personalizados sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança",
- "waf": "Segurança"
+ "text": "Siga as proteções do Metaprompting para uma IA razoável",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Proteger solicitações de entrada para APIs (plano de dados) com o Azure AD",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
- "severity": "Média",
- "text": "Usar o Microsoft Entra ID para autenticar usuários no Portal do Desenvolvedor",
- "waf": "Segurança"
+ "text": "Considere padrões de gateway com APIM ou soluções como AI central para melhor limitação de taxa, balanceamento de carga, autenticação e registro",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
- "severity": "Média",
- "text": "Criar grupos apropriados para controlar a visibilidade dos produtos",
- "waf": "Segurança"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Habilitar o monitoramento para suas instâncias AOAI",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
- "severity": "Média",
- "text": "Use o recurso Back-ends para eliminar configurações redundantes de back-end de API",
- "waf": "Operações"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Crie alertas para notificar as equipes sobre eventos, como uma entrada no log de atividades criada por uma ação executada no recurso, como regenerar suas chaves de assinatura ou um limite de métrica, como o número de erros que excedem 10 em uma hora",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
- "severity": "Média",
- "text": "Usar Valores Nomeados para armazenar valores comuns que podem ser usados em políticas",
- "waf": "Operações"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Monitore o uso do token para evitar interrupções de serviço devido à capacidade",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Para DR, aproveite o nível premium com implantações dimensionadas em duas ou mais regiões para um SLA de 99,99%",
- "waf": "Fiabilidade"
+ "text": "Observe métricas como tokens de inferência processados, monitoramento de tokens de conclusão gerados para limite de taxa",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
- "severity": "Média",
- "text": "Implante pelo menos uma unidade em duas ou mais zonas de disponibilidade para um SLA aumentado de 99,99%",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
+ "severity": "Baixo",
+ "text": "Se o diagnóstico não for suficiente para você, considere usar um gateway como o Gerenciamento de API do Azure na frente do Azure OpenAI para registrar prompts de entrada e respostas de saída, quando permitido",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Verifique se há uma rotina de backup automatizada",
- "waf": "Fiabilidade"
+ "text": "Usar a infraestrutura como código para implantar o serviço OpenAI do Azure, implantações de modelo e todos os recursos relacionados",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
- "severity": "Média",
- "text": "Use Políticas para adicionar uma URL de back-end de failover e cache para reduzir chamadas com falha.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Usar a autenticação do Microsoft Entra com identidade gerenciada em vez de chave de API",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "Baixo",
- "text": "Se você precisar registrar em níveis de alto desempenho, considere a política de Hubs de Eventos",
- "waf": "Operações"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Avalie o desempenho/precisão do sistema com um conjunto de dados dourado conhecido que tenha as entradas e as respostas corretas. Aproveite os recursos do PromptFlow para avaliação.",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
- "severity": "Média",
- "text": "Aplicar políticas de limitação para controlar o número de solicitações por segundo",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Avaliar o uso do modelo de taxa de transferência provisionada ",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
- "severity": "Média",
- "text": "Configurar o dimensionamento automático para dimensionar o número de instâncias quando a carga aumenta",
- "waf": "Desempenho"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Examinar e implementar a segurança de conteúdo do Azure AI",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
- "severity": "Média",
- "text": "Implante gateways auto-hospedados onde o Azure não tem uma região próxima às APIs de back-end.",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Defina e avalie a taxa de transferência do sistema com base em tokens e resposta por minuto e alinhe-se aos requisitos",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Use a camada premium para cargas de trabalho de produção.",
- "waf": "Fiabilidade"
+ "text": "Melhore a latência do sistema limitando os tamanhos dos tokens, as opções de streaming",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "No modelo de várias regiões, use Políticas para rotear as solicitações para back-ends regionais com base na disponibilidade ou latência.",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
- "severity": "Alto",
- "text": "Esteja atento aos limites da APIM",
- "waf": "Fiabilidade"
+ "text": "Estime as demandas de elasticidade para determinar a segregação de solicitações síncronas e em lote com base na prioridade. Para alta prioridade, use a abordagem síncrona e, para baixa prioridade, o processamento em lote assíncrono com fila é preferível",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Certifique-se de que as implantações de gateway auto-hospedado sejam resilientes.",
- "waf": "Fiabilidade"
+ "text": "Compare os requisitos de consumo de token com base nas demandas estimadas dos consumidores. Considere usar a ferramenta de benchmarking OpenAI do Azure para ajudá-lo a validar a taxa de transferência se você estiver usando implantações de Unidade de Produtividade Provisionada",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Usar o Azure Front Door na frente do APIM para implantação em várias regiões",
+ "text": "Se você estiver usando PTUs (Unidades de Produtividade Provisionadas), considere implantar uma implantação de token por minuto (TPM) para solicitações de estouro. Use um gateway para rotear solicitações para a implantação do TPM quando os limites de PTU forem atingidos.",
"waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
- "severity": "Média",
- "text": "Implantar o serviço em uma rede virtual (VNet)",
- "waf": "Segurança"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Escolha o modelo certo para a tarefa certa. Escolha modelos com a compensação certa entre velocidade, qualidade de resposta e complexidade de saída",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Implante NSG (grupos de segurança de rede) em suas sub-redes para restringir ou monitorar o tráfego de/para APIM.",
- "waf": "Segurança"
+ "text": "Tenha uma linha de base para o desempenho sem ajuste fino para saber se o ajuste fino melhorou ou não o desempenho do modelo",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
- "severity": "Média",
- "text": "Implante pontos de extremidade privados para filtrar o tráfego de entrada quando o APIM não for implantado em uma rede virtual.",
- "waf": "Segurança"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
+ "severity": "Baixo",
+ "text": "Implantar várias instâncias de OAI em regiões",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Desabilitar o acesso à rede pública",
- "waf": "Segurança"
- },
- {
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
- "severity": "Média",
- "text": "Simplifique o gerenciamento com scripts de automação do PowerShell",
- "waf": "Operações"
+ "text": "Implemente novas tentativas e verificações de integridade com o padrão de Gateway como APIM",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Configure APIM via Infrastructure-as-code. Analise as práticas recomendadas de DevOps do Cloud Adaption Framework APIM Landing Zone Accelerator",
- "waf": "Operações"
+ "text": "Garantir que tenha cotas adequadas de TPM e RPM para a carga de trabalho",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Promover o uso da extensão API do Visual Studio Code para um desenvolvimento de API mais rápido",
- "waf": "Operações"
+ "text": "Revise as considerações nas diretrizes do kit de ferramentas HAI e aplique essas práticas de interação para a análise",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Implemente DevOps e CI/CD em seu fluxo de trabalho",
- "waf": "Operações"
+ "text": "Implantar modelos ajustados separados entre regiões se o ajuste fino for empregado",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "APIs seguras usando autenticação de certificado de cliente",
- "waf": "Segurança"
+ "text": "Faça backup e replique regularmente dados críticos para garantir a disponibilidade e a capacidade de recuperação dos dados em caso de perda de dados ou falhas do sistema. Aproveite os serviços de backup e recuperação de desastre do Azure para proteger seus dados.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
- "severity": "Média",
- "text": "Serviços de back-end seguros usando autenticação de certificado de cliente",
- "waf": "Segurança"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "As camadas de serviço de pesquisa de IA do Azure devem ser escolhidas para ter um SLA ",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
- "severity": "Média",
- "text": "Consulte o artigo \"Recomendações para mitigar as 10 principais ameaças da segurança da API OWASP\" e verifique o que é aplicável às suas APIs",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "severity": "Baixo",
+ "text": "Classifique os dados e a confidencialidade, rotulando com o Microsoft Purview antes de gerar as inserções e certifique-se de tratar as inserções geradas com a mesma confidencialidade e classificação",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
- "severity": "Média",
- "text": "Usar o recurso Autorizações para simplificar o gerenciamento do token OAuth 2.0 para suas APIs de back-end",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Criptografar dados usados para RAG com criptografia SSE/Disco com BYOK opcional",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Use a versão mais recente do TLS ao criptografar informações em trânsito. Desative protocolos e cifras desatualizados e desnecessários quando possível.",
+ "text": "Certifique-se de que o TLS seja aplicado para dados em trânsito entre fontes de dados, pesquisa de IA usada para RG (Geração Aumentada por Recuperação) e comunicação LLM",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Certifique-se de que os segredos (valores nomeados) sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança",
+ "text": "Use o RBAC para gerenciar o acesso aos serviços do OpenAI do Azure. Atribua permissões apropriadas aos usuários e restrinja o acesso com base em suas funções e responsabilidades",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Use identidades gerenciadas para autenticar em outros recursos do Azure sempre que possível",
+ "text": "Implemente técnicas de criptografia, mascaramento ou redação de dados para ocultar dados confidenciais ou substituí-los por valores ofuscados em ambientes de não produção ou ao compartilhar dados para fins de teste ou solução de problemas",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Usar o WAF (Web Application Firewall) implantando o Application Gateway na frente do APIM",
+ "text": "Utilize o Azure Defender para detectar e responder a ameaças de segurança e configurar mecanismos de monitoramento e alerta para identificar atividades suspeitas ou violações. Aproveite o Azure Sentinel para detecção e resposta avançadas a ameaças",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "Alto",
- "text": "Selecione o plano de hospedagem de função certo com base em seus requisitos de negócios e SLO",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Estabeleça políticas de retenção e descarte de dados para cumprir os regulamentos de conformidade. Implemente métodos de exclusão segura para dados que não são mais necessários e mantenha uma trilha de auditoria das atividades de retenção e descarte de dados",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Aproveitar zonas de disponibilidade quando aplicável regionalmente (não disponível para a camada de consumo)",
- "waf": "Fiabilidade"
+ "text": "Implementar proteções imediatas e detecção de aterramento usando a Segurança de conteúdo ",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
- "severity": "Média",
- "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Garanta a conformidade com os regulamentos de proteção de dados relevantes, como GDPR ou HIPAA, implementando controles de privacidade e obtendo os consentimentos ou permissões necessários para atividades de processamento de dados.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
- "severity": "Alto",
- "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Eduque seus funcionários sobre as melhores práticas de segurança de dados, a importância de lidar com dados com segurança e os possíveis riscos associados a violações de dados. Incentive-os a seguir os protocolos de segurança de dados diligentemente.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Verifique se 'Sempre Ativado' está habilitado para todos os Aplicativos de Função em execução no Plano do Serviço de Aplicativo",
- "waf": "Fiabilidade"
+ "text": "Mantenha os dados de produção separados dos dados de desenvolvimento e teste. Use apenas dados confidenciais reais na produção e utilize dados anônimos ou sintéticos em ambientes de desenvolvimento e teste.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Emparelhe um aplicativo de função com sua própria conta de armazenamento. Tente não reutilizar contas de armazenamento para aplicativos de função, a menos que eles estejam firmemente acoplados",
- "waf": "Fiabilidade"
+ "text": "Se você tiver níveis variados de confidencialidade de dados, considere criar índices separados para cada nível. Por exemplo, você pode ter um índice para dados gerais e outro para dados confidenciais, cada um regido por diferentes protocolos de acesso",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código do Aplicativo de Função",
- "waf": "Operações"
+ "text": "Leve a segregação um passo adiante, colocando conjuntos de dados confidenciais em diferentes instâncias do serviço. Cada instância pode ser controlada com seu próprio conjunto específico de políticas RBAC",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Aproveitar zonas de disponibilidade, se aplicável regionalmente (isso é habilitado automaticamente)",
- "waf": "Fiabilidade"
+ "text": "Reconheça que incorporações e vetores gerados a partir de informações confidenciais são eles próprios sensíveis. Esses dados devem receber as mesmas medidas de proteção que o material de origem",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "Média",
- "text": "Esteja ciente dos failovers iniciados pela Microsoft. Eles são exercidos pela Microsoft em raras situações para fazer failover de todos os hubs IoT de uma região afetada para a região geo-emparelhada correspondente.",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Aplique o RBAC aos armazenamentos de dados com incorporações e vetores e acesso ao escopo com base nos requisitos de acesso da função",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
- "waf": "Fiabilidade"
+ "text": "Configurar o ponto de extremidade privado para serviços de IA para restringir o acesso ao serviço em sua rede",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Saiba como acionar um failover manual.",
- "waf": "Fiabilidade"
+ "text": "Imponha um controle estrito de tráfego de entrada e saída com o Firewall do Azure e UDRs e limite os pontos de integração externos",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
"severity": "Alto",
- "text": "Saiba como fazer failback após um failover.",
- "waf": "Fiabilidade"
+ "text": "Implemente segmentação de rede e controles de acesso para restringir o acesso ao aplicativo LLM apenas a usuários e sistemas autorizados e evitar movimentos laterais",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "Siga as recomendações de suporte de confiabilidade no Serviço de Bot do Azure",
- "waf": "Fiabilidade"
+ "text": "Use ferramentas de compactação imediatas como LLMLingua ou gprtrim",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "severity": "Média",
- "text": "Implantando bots com residência de dados local e conformidade regional",
- "waf": "Fiabilidade"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Certifique-se de que as APIs e os endpoints usados pelo aplicativo LLM estejam devidamente protegidos com mecanismos de autenticação e autorização, como identidades gerenciadas, chaves de API ou OAuth, para impedir o acesso não autorizado.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"severity": "Média",
- "text": "O Serviço de Bot do Azure é executado no modo ativo-ativo para serviços globais e regionais. Quando ocorre uma paralisação, você não precisa detectar erros ou gerenciar o serviço. O Serviço de Bot do Azure executa automaticamente o failover automático e a recuperação automática em uma arquitetura geográfica de várias regiões. Para o serviço regional de bot da UE, o Serviço de Bot do Azure fornece duas regiões completas dentro da Europa com replicação ativa/ativa para garantir redundância. Para o serviço de bot global, todas as regiões/geografias disponíveis podem ser servidas como a presença global.",
- "waf": "Fiabilidade"
+ "text": "Aplique mecanismos fortes de autenticação do usuário final, como autenticação multifator, para impedir o acesso não autorizado ao aplicativo LLM e aos recursos de rede associados",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
- "text": "Regras de coleta de dados no Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Implemente ferramentas de monitoramento de rede para detectar e analisar o tráfego de rede em busca de atividades suspeitas ou maliciosas. Habilite o registro para capturar eventos de rede e facilitar a análise forense em caso de incidentes de segurança",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
- "text": "Verificar instâncias de backup com a fonte de dados subjacente não encontrada",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Realize auditorias de segurança e testes de penetração para identificar e resolver quaisquer pontos fracos ou vulnerabilidades de segurança de rede na infraestrutura de rede do aplicativo LLM",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "text": "Excluir ou arquivar serviços não associados (discos, nics, endereços IP etc.)",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "severity": "Baixo",
+ "text": "Os Serviços de IA do Azure são marcados corretamente para melhor gerenciamento",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
- "text": "Considere um bom equilíbrio entre recuperação de local, armazenamento e backup para aplicativos não essenciais",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "Baixo",
+ "text": "As contas do Serviço de IA do Azure seguem as convenções de nomenclatura organizacional",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
- "text": "Verifique os gastos e as oportunidades de economia entre os 40 diferentes espaços de trabalho de análise de log - use retenção e coleta de dados diferentes para espaços de trabalho não prod - crie limite diário para reconhecimento e dimensionamento de camadas - Se você definir um limite diário, além de criar um alerta quando o limite for atingido, certifique-se de também criar uma regra de alerta para ser notificado quando alguma porcentagem for atingida (90%, por exemplo). - considerar a transformação do espaço de trabalho, se possível - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Os logs de diagnóstico nos recursos de serviços de IA do Azure devem ser habilitados",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
- "text": "Impor uma política de log de limpeza e automação (se necessário, os logs podem ser movidos para armazenamento frio)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Recomenda-se que o acesso à chave (autenticação local) seja desabilitado por segurança. Depois de desabilitar o acesso baseado em chave, o Microsoft Entra ID se torna o único método de acesso, o que permite manter o princípio de privilégio mínimo e o controle granular. ",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
- "text": "Verifique se os discos são realmente necessários, se não: excluir. Se forem necessários, encontre níveis de armazenamento mais baixos ou use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Armazene e gerencie chaves com segurança usando o Azure Key Vault. Evite codificar ou inserir chaves confidenciais no código do aplicativo LLM e recuperá-las com segurança do Azure Key Vault usando identidades gerenciadas",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
- "text": "Considere mover o armazenamento não utilizado para o nível inferior, com regra personalizada - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Gire e expire regularmente as chaves armazenadas no Azure Key Vault para minimizar o risco de acesso não autorizado.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
- "text": "Verifique se o Advisor está configurado para o dimensionamento correto da VM ",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Use tiktoken para entender os tamanhos de token para otimizações de token no modo de conversação",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "verifique pesquisando as Licenças de Categoria de Medidor na Análise de Custos",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "text": "executar o script em todas as VMs do Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- considere implementar uma diretiva se as VMs do Windows forem criadas com frequência",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Siga práticas de codificação segura para evitar vulnerabilidades comuns, como ataques de injeção, cross-site scripting (XSS) ou configurações incorretas de segurança",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
- "text": " isso também pode ser colocado no AHUB se você já tiver licenças https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Configure um processo para atualizar e corrigir regularmente as bibliotecas LLM e outros componentes do sistema",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
- "text": "Consolidar famílias de VM reservadas com opção de flexibilidade (não mais do que 4-5 famílias)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Aderir aos termos de uso, políticas e diretrizes do Azure OpenAI ou de outros LLMs e casos de uso permitidos",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
- "text": "Utilize instâncias reservadas do Azure: esse recurso permite reservar VMs por um período de 1 ou 3 anos, proporcionando uma economia significativa em comparação com os preços do PAYG.",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Entender a diferença no custo de modelos básicos e modelos ajustados e tamanhos de etapa de token",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
- "text": "Somente discos maiores podem ser reservados => 1 TiB -",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Solicitações em lote, sempre que possível, para minimizar a sobrecarga por chamada, o que pode reduzir os custos gerais. Certifique-se de otimizar o tamanho do lote",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
- "text": "Após a otimização do dimensionamento correto",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Configure um sistema de rastreamento de custos que monitore o uso do modelo e use essas informações para ajudar a informar as escolhas do modelo e solicitar tamanhos",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "text": "Verifique se aplicável e aplique a política/alteração https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Defina um limite máximo para o número de tokens por resposta do modelo. Otimize o tamanho para garantir que seja grande o suficiente para uma resposta válida",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "text": "O desconto da peça de licença VM + (ahub + 3YRI) é de cerca de 70% de desconto",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Examine as diretrizes fornecidas sobre como configurar a pesquisa de IA para confiabilidade",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
- "text": "Considere o uso de um VMSS para corresponder à demanda em vez de dimensionamento simples",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Planejar e gerenciar o armazenamento de vetores do AI Search",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
- "text": "Use o autoscaler AKS para corresponder ao uso de clusters (verifique se os requisitos dos pods correspondem ao dimensionador)",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Aplique as práticas do LLMOps para automatizar o gerenciamento do ciclo de vida de seus aplicativos GenAI",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
- "text": "Mover pontos de recuperação para o vault-archive, quando aplicável (Validar)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Avalie o uso de modelos de faturamento - PAYG vs PTU",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "text": "Considere o uso de VMs spot com fallback sempre que possível. Considere o autotermination de clusters.",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Avaliar a qualidade de prompts e aplicativos ao alternar entre versões de modelo",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
- "text": "Funções - Reutilizar conexões",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Avalie, monitore e refine seus aplicativos GenAI para recursos como fundamentação, relevância, precisão, coerência, fluência,",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
- "text": "Funções - Armazenar dados em cache localmente",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Avaliar os resultados do Azure AI Search com base em diferentes parâmetros de pesquisa",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
- "text": "Funções - Partidas a frio - Use a funcionalidade 'Executar do pacote'. Dessa forma, o código é baixado como um único arquivo zip. Isso pode, por exemplo, resultar em melhorias significativas com as funções Javascript, que possuem muitos módulos de nó. Use ferramentas específicas de linguagem para reduzir o tamanho do pacote, por exemplo, aplicativos Javascript que agitam árvores.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Olhe para os modelos de ajuste fino como forma de aumentar a precisão somente quando você tiver tentado outras abordagens básicas, como engenharia rápida e RAG com seus dados",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
- "text": "Funções - Mantenha suas funções aquecidas",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Use técnicas de engenharia rápida para melhorar a precisão das respostas do LLM",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
- "text": "Ao usar o dimensionamento automático com funções diferentes, pode haver um que conduza todo o dimensionamento automático para todos os recursos - considere movê-lo para um plano de consumo separado (e considere um plano mais alto para a CPU)",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Equipe vermelha de seus aplicativos GenAI",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Forneça aos usuários finais opções de pontuação para respostas LLM e acompanhe essas pontuações. ",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
- "text": "Os aplicativos de função em um determinado plano são todos dimensionados juntos, portanto, quaisquer problemas com o dimensionamento podem afetar todos os aplicativos no plano.",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
+ "severity": "Alto",
+ "text": "Considere as práticas de gerenciamento de cotas",
+ "waf": "Otimização de custos"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
- "text": "Sou cobrado por 'tempo de espera'? Essa pergunta geralmente é feita no contexto de uma função C# que faz uma operação assíncrona e aguarda o resultado, por exemplo, aguardar Task.Delay(1000) ou aguardar cliente. GetAsync('http://google.com'). A resposta é sim - o segundo cálculo de GB é baseado na hora de início e término da função e no uso de memória durante esse período. O que realmente acontece ao longo desse tempo em termos de atividade da CPU não é levado em consideração no cálculo. Uma exceção a essa regra é se você estiver usando funções duráveis. Você não é cobrado pelo tempo gasto em espera em funções de orquestrador.aplique técnicas de modelagem de demanda sempre que possível (ambientes de desenvolvimento?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Custar"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
+ "severity": "Média",
+ "text": "Use soluções de balanceador de carga, como gateway baseado em APIM, para balancear carga e capacidade entre serviços e regiões",
+ "waf": "Excelência Operacional"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
- "text": "Frontdoor - Desativar a página inicial padrãoNas configurações do aplicativo do seu aplicativo, defina AzureWebJobsDisableHomepage como true. Isso retornará um 204 (Sem Conteúdo) para o PoP para que apenas os dados de cabeçalho sejam retornados.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "Baixo",
+ "text": "Consulte a arquitetura de aplicativo Web com redundância de zona altamente disponível da linha de base para obter as práticas recomendadas",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "text": "Frontdoor - Rota para algo que não retorna nada. Configure uma Função, Proxy de Função ou adicione uma rota em seu WebApp que retorne 200 (OK) e envie conteúdo nulo ou mínimo. A vantagem disso é que você poderá fazer logout quando for chamado.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Use as camadas Premium e Standard. Esses níveis oferecem suporte a slots de preparo e backups automatizados.",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
- "text": "Considere níveis de arquivamento para dados menos usados",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente (requer a camada Premium v2 ou v3)",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
- "text": "Verifique os tamanhos de disco em que o tamanho não corresponde à camada (ou seja, um disco de 513 GiB pagará um P30 (1TiB) e considere o redimensionamento",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Implementar verificações de integridade",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "text": "Considere usar SSD padrão em vez de Premium ou Ultra sempre que possível",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Consulte as práticas recomendadas de backup e restauração para o Serviço de Aplicativo do Azure",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "text": "Para contas de armazenamento, verifique se a camada escolhida não está somando encargos de transação (pode ser mais barato passar para a próxima camada)",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Implementar práticas recomendadas de confiabilidade do Serviço de Aplicativo do Azure",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "text": "Para ASR, considere o uso de discos SSD padrão se o RPO/RTO e a taxa de transferência de replicação permitirem",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "severity": "Baixo",
+ "text": "Familiarizar-se com como mover um aplicativo do Serviço de Aplicativo para outra região durante um desastre",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
- "text": "Contas de armazenamento: verifique o hot tier e/ou o GRS necessário",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Familiarizar-se com o suporte de confiabilidade no Serviço de Aplicativo do Azure",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "text": "Discos - valide o uso de discos SSD Premium em todos os lugares: por exemplo, não-prod pode trocar para SSD padrão ou SSD Premium sob demanda ",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Verifique se \"Sempre Ativo\" está habilitado para Aplicativos de Função em execução em um plano de serviço de aplicativo",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
- "text": "Crie orçamentos para gerenciar custos e crie alertas que notifiquem automaticamente as partes interessadas sobre anomalias de gastos e riscos de gastos excessivos.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Monitorar instâncias do Serviço de Aplicativo usando verificações de integridade",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
- "text": "Exporte dados de custo para uma conta de armazenamento para análise de dados adicionais.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site usando testes de disponibilidade do Application Insights",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "text": "Controle os custos de um pool SQL dedicado pausando o recurso quando ele não estiver em uso.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
+ "severity": "Baixo",
+ "text": "Usar o teste Application Insights Standard para monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site",
+ "waf": "Fiabilidade"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "text": "Habilite o recurso de pausa automática do Apache Spark sem servidor e defina seu valor de tempo limite de acordo.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use o Cofre de Chaves do Azure para armazenar quaisquer segredos de que o aplicativo precisa. O Cofre de Chaves fornece um ambiente seguro e auditado para armazenar segredos e está bem integrado ao Serviço de Aplicativo por meio do SDK do Cofre de Chaves ou das Referências do Cofre de Chaves do Serviço de Aplicativo.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Usar o Cofre de Chaves para armazenar segredos",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
- "text": "Crie várias definições de pool do Apache Spark de vários tamanhos.",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use uma Identidade Gerenciada para se conectar ao Cofre de Chaves usando o SDK do Cofre de Chaves ou por meio das Referências do Cofre de Chaves do Serviço de Aplicativo.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Usar a Identidade Gerenciada para se conectar ao Cofre de Chaves",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "text": "Adquira unidades de confirmação (SCU) do Azure Synapse por um ano com um plano de pré-compra para economizar nos custos do Azure Synapse Analytics.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Armazene o certificado TLS do Serviço de Aplicativo no Cofre de Chaves.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Use o Cofre de Chaves para armazenar o certificado TLS.",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "text": "Usar VMs spot para trabalhos interruptíveis: são VMs que podem ser licitadas e compradas a um preço com desconto, fornecendo uma solução econômica para cargas de trabalho não críticas.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Os sistemas que processam informações confidenciais devem ser isolados. Para fazer isso, use Planos do Serviço de Aplicativo ou Ambientes do Serviço de Aplicativo separados e considere o uso de assinaturas ou grupos de gerenciamento diferentes.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Isolar sistemas que processam informações confidenciais",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "text": "Dimensionamento correto de todas as VMs",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Os discos locais no Serviço de Aplicativo não são criptografados e os dados confidenciais não devem ser armazenados neles. (Por exemplo: D:\\\\Local e %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Não armazene dados confidenciais no disco local",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "text": "Trocar VM dimensionada com tamanhos normalizados e mais recentes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Para aplicativos Web autenticados, use um Provedor de Identidade bem estabelecido, como o Azure AD ou o Azure AD B2C. Aproveite a estrutura de aplicativo de sua escolha para se integrar a esse provedor ou use o recurso de Autenticação/Autorização do Serviço de Aplicativo.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Usar um provedor de identidade estabelecido para autenticação",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "VMs de dimensionamento correto - comece com o monitoramento do uso abaixo de 5% e, em seguida, trabalhe até 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Implante código no Serviço de Aplicativo a partir de um ambiente controlado e confiável, como um pipeline de implantação de DevOps bem gerenciado e seguro. Isso evita que o código que não foi controlado por versão e verificado para ser implantado a partir de um host mal-intencionado.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Implantar a partir de um ambiente confiável",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "A conteinerização de um aplicativo pode melhorar a densidade da VM e economizar dinheiro no dimensionamento",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Custar"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Desative a autenticação básica para FTP/FTPS e WebDeploy/SCM. Isso desabilita o acesso a esses serviços e impõe o uso de pontos de extremidade protegidos do Azure AD para implantação. Observe que o site do SCM também pode ser aberto usando credenciais do Azure AD.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Desabilitar a autenticação básica",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Sempre que possível, use a Identidade Gerenciada para se conectar aos recursos protegidos do Azure AD. Se isso não for possível, armazene segredos no Cofre de Chaves e conecte-se ao Cofre de Chaves usando uma Identidade Gerenciada.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"severity": "Alto",
- "text": "Familiarize-se com as práticas recomendadas do Key Vault, como recomendações de isolamento, controle de acesso, proteção de dados, backup e registro em log.",
- "waf": "Fiabilidade"
+ "text": "Usar a Identidade Gerenciada para se conectar a recursos",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
- "severity": "Média",
- "text": "O Key Vault é um serviço gerenciado e a Microsoft lidará com o failover dentro e entre regiões. Familiarize-se com a disponibilidade e a redundância do Key Vault.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Onde estiver usando imagens armazenadas no Registro de Contêiner do Azure, extraia-as usando uma Identidade Gerenciada.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Extrair contêineres usando uma identidade gerenciada",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ao definir as configurações de diagnóstico do Serviço de Aplicativo, você pode enviar toda a telemetria para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade de tempo de execução do Serviço de Aplicativo, como logs HTTP, logs de aplicativos, logs de plataforma, ...",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "Média",
- "text": "O conteúdo do cofre de chaves é replicado dentro da região e para uma região secundária a pelo menos 150 milhas de distância, mas dentro da mesma geografia para manter a alta durabilidade de suas chaves e segredos. Familiarize-se com a replicação de dados do Key Vault.",
- "waf": "Fiabilidade"
+ "text": "Enviar logs de tempo de execução do Serviço de Aplicativo para o Log Analytics",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure uma configuração de diagnóstico para enviar o log de atividades para o Log Analytics como o destino central para registro e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso do Serviço de Aplicativo.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "Média",
- "text": "Durante o failover, as configurações e configurações de política de acesso ou firewall não podem ser alteradas. O cofre de chaves estará no modo somente leitura durante o failover. Familiarize-se com as diretrizes de failover do Key Vault.",
- "waf": "Fiabilidade"
+ "text": "Enviar logs de atividade do Serviço de Aplicativo para o Log Analytics",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Controle o acesso à rede de saída usando uma combinação de integração regional de VNet, grupos de segurança de rede e UDR's. O tráfego deve ser roteado para um NVA, como o Firewall do Azure. Certifique-se de monitorar os logs do Firewall.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"severity": "Média",
- "text": "Quando você faz backup de um objeto do cofre de chaves, como um segredo, uma chave ou um certificado, a operação de backup baixa o objeto como um blob criptografado. Esse blob não pode ser descriptografado fora do Azure. Para obter dados utilizáveis desse blob, você deve restaurar o blob em um cofre de chaves dentro da mesma assinatura do Azure e da mesma geografia do Azure. Familiarize-se com as diretrizes de backup e restauração do Key Vault.",
- "waf": "Fiabilidade"
+ "text": "O acesso à rede de saída deve ser controlado",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Você pode fornecer um IP de saída estável usando a integração de rede virtual e um gateway NAT de rede virtual ou um NVA como o Firewall do Azure. Isso permite que a parte receptora permita uma lista com base no IP, caso seja necessário. Observe que, para comunicações com os Serviços do Azure, geralmente não há necessidade de depender do endereço IP e mecânicas como Pontos de Extremidade de Serviço devem ser usadas. (Além disso, o uso de pontos de extremidade privados na extremidade de recebimento evita que o SNAT aconteça e fornece um intervalo de IP de saída estável.)",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
+ "severity": "Baixo",
+ "text": "Garantir um IP estável para comunicações de saída para endereços de Internet",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Controle o acesso à rede de entrada usando uma combinação de Restrições de Acesso do Serviço de Aplicativo, Pontos de Extremidade de Serviço ou Pontos de Extremidade Privados. Diferentes restrições de acesso podem ser necessárias e configuradas para o próprio aplicativo Web e o site do SCM.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "Alto",
- "text": "Se você quiser proteção contra exclusão acidental ou mal-intencionada de seus segredos, configure recursos de proteção de exclusão reversível e limpeza em seu cofre de chaves.",
- "waf": "Fiabilidade"
+ "text": "O acesso à rede de entrada deve ser controlado",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "Baixo",
- "text": "Os recursos excluídos temporariamente do Key Vault são retidos por um período definido de 90 dias corridos. Familiarize-se com as diretrizes de exclusão reversível do Key Vault.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Proteja-se contra tráfego de entrada mal-intencionado usando um Firewall de Aplicativo Web, como o Gateway de Aplicativo ou o Azure Front Door. Certifique-se de monitorar os logs do WAF.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Usar um WAF na frente do Serviço de Aplicativo",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Baixo",
- "text": "Entenda as limitações de backup do Key Vault. O Key Vault não dá suporte à capacidade de fazer backup de mais de 500 versões anteriores de um objeto de chave, segredo ou certificado. A tentativa de fazer backup de uma chave, segredo ou objeto de certificado pode resultar em um erro. Não é possível excluir versões anteriores de uma chave, segredo ou certificado.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Certifique-se de que o WAF não pode ser ignorado bloqueando o acesso apenas ao WAF. Use uma combinação de Restrições de Acesso, Pontos de Extremidade de Serviço e Pontos de Extremidade Privados.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Evite que o WAF seja ignorado",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "Baixo",
- "text": "Atualmente, o Key Vault não fornece uma maneira de fazer backup de um cofre de chaves inteiro em uma única operação e chaves, segredos e certificados devem ser copiados individualmente. Familiarize-se com as diretrizes de backup e restauração do Key Vault.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Defina a política TLS mínima como 1.2 na configuração do Serviço de Aplicativo.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Definir a política TLS mínima como 1.2",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Configure o Serviço de Aplicativo para usar somente HTTPS. Isso faz com que o Serviço de Aplicativo redirecione de HTTP para HTTPS. Considere fortemente o uso de HTTP Strict Transport Security (HSTS) em seu código ou a partir de seu WAF, que informa aos navegadores que o site só deve ser acessado usando HTTPS.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Usar somente HTTPS",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
- "severity": "Média",
- "text": "A proteção contra limpeza é recomendada ao usar chaves para criptografia para evitar a perda de dados. A proteção contra limpeza é um comportamento opcional do Key Vault e não está habilitada por padrão. A proteção contra limpeza só pode ser habilitada depois que a exclusão reversível estiver habilitada. Ele pode ser ativado via CLI, PowerShell ou Portal.",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Não use curingas em sua configuração do CORS, pois isso permite que todas as origens acessem o serviço (derrotando assim o propósito do CORS). Especificamente, permita apenas as origens que você espera poder acessar o serviço.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Curingas não devem ser usados para CORS",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
- "severity": "Média",
- "text": "O RBAC é recomendado para controlar o acesso ao cofre de chaves. Familiarize-se com as diretrizes de controle de acesso do Key Vault.",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "A depuração remota não deve ser ativada na produção, pois isso abre portas adicionais no serviço, o que aumenta a superfície de ataque. Observe que o serviço ativa a depuração remota automaticamente após 48 horas.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Desativar a depuração remota",
"waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Habilite o Defender para o Serviço de Aplicativo. Isso (entre outras ameaças) detecta comunicações com endereços IP mal-intencionados conhecidos. Analise as recomendações do Defender for App Service como parte de suas operações.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"severity": "Média",
- "text": "Aproveite o Manual de Resiliência de FTA para o Azure Data Factory",
- "waf": "Fiabilidade"
+ "text": "Habilitar o Defender for Cloud - Defender for App Service",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "Alto",
- "text": "Usar pipelines redundantes de zona em regiões que oferecem suporte a zonas de disponibilidade",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "O Azure fornece proteção contra DDoS Basic em sua rede, que pode ser aprimorada com recursos inteligentes de DDoS Standard que aprendem sobre padrões normais de tráfego e podem detectar comportamentos incomuns. O DDoS Standard se aplica a uma Rede Virtual, portanto, ele deve ser configurado para o recurso de rede na frente do aplicativo, como o Application Gateway ou um NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
+ "severity": "Média",
+ "text": "Habilitar o padrão de proteção DDOS na rede virtual WAF",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as por uma rede virtual do Registro de Contêiner do Azure usando seu ponto de extremidade privado e a configuração do aplicativo 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"severity": "Média",
- "text": "Usar DevOps para fazer backup dos modelos ARM com a integração Github/Azure DevOps ",
- "waf": "Fiabilidade"
+ "text": "Extrair contêineres por uma rede virtual",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Realizar um teste de penetração na aplicação web seguindo as regras de teste de penetração de engajamento.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"severity": "Média",
- "text": "Certifique-se de replicar as VMs do Self-Hosted Integration Runtime em outra região ",
- "waf": "Fiabilidade"
+ "text": "Realizar um teste de penetração",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"severity": "Média",
- "text": "Certifique-se de replicar ou duplicar sua rede na região irmã. Você tem que fazer uma cópia do seu Vnet em outra região",
- "waf": "Fiabilidade"
+ "text": "Implantar código validado",
+ "waf": "Segurança"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "Se seus pipelines do ADF usarem o Cofre de Chaves, você não precisará fazer nada para replicar o Cofre de Chaves. O Cofre de Chaves é um serviço gerenciado e a Microsoft cuida dele para você",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
- "severity": "Baixo",
- "text": "Se estiver usando a integração do Keyvault, use o SLA do Keyvault para entender sua disponibilidade",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportadas.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "Alto",
+ "text": "Use plataformas, linguagens, protocolos e frameworks atualizados",
+ "waf": "Segurança"
},
{
"arm-service": "Microsoft.Devices/provisioningServices",
@@ -9225,193 +9504,73 @@
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
- "severity": "Baixo",
- "text": "Se necessário, considere usar hosts dedicados do Azure para nós AKS",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "Alto",
- "text": "Usar discos efêmeros do sistema operacional",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
- "severity": "Alto",
- "text": "Para discos não efêmeros, use IOPS altos e discos maiores do sistema operacional para os nós ao executar muitos pods/nó, pois requer alto desempenho para executar vários pods e gerará logs enormes com limites de rotação de log AKS padrão",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "Baixo",
- "text": "Para a opção de armazenamento de hiperdesempenho, use Ultra Disks no AKS",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
- "severity": "Média",
- "text": "Evite manter o estado no cluster e armazene dados fora (AzStorage, AzSQL, Cosmos, etc)",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
- "severity": "Média",
- "text": "Se estiver usando o AzFiles Standard, considere o AzFiles Premium e/ou ANF por motivos de desempenho",
- "waf": "Desempenho"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
- "severity": "Média",
- "text": "Se estiver usando Discos e AZs do Azure, considere ter nodepools dentro de uma zona para disco LRS com VolumeBindingMode:WaitForFirstConsumer para provisionar armazenamento na zona direita ou use o disco ZRS para nodepools abrangendo várias zonas",
- "waf": "Desempenho"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "Alto",
- "text": "Permitir que 2 réplicas tenham 99,9% de disponibilidade para operações de leitura",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "Média",
- "text": "Permitir que 3 réplicas tenham 99,9% de disponibilidade para operações de leitura/gravação",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
- "severity": "Alto",
- "text": "Aproveite as zonas de disponibilidade habilitando réplicas de leitura e/ou gravação",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "Média",
- "text": "Para redução regional, crie manualmente serviços em 2 ou mais regiões para a Pesquisa, pois não fornece um método automatizado de replicação de índices de pesquisa entre regiões geográficas",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
- "severity": "Média",
- "text": "Para sincronizar dados em vários serviços: Use indexadores para atualizar conteúdo em vários serviços ou Use APIs REST para enviar atualizações de conteúdo em vários serviços",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
- "severity": "Média",
- "text": "Usar o Gerenciador de Tráfego do Azure para coordenar solicitações",
- "waf": "Fiabilidade"
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "Baixo",
+ "text": "Se necessário, considere usar hosts dedicados do Azure para nós AKS",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"severity": "Alto",
- "text": "Backup e restauração de um índice de pesquisa cognitiva do Azure. Use este código de exemplo para fazer backup da definição de índice e instantâneo em uma série de arquivos Json",
- "waf": "Fiabilidade"
+ "text": "Usar discos efêmeros do sistema operacional",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
"severity": "Alto",
- "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO",
- "waf": "Fiabilidade"
+ "text": "Para discos não efêmeros, use IOPS altos e discos maiores do sistema operacional para os nós ao executar muitos pods/nó, pois requer alto desempenho para executar vários pods e gerará logs enormes com limites de rotação de log AKS padrão",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "severity": "Alto",
- "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
+ "severity": "Baixo",
+ "text": "Para a opção de armazenamento de hiperdesempenho, use Ultra Disks no AKS",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
- "severity": "Alto",
- "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
+ "severity": "Média",
+ "text": "Evite manter o estado no cluster e armazene dados fora (AzStorage, AzSQL, Cosmos, etc)",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
- "severity": "Alto",
- "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3",
- "waf": "Fiabilidade"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
+ "severity": "Média",
+ "text": "Se estiver usando o AzFiles Standard, considere o AzFiles Premium e/ou ANF por motivos de desempenho",
+ "waf": "Desempenho"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
"severity": "Média",
- "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico",
- "waf": "Operações"
+ "text": "Se estiver usando Discos e AZs do Azure, considere ter nodepools dentro de uma zona para disco LRS com VolumeBindingMode:WaitForFirstConsumer para provisionar armazenamento na zona direita ou use o disco ZRS para nodepools abrangendo várias zonas",
+ "waf": "Desempenho"
},
{
"arm-service": "microsoft.network/frontdoors",
@@ -9817,170 +9976,11 @@
"severity": "Alto",
"text": "Ao usar o Front Door com origem como serviços de aplicativos, considere bloquear o tráfego para serviços de aplicativos somente por meio do Azure Front Door usando restrições de acesso. ",
"waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "O Hub de Eventos do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "Baixo",
- "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Os namespaces dos Hubs de Eventos do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace dos Hubs de Eventos para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS. Se um namespace de Hubs de Eventos exigir uma versão mínima do TLS, todas as solicitações feitas com uma versão mais antiga falharão. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Quando você cria um namespace de Hubs de Eventos, uma regra de política chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Evite usar conta root quando não for necessário",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "As identidades gerenciadas para recursos do Azure podem autorizar o acesso a recursos dos Hubs de Eventos usando credenciais do Azure AD de aplicativos em execução em VMs (Máquinas Virtuais) do Azure, aplicativos de Função, Conjuntos de Dimensionamento de Máquina Virtual e outros serviços. Usando identidades gerenciadas para recursos do Azure junto com a autenticação do Azure AD, você pode evitar o armazenamento de credenciais com seus aplicativos executados na nuvem. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Hub de Eventos do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre de Chaves do Azure ou em um serviço equivalente",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Hub de Eventos do Azure. As permissões no Hub de Eventos do Azure podem e devem ter o escopo definido para o nível de recurso individual, por exemplo, grupo de consumidores, entidade de hub de eventos, namespaces de hub de eventos, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
- "severity": "Alto",
- "text": "Usar RBAC do plano de dados de privilégios mínimos",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Os logs de recursos do Hub de Eventos do Azure incluem logs operacionais, logs de rede virtual e logs de Kafka. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para todas as operações de acesso ao plano de dados (como eventos de envio ou recebimento) nos Hubs de Eventos.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Habilite o registro em log para investigação de segurança. Use o Azure Monitor para capturar métricas e logs como logs de recursos, logs de auditoria de tempo de execução e logs Kafka",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Por padrão, o Hub de Eventos do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Hub de Eventos do Azure percorra a rede de backbone da Microsoft. Além disso, você deve desabilitar os pontos de extremidade públicos se eles não forem usados. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Considere o uso de pontos de extremidade privados para acessar o Hub de Eventos do Azure e desabilitar o acesso à rede pública quando aplicável.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Com o firewall IP, você pode restringir ainda mais o ponto de extremidade público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Considere permitir apenas o acesso ao namespace do Hub de Eventos do Azure a partir de endereços IP ou intervalos específicos",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Segurança"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Aproveite o Manual de Resilência do FTA",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": " Isso será ativado automaticamente para um novo namespace de EH criado a partir do portal com SKUs Premium, Dedicado ou Standard em uma região habilitada para região. Os metadados do EH e os próprios dados do evento são replicados entre zonas",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
- "severity": "Alto",
- "text": "Aproveite as zonas de disponibilidade, se aplicável regionalmente",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Use os SKUs Premium ou Dedicado para desempenho previsível",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "O recurso interno de recuperação de desastres geográficos, quando habilitado, garante que toda a configuração de um namespace (Hubs de Eventos, Grupos de Consumidores e configurações) seja replicada continuamente de um namespace primário para um namespace secundário e permite uma movimentação de failover única do primário para o secundário a qualquer momento. O recurso Ativo/Passivo foi projetado para facilitar a recuperação e o abandono de uma região do Azure com falha sem precisar alterar as configurações do aplicativo",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
- "severity": "Alto",
- "text": "Planejar a recuperação de desastres geográficos usando a configuração passiva ativa",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Deve ser usado para configurações de DR em que uma interrupção ou perda de dados de eventos na região derrubada não pode ser tolerada. Para esses casos, siga as diretrizes de replicação e não use o recurso interno de recuperação de desastres geográficos (ativo/passivo). Com Ativo/Ativo, mantenha vários Hubs de Eventos em diferentes regiões e namespaces, e os eventos serão replicados entre os hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Para aplicativos críticos para os negócios, use a configuração ativa",
- "waf": "Fiabilidade"
- },
- {
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
- "severity": "Média",
- "text": "Projetar Hubs de Eventos Resilientes",
- "waf": "Fiabilidade"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
@@ -10003,15 +10003,15 @@
"name": "Abrir"
},
{
- "description": "Essa verificação foi verificada e não há outros itens de ação associados a ela",
+ "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
"name": "Cumprido"
},
{
"description": "Recomendação compreendida, mas não necessária pelos requisitos atuais",
- "name": "Risco aceito"
+ "name": "Não é necessário"
},
{
- "description": "Não aplicável ao projeto atual",
+ "description": "Não aplicável para o projeto atual",
"name": "N/A"
}
]
diff --git a/checklists/waf_checklist.zh-Hant.json b/checklists/waf_checklist.zh-Hant.json
index 8447891cf..bff3f9ce8 100644
--- a/checklists/waf_checklist.zh-Hant.json
+++ b/checklists/waf_checklist.zh-Hant.json
@@ -1,54 +1,54 @@
{
"items": [
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
+ "service": "IoT",
"severity": "高",
- "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃",
+ "text": "利用可用區（如果區域適用）（這是自動啟用的）",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "severity": "高",
- "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
+ "severity": "中等",
+ "text": "請注意 Microsoft 發起的故障轉移。Microsoft 在極少數情況下會執行這些操作，以將所有IoT中心從受影響的區域故障轉移到相應的異地配對區域。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
+ "service": "IoT",
"severity": "高",
"text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
+ "service": "IoT",
"severity": "高",
- "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
+ "text": "瞭解如何觸發手動故障轉移。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "Device Provisioning Service Review",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
- "severity": "中等",
- "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼",
- "waf": "操作"
+ "arm-service": "Microsoft.Devices/IotHubs",
+ "checklist": "IoT Hub Review",
+ "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
+ "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
+ "service": "IoT",
+ "severity": "高",
+ "text": "瞭解如何在故障轉移後進行故障回復。",
+ "waf": "可靠性"
},
{
"arm-service": "Microsoft.AppPlatform/Spring",
@@ -131,3860 +131,3843 @@
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
- "text": "Azure Monitor 中的數據收集規則 -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "成本"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
+ "severity": "高",
+ "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
- "text": "檢查未找到底層數據源的備份實例",
- "waf": "成本"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
+ "severity": "高",
+ "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "VM",
- "text": "刪除或存檔未關聯的服務（磁碟、網卡、IP 位址等）",
- "waf": "成本"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
+ "severity": "高",
+ "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
- "text": "考慮在網站恢復存儲和非任務關鍵型應用程式的備份之間取得良好的平衡",
- "waf": "成本"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
+ "severity": "高",
+ "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
- "text": "檢查 40 個不同 Log Analytics 工作區之間的支出和節省機會 - 對非生產工作區使用不同的保留和數據收集 - 創建每日上限以實現意識和層大小調整 - 如果確實設置了每日上限，除了在達到上限時創建警報外，請確保還創建警報規則，以便在達到某個百分比（例如 90%）時收到通知。- 如果可能，考慮工作空間改造 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "成本"
+ "arm-service": "Microsoft.Devices/provisioningServices",
+ "checklist": "Device Provisioning Service Review",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
+ "severity": "中等",
+ "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Cost Optimization Checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
- "text": "強制執行清除日誌策略和自動化（如果需要，可以將記錄移至冷存儲）",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "高",
+ "text": "熟悉 Key Vault 的最佳實踐，例如隔離建議、訪問控制、數據保護、備份和日誌記錄。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
- "text": "檢查磁碟是否確實需要，如果不是：刪除。如果需要，請尋找較低的儲存層或使用備份 -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "Key Vault 是一項託管服務，Microsoft 將處理區域內和區域之間的故障轉移。熟悉 Key Vault 的可用性和冗餘。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
- "text": "考慮使用自定義規則將未使用的存儲移動到較低層 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "密鑰保管庫的內容將在區域內複製到至少 150 英里外的次要區域，但要在同一地理位置內，以保持金鑰和機密的高持久性。熟悉 Key Vault 的數據複製。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
- "text": "確保 advisor 配置為適合 VM 大小調整",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "在故障轉移期間，無法訪問策略或防火牆配置和設置。在故障轉移期間，金鑰保管庫將處於只讀模式。熟悉 Key Vault 的故障轉移指南。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "description": "通過在成本分析系統中搜索計量類別許可證進行檢查",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
- "text": "在所有 Windows VM 上運行腳本 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server - 如果頻繁創建 Windows VM，請考慮實施策略",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "備份金鑰保管庫物件（例如機密、金鑰或證書）時，備份操作會將該物件下載為加密的 blob。無法在 Azure 外部解密此 blob。若要從此 blob 獲取可用數據，必須將 blob 還原到同一 Azure 訂閱和 Azure 地理位置中的金鑰保管庫中。熟悉 Key Vault 的備份和還原指南。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
- "text": "如果您已經擁有許可證，也可以將其置於 AHUB https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "高",
+ "text": "如果要防止意外或惡意刪除機密，請在密鑰保管庫上配置軟刪除和清除保護功能。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
- "text": "使用靈活性選項（不超過 4-5 個系列）整合保留的 VM 系列",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
+ "severity": "低",
+ "text": "Key Vault 的軟刪除資源將保留 90 個日曆日的固定期限。熟悉 Key Vault 的軟刪除指南。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
- "text": "利用 Azure 預留實例：此功能允許將 VM 預留 1 年或 3 年，與 PAYG 價格相比，可顯著節省成本。",
- "waf": "成本"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
- "text": "只能保留較大的磁碟 => 1 TiB -",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "低",
+ "text": "瞭解 Key Vault 的備份限制。Key Vault 不支援備份超過 500 個金鑰、機密或證書對象的過去版本。嘗試備份金鑰、金鑰或證書物件可能會導致錯誤。無法刪除金鑰、金鑰或證書的早期版本。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
- "text": "調整大小優化后",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
+ "severity": "低",
+ "text": "Key Vault 目前不提供在單個操作中備份整個 Key Vault 的方法，並且必須單獨備份密鑰、機密和證書。熟悉 Key Vault 的備份和還原指南。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Sql/servers",
- "checklist": "Cost Optimization Checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
- "text": "檢查是否適用並強制執行策略/更改 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "使用金鑰進行加密時，建議使用清除保護，以防止數據丟失。清除保護是一種可選的 Key Vault 行為，預設情況下未啟用。只有在啟用軟刪除後，才能啟用清除保護。可以通過 CLI、PowerShell 或 Portal 打開它。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
- "text": "虛擬機 + 許可證部分折扣 （ahub + 3YRI） 約為 70% 的折扣",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Key Vault",
+ "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
+ "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "建議使用 RBAC 來控制對 Key Vault 的訪問。熟悉 Key Vault 的訪問控制指南。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
- "text": "考慮使用 VMSS 來滿足需求，而不是按比例調整",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure 服務總線高級版提供靜態數據加密。如果您使用自己的金鑰，則數據仍使用 Microsoft 管理的金鑰進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
+ "severity": "低",
+ "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Cost Optimization Checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
- "text": "使用 AKS 自動縮放程式符合群集使用方式（確保 Pod 要求與縮放程式符合）",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "用戶端應用程式與 Azure 服務總線命名空間之間的通信使用傳輸層安全性 （TLS） 進行加密。Azure 服務總線命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將服務總線命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "對請求強制實施最低要求的傳輸層安全性 （TLS） 版本",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
- "text": "將恢復點移至保管庫存檔（如果適用）（驗證）",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "創建服務總線命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的 SAS 規則。此策略具有整個命名空間的 Manage 許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。 建議使用 AAD 作為 RBAC 的身份驗證提供程式。",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "避免在不需要時使用 root 帳戶",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
- "text": "請考慮盡可能使用帶回退功能的現成 VM。考慮群集的自動終止。",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "在 Azure 應用服務應用程式內或在啟用了 Azure 資源支援的託管實體的虛擬機中運行的服務總線用戶端應用不需要處理 SAS 規則和密鑰或任何其他存取權杖。用戶端應用程式只需要 Service Bus Messaging 命名空間的終結點位址。",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "如果可能，應用程式應使用託管標識向 Azure 服務總線進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中使用存儲憑據（SAS、服務主體憑據）",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
- "text": "功能 - 重用連接",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "創建許可權時，請對用戶端對 Azure 服務總線的訪問提供精細控制。Azure 服務總線中的許可權可以而且應該限定為單個資源級別，例如佇列、主題或訂閱。",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "severity": "高",
+ "text": "使用最低許可權數據平面 RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
- "text": "函數 - 本地快取資料",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "Azure 服務總線資源日誌包括操作日誌、虛擬網路和IP篩選日誌。運行時審核日誌捕獲服務總線中各種數據平面訪問操作（例如發送或接收消息）的聚合診斷資訊。",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "啟用記錄以進行安全調查。使用 Azure Monitor 追蹤資源紀錄和執行時審核紀錄（目前僅在進階層中可用 ）",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
- "text": "函數 - 冷啟動 - 使用“從包運行”功能。這樣，代碼將下載為單個 zip 檔。例如，這可以顯著改進具有大量節點模組的 Javascript 函數。使用特定於語言的工具來減小包大小，例如，搖樹 Javascript 應用程式。",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "成本"
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "默認情況下，Azure 服務總線具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路與 Azure 服務總線之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公有終端節點，則應禁用這些終端節點。",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "請考慮使用專用終結點訪問 Azure 服務總線，並在適用時禁用公用網路訪問。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
- "text": "功能 - 保持功能溫暖",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "Service Bus Review Checklist",
+ "description": "使用IP防火牆，您可以將公有終端節點進一步限製為僅一組 IPv4 位址或 CIDR（無類域間路由）表示法的 IPv4 位址範圍。",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
+ "severity": "中等",
+ "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 服務總線命名空間",
"training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "成本"
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
- "text": "使用具有不同功能的自動縮放時，可能會有一個資源驅動所有資源的所有自動縮放 - 請考慮將其移動到單獨的消耗計劃（並考慮更高的 CPU 計劃）",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
+ "severity": "低",
+ "text": "有關最佳實踐，請參閱基線高可用性區域冗餘 Web 應用程式體系結構",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
- "text": "給定計劃中的函數應用都縮放在一起，因此縮放的任何問題都可能影響計劃中的所有應用。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "使用高級層和標準層。這些層支援暫存槽和自動備份。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Cost Optimization Checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
- "text": "我需要為「等待時間」付費嗎？這個問題通常是在執行異步操作並等待結果的 C# 函數的上下文中提出的，例如 await Task.Delay（1000） 或 await client。GetAsync（'http：//google.com'）。答案是肯定的 - GB 秒計算基於函數的開始和結束時間以及該時間段內的記憶體使用方式。在這段時間內實際發生的CPU活動未計入計算。此規則的一個例外是，如果使用的是持久函數。您無需為在業務流程協調程式函數中等待所花費的時間付費。在可能的情況下應用需求塑造技術（開發環境？）https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
+ "severity": "高",
+ "text": "利用區域適用的可用性區域（需要高級 v2 或 v3 層）",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
- "text": "Frontdoor - 關閉預設主頁在應用的應用程式設置中，將 AzureWebJobsDisableHomepage 設置為 true。這將向PoP返回204（無內容），因此僅返回標頭數據。",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Cost Optimization Checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
- "text": "Frontdoor - 路由到不返回任何內容的內容。設置函數、函數代理，或在 WebApp 中添加返回 200 （OK） 且不發送內容或發送最少內容的路由。這樣做的好處是您可以在調用時註銷。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "實施健康檢查",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
- "text": "考慮為使用較少的數據存檔層",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
+ "severity": "高",
+ "text": "請參閱 Azure 應用服務的備份和還原最佳做法",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
- "text": "檢查大小與層不匹配的磁碟大小（即 513 GiB 磁碟將支付 P30 （1TiB） 並考慮調整大小",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
+ "severity": "高",
+ "text": "實現 Azure 應用服務可靠性最佳做法",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
- "text": "盡可能考慮使用標準 SSD，而不是 Premium 或 Ultra",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "severity": "低",
+ "text": "熟悉如何在災難期間將應用服務應用移動到另一個區域",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
- "text": "對於存儲帳戶，請確保所選層不會增加事務費用（移動到下一層可能會更便宜）",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
+ "severity": "高",
+ "text": "熟悉 Azure 應用服務中的可靠性支援",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Cost Optimization Checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
- "text": "對於 ASR，如果 RPO/RTO 和複製輸送量允許，請考慮使用標準 SSD 磁碟",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "確保為在應用服務計劃上運行的函數應用啟用“Always On”",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Cost Optimization Checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
- "text": "存儲帳戶：檢查熱層和/或 GRS 必填",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "使用運行狀況檢查監視應用服務實例",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
- "text": "磁碟 - 驗證高級 SSD 磁碟在任何地方的使用方式：例如，非生產磁碟可以交換到標準 SSD 或按需高級 SSD",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "使用 Application Insights 可用性測試監視 Web 應用或網站的可用性和回應能力",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
- "text": "創建預算以管理成本並創建警報，自動通知利益相關者支出異常和超支風險。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
+ "severity": "低",
+ "text": "使用 Application Insights 標準測試監視 Web 應用或網站的可用性和回應能力",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
- "text": "將成本數據匯出到存儲帳戶以進行其他數據分析。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用 Azure Key Vault 儲存應用程式所需的任何機密。 Key Vault 為儲存機密提供安全且經過審核的環境，並通過 Key Vault SDK 或應用服務 Key Vault 引用與應用服務很好地集成。",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "高",
+ "text": "使用 Key Vault 儲存機密",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
- "text": "通過在不使用資源時暫停資源來控制專用 SQL 池的成本。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用託管標識通過 Key Vault SDK 或透過應用服務 Key Vault 引用連接到 Key Vault。",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
+ "severity": "高",
+ "text": "使用託管標識連接到 Key VaultUse Managed Identity to connect to Key Vault",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
- "text": "啟用無伺服器 Apache Spark 自動暫停功能，並相應地設置超時值。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "將應用服務 TLS 證書存儲在 Key Vault 中。",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
+ "severity": "高",
+ "text": "使用 Key Vault 儲存 TLS 證書。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
- "text": "創建多個不同大小的 Apache Spark 池定義。",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "處理敏感信息的系統應隔離。 為此，請使用單獨的應用服務計劃或應用服務環境，並考慮使用不同的訂閱或管理組。",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "隔離處理敏感信息的系統",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
- "checklist": "Cost Optimization Checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
- "text": "使用預購計劃購買為期一年的 Azure Synapse 提交單元 （SCU），以節省 Azure Synapse Analytics 成本。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "應用服務上的本地磁碟未加密，敏感數據不應存儲在這些磁碟上。 （例如：D：\\\\Local 和 %TMP%）。",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "不要將敏感數據存儲在本地磁碟上",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
- "text": "將現成 VM 用於可中斷作業：這些 VM 可以以折扣價競標和購買，為非關鍵工作負載提供經濟高效的解決方案。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "對於經過身份驗證的 Web 應用程式，請使用成熟的標識提供者，例如 Azure AD 或 Azure AD B2C。 利用所選的應用程式框架與此提供程式整合，或使用應用服務身份驗證/授權功能。",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
+ "severity": "中等",
+ "text": "使用已建立的身份提供程式進行身份驗證",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
- "text": "合理調整所有 VM 的大小",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "將代碼從受控且受信任的環境（例如管理良好且安全的 DevOps 部署管道）部署到應用服務。這樣可以避免未經版本控制和驗證從惡意主機部署的代碼。",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
+ "severity": "高",
+ "text": "從受信任的環境部署",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
- "text": "將 VM 大小與規範化大小和最新大小交換",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "成本"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "調整 VM 大小 - 從低於 5% 的監視使用率開始，然後工作到 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "禁用 FTP/FTPS 和 WebDeploy/SCM 的基本身份驗證。 這將禁止訪問這些服務，並強制使用 Azure AD 安全終結點進行部署。 請注意，還可以使用 Azure AD 憑據打開 SCM 網站。",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
+ "severity": "高",
+ "text": "禁用基本身份驗證",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Cost Optimization Checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
- "text": "容器化應用程式可以提高 VM 密度並節省擴展成本",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "成本"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "如果可能，請使用託管標識連接到 Azure AD 受保護的資源。 如果無法做到這一點，請將機密存儲在 Key Vault 中，並改用託管標識連接到 Key Vault。",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
+ "severity": "高",
+ "text": "使用託管標識連接到資源",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用託管標識拉取這些映像。",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"severity": "高",
- "text": "熟悉 Key Vault 的最佳實踐，例如隔離建議、訪問控制、數據保護、備份和日誌記錄。",
- "waf": "可靠性"
+ "text": "使用託管標識拉取容器",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "通過配置應用服務的診斷設置，可以將所有遙測數據發送到Log Analytics，作為日誌記錄和監視的中心目標。這允許你監視應用服務的運行時活動，例如 HTTP 日誌、應用程式日誌、平臺日誌等。",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"severity": "中等",
- "text": "Key Vault 是一項託管服務，Microsoft 將處理區域內和區域之間的故障轉移。熟悉 Key Vault 的可用性和冗餘。",
- "waf": "可靠性"
+ "text": "將應用服務運行時日誌發送到Log Analytics",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "設置診斷設置，將活動日誌發送到Log Analytics，作為日誌記錄和監視的中心目標。這樣，你就可以監視應用服務資源本身上的控制平面活動。",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"severity": "中等",
- "text": "密鑰保管庫的內容將在區域內複製到至少 150 英里外的次要區域，但要在同一地理位置內，以保持金鑰和機密的高持久性。熟悉 Key Vault 的數據複製。",
- "waf": "可靠性"
+ "text": "將應用服務活動日誌發送到Log Analytics",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用區域 VNet 集成、網路安全組和 UDR 的組合來控制出站網路訪問。 流量應路由到 NVA，例如 Azure 防火牆。 確保監控防火牆的日誌。",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"severity": "中等",
- "text": "在故障轉移期間，無法訪問策略或防火牆配置和設置。在故障轉移期間，金鑰保管庫將處於只讀模式。熟悉 Key Vault 的故障轉移指南。",
- "waf": "可靠性"
+ "text": "應控制出站網路訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
- "severity": "中等",
- "text": "備份金鑰保管庫物件（例如機密、金鑰或證書）時，備份操作會將該物件下載為加密的 blob。無法在 Azure 外部解密此 blob。若要從此 blob 獲取可用數據，必須將 blob 還原到同一 Azure 訂閱和 Azure 地理位置中的金鑰保管庫中。熟悉 Key Vault 的備份和還原指南。",
- "waf": "可靠性"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "可以使用 VNet 集成並使用 VNet NAT 閘道或 NVA（如 Azure 防火牆）來提供穩定的出站 IP。 這允許接收方根據需要根據IP列出允許清單。 請注意，對於與 Azure 服務的通信，通常不需要依賴於 IP 位址，應改用服務終結點等機制。 （此外，在接收端使用專用終結點可避免發生 SNAT，並提供穩定的出站 IP 範圍。",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
+ "severity": "低",
+ "text": "確保與互聯網位址的出站通信具有穩定的IP",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用應用服務訪問限制、服務終結點或專用終結點的組合來控制入站網路訪問。對於 Web 應用本身和 SCM 網站，可能需要和配置不同的訪問限制。",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"severity": "高",
- "text": "如果要防止意外或惡意刪除機密，請在密鑰保管庫上配置軟刪除和清除保護功能。",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
- "severity": "低",
- "text": "Key Vault 的軟刪除資源將保留 90 個日曆日的固定期限。熟悉 Key Vault 的軟刪除指南。",
- "waf": "可靠性"
+ "text": "應控制入站網路訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "低",
- "text": "瞭解 Key Vault 的備份限制。Key Vault 不支援備份超過 500 個金鑰、機密或證書對象的過去版本。嘗試備份金鑰、金鑰或證書物件可能會導致錯誤。無法刪除金鑰、金鑰或證書的早期版本。",
- "waf": "可靠性"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用 Web 應用程式防火牆（如應用程式閘道或 Azure Front Door）防範惡意入站流量。 請務必監控 WAF 的日誌。",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
+ "severity": "高",
+ "text": "在應用服務前面使用 WAF",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
- "severity": "低",
- "text": "Key Vault 目前不提供在單個操作中備份整個 Key Vault 的方法，並且必須單獨備份密鑰、機密和證書。熟悉 Key Vault 的備份和還原指南。",
- "waf": "可靠性"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "確保僅鎖定對 WAF 的訪問，從而無法繞過 WAF。 結合使用訪問限制、服務終結點和專用終結點。",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
+ "severity": "高",
+ "text": "避免繞過 WAF",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "在應用服務配置中將最低 TLS 策略設置為 1.2。",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"severity": "中等",
- "text": "使用金鑰進行加密時，建議使用清除保護，以防止數據丟失。清除保護是一種可選的 Key Vault 行為，預設情況下未啟用。只有在啟用軟刪除後，才能啟用清除保護。可以通過 CLI、PowerShell 或 Portal 打開它。",
- "waf": "可靠性"
+ "text": "將最低 TLS 策略設置為 1.2",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Key Vault",
- "graph": "resources| where type =~ 'microsoft.keyvault/vaults' | extend compliant = (properties.enableRbacAuthorization == true) | distinct id, compliant",
- "guid": "d0642c1c-312b-4116-94ab-439e1c836819",
- "link": "https://learn.microsoft.com/azure/key-vault/general/rbac-guide?tabs=azure-cli",
- "service": "Key Vault",
- "severity": "中等",
- "text": "建議使用 RBAC 來控制對 Key Vault 的訪問。熟悉 Key Vault 的訪問控制指南。",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "將應用服務配置為僅使用 HTTPS。 這會導致應用服務從 HTTP 重定向到 HTTPS。 強烈建議在代碼或 WAF 中使用 HTTP 嚴格傳輸安全性 （HSTS），這會通知瀏覽器只能使用 HTTPS 訪問網站。",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
+ "severity": "高",
+ "text": "僅使用 HTTPS",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
- "severity": "中等",
- "text": "確保使用的是應用程式閘道 v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "不要在 CORS 配置中使用通配符，因為這允許所有源訪問服務（從而破壞 CORS 的目的）。具體而言，僅允許您希望能夠訪問服務的源。",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
+ "severity": "高",
+ "text": "不得將通配符用於 CORS",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
- "severity": "中等",
- "text": "確保將標準 SKU 用於 Azure 負載均衡器",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "不得在生產環境中啟用遠端調試，因為這會在服務上打開其他埠，從而增加攻擊面。請注意，該服務會在 48 小時後自動轉為遠端調試。",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
+ "severity": "高",
+ "text": "關閉遠端調試",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "啟用 Defender for App Service。 這（除其他威脅外）檢測與已知惡意IP位址的通信。 在操作過程中查看 Defender for App Service 中的建議。",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"severity": "中等",
- "text": "確保您的負載均衡器前端IP位址是區域冗餘的（除非您需要可用區前端）。",
+ "text": "啟用 Defender for Cloud - Defender for App Service",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "Azure 在其網路上提供 DDoS 基本保護，可以通過智慧 DDoS 標準功能進行改進，該功能可以瞭解正常的流量模式並檢測異常行為。DDoS 標準適用於虛擬網路，因此必須為應用前面的網路資源（例如應用程式閘道或 NVA）配置它。",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"severity": "中等",
- "text": "應用程式閘道 v2 應部署在IP前綴等於或大於 /24 的子網中",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "在 WAF VNet 上啟用 DDOS 保護標準",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "description": "一般來說，反向代理（尤其是 WAF）的管理更接近應用程式而不是網路，因此它們與應用程式屬於同一訂閱。如果應用程式閘道和 WAF 由一個團隊管理，則將其集中在連接訂閱中可能是可以的。",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用其專用終結點和應用設置“WEBSITE_PULL_IMAGE_OVER_VNET”通過虛擬網络從 Azure 容器註冊表拉取這些映射。",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"severity": "中等",
- "text": "部署 Azure 應用程式閘道 v2 或合作夥伴 NVA，用於在登陸區虛擬網路中代理入站 HTTP（S） 連接，以及它們所保護的應用。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "通過虛擬網路拉取容器",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "按照參與的滲透測試規則對 Web 應用程式進行滲透測試。",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"severity": "中等",
- "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "進行滲透測試",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "部署根據 DevSecOps 實踐驗證和掃描漏洞的受信任代碼。",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"severity": "中等",
- "text": "配置自動縮放，最小實例數為 2。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "可靠性"
+ "text": "部署經過驗證的代碼",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
- "severity": "中等",
- "text": "跨可用區部署應用程式閘道",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "可靠性"
+ "arm-service": "microsoft.web/sites",
+ "checklist": "Azure App Service Review",
+ "description": "使用最新版本的受支援平臺、程式設計語言、協定和框架。",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
+ "severity": "高",
+ "text": "使用最新的平臺、語言、協定和框架",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoors",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
+ "service": "VNet",
"severity": "中等",
- "text": "使用 Front Door 和應用程式閘道幫助保護 HTTP/S 應用時，請在 Front Door 中使用 WAF 策略。鎖定應用程式閘道以僅接收來自 Front Door 的流量。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "text": "在多個區域中部署 Azure 登陸區域連接資源，以便可以快速支援多區域應用程式登陸區域和災難恢復方案。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "可靠性"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
- "checklist": "Azure Application Delivery Networking",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
- "severity": "高",
- "text": "使用流量管理器交付跨 HTTP/S 以外的協定的全域應用。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "可靠性"
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
+ "severity": "中等",
+ "text": "使用一個 Entra 租戶來管理 Azure 資源，除非對多租戶有明確的法規或業務要求。",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "操作"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
"service": "Entra",
"severity": "低",
- "text": "如果使用者只需要存取內部應用程式，是否考慮將 Microsoft Entra ID 應用程式代理作為 Azure 虛擬桌面 （AVD） 的替代方案？",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "安全"
+ "text": "使用多租戶自動化方法管理您的 Microsoft Entra ID 租戶。",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "操作"
},
{
- "checklist": "Azure Application Delivery Networking",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
"service": "Entra",
- "severity": "中等",
- "text": "要減少網路中為傳入連接打開的防火牆埠數，請考慮使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式的安全且經過身份驗證的訪問。",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "安全"
+ "severity": "高",
+ "text": "使用具有相同 ID 的 Azure Lighthouse 進行多租戶管理。",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "操作"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
"severity": "高",
- "text": "使用 Azure NAT 閘道而不是負載均衡器出站規則來提高 SNAT 可伸縮性",
- "waf": "可靠性"
+ "text": "如果向合作夥伴授予管理租戶的許可權，請使用 Azure Lighthouse。",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "成本"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
"severity": "高",
- "text": "啟用 Azure 應用程式閘道 WAF 機器人保護規則集。機器人規則檢測好的機器人和壞的機器人。",
+ "text": "實施與您的雲操作模型相一致的 RBAC 模型。跨管理組和訂閱確定範圍和分配。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "安全"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
- "severity": "高",
- "text": "確保 Azure 應用程式閘道 WAF 策略中是否啟用了請求正文檢查功能。",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
+ "severity": "中等",
+ "text": "僅對所有帳戶類型使用身份驗證類型 Work or school account。避免使用 Microsoft 帳戶",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "安全"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
- "severity": "高",
- "text": "在檢測模式下優化工作負載的 Azure 應用程式閘道 WAF。減少誤報檢測。",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "severity": "中等",
+ "text": "僅使用組來分配許可權。如果組管理系統已就位，請將本地組添加到僅 Entra ID 組。",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "安全"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
"severity": "高",
- "text": "在「防護」模式下部署應用程式閘道的 WAF 策略。",
+ "text": "對 Azure 環境具有許可權的任何使用者強制實施 Microsoft Entra ID 條件訪問策略。",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
- "severity": "中等",
- "text": "向 Azure 應用程式閘道 WAF 添加速率限制。Rate limit 會阻止客戶端在短時間內意外或故意發送大量流量。",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "高",
+ "text": "對有權訪問 Azure 環境的任何使用者強制實施多重身份驗證。",
+ "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
"severity": "中等",
- "text": "對 Azure 應用程式閘道 WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎設施不堪重負的極大量請求提供保護。",
+ "text": "強制實施 Microsoft Entra ID Privileged Identity Management （PIM） 以建立零長期訪問和最低許可權。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
- "severity": "低",
- "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選條件來阻止來自非預期國家/地區的流量。",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "中等",
+ "text": "如果計劃從 Active Directory 域服務切換到 Entra 域服務，請評估所有工作負載的相容性。",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
"severity": "中等",
- "text": "在使用 Azure 應用程式閘道 WAF 對流量進行異地篩選時，指定未知 （ZZ） 位置。避免在IP位址無法進行異地匹配時意外阻止合法請求。",
- "waf": "安全"
+ "text": "使用 Microsoft Entra 域服務時，請使用副本集。副本集將提高託管域的復原能力，並允許您部署到其他區域。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
"severity": "中等",
- "text": "使用最新的 Azure 應用程式閘道 WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。",
+ "text": "將 Microsoft Entra ID 紀錄與平臺中心的 Azure Monitor 集成。Azure Monitor 允許 Azure 中日誌和監視數據的單一事實來源，為組織提供雲原生選項來滿足日誌收集和保留的要求。",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
- "severity": "中等",
- "text": "添加診斷設置以保存 Azure 應用程式閘道 WAF 紀錄。",
- "waf": "操作"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
- "severity": "中等",
- "text": "將 Azure 應用程式閘道 WAF 紀錄發送到 Microsoft Sentinel。",
- "waf": "操作"
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "高",
+ "text": "實施緊急訪問或不受限帳戶，以防止租戶範圍的帳戶鎖定。默認情況下，MFA 將於 2024 年 10 月為所有用戶開啟。我們建議更新這些帳戶以使用密鑰 （FIDO2） 或為 MFA 配置基於證書的身份驗證。",
+ "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
"severity": "中等",
- "text": "將 Azure 應用程式閘道 WAF 設定定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。",
- "waf": "操作"
+ "text": "請勿將本地同步帳戶用於 Microsoft Entra ID 角色分配，除非你的方案特別需要它。",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
"severity": "中等",
- "text": "使用 WAF 策略而不是舊版 WAF 配置。",
- "waf": "操作"
+ "text": "使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對應用程式的訪問許可權時，請將其作為平臺資源進行管理，因為每個租戶只能有一個實例。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
"severity": "中等",
- "text": "篩選後端中的入站流量，使其僅接受來自應用程式閘道子網的連接，例如使用NSG的連接。",
+ "text": "對於需要最大靈活性的網路方案，請使用中心輻射型網路拓撲。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
"severity": "高",
- "text": "您應該對到後端伺服器的流量進行加密。",
- "waf": "安全"
+ "text": "在中心虛擬網路中部署共用網路服務，包括 ExpressRoute 閘道、VPN 閘道和 Azure 防火牆或合作夥伴 NVA。如有必要，還要部署 DNS 服務。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
"severity": "高",
- "text": "您應該使用 Web 應用程式防火牆。",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
- "severity": "中等",
- "text": "將 HTTP 重定向到 HTTPS",
+ "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"severity": "中等",
- "text": "使用閘道託管的 Cookie 將流量從使用者工作階段定向到同一伺服器進行處理",
- "waf": "操作"
+ "text": "部署合作夥伴網路技術或 NVA 時，請遵循合作夥伴供應商的指導。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
- "severity": "高",
- "text": "在計劃內服務更新期間啟用連接耗盡，以防止後端池的現有成員失去連接",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "低",
+ "text": "如果需要在中心輻射型方案中在 ExpressRoute 和 VPN 閘道之間傳輸，請使用 Azure 路由伺服器。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
"severity": "低",
- "text": "創建自訂錯誤頁面以顯示個人化的用戶體驗",
- "waf": "操作"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
- "severity": "中等",
- "text": "編輯 HTTP 請求和回應標頭，以便更輕鬆地在用戶端和伺服器之間進行路由和資訊交換",
+ "text": "如果使用路由伺服器，請對路由伺服器子網使用 /27 前置綴。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
"severity": "中等",
- "text": "配置 Front Door 以優化全域 Web 流量路由和頂級最終使用者性能，並通過快速全域故障轉移實現可靠性",
+ "text": "對於跨 Azure 區域具有多個中心輻射型拓撲的網路體系結構，請在中心 VNet 之間使用全域虛擬網路對等互連將區域相互連接。",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
"waf": "性能"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
"severity": "中等",
- "text": "使用傳輸層負載均衡",
- "waf": "性能"
+ "text": "使用適用於網路的 Azure Monitor 監視 Azure 上網路的端到端狀態。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "中等",
- "text": "為單個閘道上的多個 Web 應用程式配置基於主機名稱或功能變數名稱的路由",
- "waf": "安全"
+ "text": "如果一個區域中的分支網路超過 400 個，請部署一個額外的中心以繞過 VNet 對等互連限制 （500） 和可通過 ExpressRoute 播發的最大前綴數 （1000）。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
"severity": "中等",
- "text": "集中 SSL 證書管理以減少後端伺服器場的加密和解密開銷",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Application Delivery Networking",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
- "severity": "低",
- "text": "使用應用程式閘道實現對 WebSocket 和 HTTP/2 協定的本機支援",
- "waf": "安全"
+ "text": "將每個路由表的路由數限制為 400。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
"severity": "高",
- "text": "為 Azure Cache for Redis 啟用區域冗餘。Azure Cache for Redis 支持高級層和企業層中的區域冗餘配置。區域冗餘緩存可以將其節點放置在同一區域的不同 Azure 可用性區域中。它消除了作為單點故障的數據中心或可用區中斷，並提高了緩存的整體可用性。",
+ "text": "配置 VNet 對等互連時，請使用「允許流量流向遠端虛擬網路」設置。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
- "severity": "中等",
- "text": "為 Azure Cache for Redis 實例配置數據持久性。由於緩存數據存儲在記憶體中，因此多個節點的罕見和計劃外故障可能會導致所有數據被丟棄。為了避免完全丟失數據，Redis 持久性允許您定期拍攝記憶體中數據的快照，並將其存儲到存儲帳戶中。",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
+ "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "高",
+ "text": "將標準負載均衡器 SKU 與區域冗餘部署配合使用，選擇標準 SKU 負載均衡器可通過可用性區域和區域復原能力增強可靠性，確保部署能夠承受區域和區域故障。與 Basic 不同，它支援全域負載平衡並提供 SLA。",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
- "severity": "中等",
- "text": "使用異地冗餘存儲帳戶保留 Azure Cache for Redis 數據，或在異地冗餘不可用的情況下使用區域冗餘",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
+ "service": "Load Balancers",
+ "severity": "高",
+ "text": "確保負載均衡器後端池至少包含兩個實例，在後端部署至少包含兩個實例的 Azure 負載均衡器可以防止單點故障並支援可伸縮性。",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.cache/redis",
- "checklist": "Redis Resiliency checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "為高級 Azure Cache for Redis 實例配置被動異地複製。異地複製是一種用於連結兩個或多個 Azure Cache for Redis 實例的機制，通常跨越兩個 Azure 區域。異地複製主要用於跨區域災難恢復。兩個高級層緩存實例通過異地複製進行連接，從而提供對主緩存的讀取和寫入，並將數據複製到輔助緩存。",
- "waf": "可靠性"
+ "text": "使用 ExpressRoute Direct 時，請配置 MACsec，以便在組織路由器和 MSEE 之間的第二層加密流量。該圖顯示了這種加密流程。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
- "severity": "高",
- "text": "根據您的業務和 SLO 要求選擇正確的功能託管計劃",
- "waf": "可靠性"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "對於無法使用MACsec的情況（例如，不使用ExpressRoute Direct），請使用 VPN 閘道通過 ExpressRoute 專用對等互連建立 IPsec 隧道。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
"severity": "高",
- "text": "利用區域適用的可用區（不適用於消耗層）",
- "waf": "可靠性"
+ "text": "確保 Azure 區域和本地位置之間沒有使用重疊的 IP 位址空間。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "中等",
- "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
- "waf": "可靠性"
+ "text": "使用私有互聯網的位址分配範圍 （RFC 1918） 中的IP位址。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
"severity": "高",
- "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
- "waf": "可靠性"
+ "text": "確保IP位址空間不會浪費，不要創建不必要的大型虛擬網路（例如/16）。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
"severity": "高",
- "text": "確保為應用服務計劃上運行的所有函數應用啟用“始終開啟”",
+ "text": "不要對生產和災難恢復網站使用重疊的IP位址範圍。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
- "severity": "中等",
- "text": "將函數應用與其自己的存儲帳戶配對。盡量不要重用函數應用的存儲帳戶，除非它們緊密耦合",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
+ "service": "Public IP Addresses",
+ "severity": "高",
+ "text": "使用標準 SKU 和區域冗餘 IP（如果適用），Azure 中的公共 IP 位址可以是標準 SKU，以非區域、區域或區域冗餘的形式提供。區域冗餘IP可跨所有區域訪問，可抵禦任何單個區域故障，從而提供更高的彈性。",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Azure Function Review",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
"severity": "中等",
- "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護函數應用代碼",
+ "text": "對於只需要在 Azure 中進行名稱解析的環境，請使用 Azure 專用 DNS 進行解析，並使用委託區域進行名稱解析（例如“azure.contoso.com”）。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
- "service": "AKS",
- "severity": "低",
- "text": "如果 AKS Windows 工作負載需要，可以使用 HostProcess 容器",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "severity": "中等",
+ "text": "對於需要跨 Azure 和本地進行名稱解析且沒有 Active Directory 等現有企業 DNS 服務的環境，請使用 Azure DNS 專用解析程式將 DNS 請求路由到 Azure 或本地 DNS 伺服器。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
"severity": "低",
- "text": "如果運行事件驅動的工作負載，請使用KEDA",
- "waf": "性能"
+ "text": "需要並部署自己的 DNS 的特殊工作負載（例如 Red Hat OpenShift）應使用其首選的 DNS 解決方案。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
- "service": "AKS",
- "severity": "低",
- "text": "使用 Dapr 簡化微服務開發",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "高",
+ "text": "為 Azure DNS 啟用自動註冊，以自動管理虛擬網路中部署的虛擬機的 DNS 記錄的生命週期。",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
- "service": "AKS",
- "severity": "高",
- "text": "使用 SLA 支援的 AKS 產品/服務",
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
+ "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
+ "service": "DNS",
+ "severity": "中等",
+ "text": "實施一個計劃，用於管理多個 Azure 區域之間的 DNS 解析以及服務故障轉移到另一個區域時",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "低",
- "text": "在容器和部署定義中使用中斷預算",
- "waf": "可靠性"
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "中等",
+ "text": "使用 Azure Bastion 安全地連接到您的網路。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
- "severity": "高",
- "text": "如果使用專用註冊表，請配置區域複製以將映像存儲在多個區域中",
- "waf": "可靠性"
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
+ "severity": "中等",
+ "text": "在子網 /26 或更大的子網中使用 Azure Bastion。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
- "service": "AKS",
- "severity": "低",
- "text": "使用外部應用（如 kubecost）將成本分配給不同的使用者",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
- "service": "AKS",
- "severity": "低",
- "text": "使用縮減模式刪除/取消分配節點",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
- "severity": "中等",
- "text": "需要時，請在 AKS 群集上使用多實例分組 GPU",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
- "severity": "低",
- "text": "如果運行開發/測試群集，請使用 NodePool Start/Stop",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
- "severity": "中等",
- "text": "使用適用於 Kubernetes 的 Azure Policy 確保群集符合性",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
"severity": "中等",
- "text": "使用使用者/系統節點池將應用程式與控制平面分開",
+ "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為到登陸區域的入站 HTTP/S 連接提供全域保護。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
"severity": "低",
- "text": "向系統節點池添加污點以使其專用",
+ "text": "使用 Azure Front Door 和 Azure 應用程式閘道幫助保護 HTTP/S 應用時，請使用 Azure Front Door 中的 WAF 策略。鎖定 Azure 應用程式閘道以僅接收來自 Azure Front Door 的流量。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
- "severity": "中等",
- "text": "對映像使用專用註冊表，例如 ACR",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "高",
+ "text": "當入站 HTTP/S 連接需要 WAF 和其他反向代理時，請將它們部署在登陸區虛擬網路中，並與它們保護並公開給 Internet 的應用程式一起部署。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerregistry/registries",
- "checklist": "Azure AKS Review",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
- "severity": "中等",
- "text": "掃描映像以查找漏洞",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "高",
+ "text": "使用 Azure DDoS 網路或 IP 保護計劃來幫助保護虛擬網路中的公共 IP 位址終結點。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
"severity": "高",
- "text": "定義應用分離要求（命名空間/節點池/集群）",
- "waf": "安全"
+ "text": "規劃如何在即將到來的重大更改之前管理您的網路出站流量配置和策略。2025 年 9 月 30 日，新部署的預設出站訪問將停用，僅允許顯式訪問配置。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
- "severity": "中等",
- "text": "使用 CSI 機密存儲驅動程式將機密存儲在 Azure Key Vault 中",
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "高",
+ "text": "添加診斷設置以保存所有受保護的公有IP位址（DDoS IP或網路保護）的 DDoS 相關日誌。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
"severity": "高",
- "text": "如果將服務主體用於群集，請定期刷新憑據（如每季度）",
+ "text": "確保有一個策略分配來拒絕直接連接到虛擬機的公有IP位址。 如果特定 VM 上需要公共 IP，請使用排除項。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "如果需要，請添加金鑰管理服務 etcd 加密",
- "waf": "安全"
+ "text": "使用 ExpressRoute 作為與 Azure 的主要連接。 使用 VPN 作為備份連接的源。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請考慮使用適用於 AKS 的機密計算",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "您可以使用 AS 路徑預置和連接權重來影響從 Azure 到本地的流量，並使用您自己的路由器中的所有 BGP 屬性來影響從本地到 Azure 的流量。",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "使用多個 ExpressRoute 線路或多個本地位置時，請使用 BGP 屬性來優化路由。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "考慮使用 Defender for Containers",
- "waf": "安全"
+ "text": "根據頻寬和性能要求為 ExpressRoute/VPN 閘道選擇正確的 SKU。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
"severity": "高",
- "text": "使用託管標識而不是服務主體",
- "waf": "安全"
+ "text": "確保僅在達到與成本相稱的頻寬時才使用無限數據 ExpressRoute 線路。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
- "severity": "中等",
- "text": "將身份驗證與 AAD（使用託管集成）集成",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "高",
+ "text": "如果你的線路對等互連位置支援本地 SKU 的 Azure 區域，請利用 ExpressRoute 的本地 SKU 來降低線路的成本。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "限制對管理員 kubeconfig （get-credentials --admin） 的訪問",
- "waf": "安全"
+ "text": "在支援的 Azure 區域中部署區域冗餘 ExpressRoute 閘道。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "將授權與 AAD RBAC 集成",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
- "service": "AKS",
- "severity": "高",
- "text": "在 Kubernetes 中使用命名空間限制 RBAC 許可權",
- "waf": "安全"
+ "text": "對於需要高於 10 Gbps 的頻寬或專用 10/100 Gbps 埠的方案，請使用 ExpressRoute Direct。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "對於 Pod Identity Access Management，請使用 Azure AD 工作負載標識（預覽版）",
- "waf": "安全"
+ "text": "當需要低延遲，或者從本地到 Azure 的輸送量必須大於 10 Gbps 時，請啟用 FastPath 以從數據路徑繞過 ExpressRoute 閘道。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
"severity": "中等",
- "text": "對於 AKS 非互動式登錄名，請使用 kubelogin（預覽版）",
- "waf": "安全"
+ "text": "使用區域冗餘 VPN 閘道將分支或遠端位置連接到 Azure（如果可用）。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
"severity": "中等",
- "text": "禁用 AKS 本地帳戶",
- "waf": "安全"
+ "text": "在本地使用冗餘 VPN 設備（主動/主動或主動/被動）。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請配置 Just-in-time 群集訪問",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "severity": "高",
+ "text": "如果使用 ExpressRoute Direct，請考慮使用連接到本地 Azure 區域的 ExpressRoute 本地線路以節省成本。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，為 AKS 配置 AAD 條件訪問",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "當需要流量隔離或專用頻寬時（例如用於分離生產和非生產環境），請使用不同的 ExpressRoute 線路。它將幫助您確保隔離的路由域並減輕嘈雜的鄰居風險。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
- "severity": "低",
- "text": "如果 Windows AKS 工作負載需要，請配置 gMSA",
- "waf": "安全"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "使用內置的 Express Route Insights 監控 ExpressRoute 的可用性和利用率。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "為了獲得更精細的控制，請考慮使用託管的 Kubelet 身份",
- "waf": "安全"
+ "text": "使用連接監視器進行跨網路的連接監控，尤其是本地和 Azure 之間的連接。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "如果使用 AGIC，請勿跨集群共用 AppGW",
+ "text": "使用來自不同對等互連位置的 ExpressRoute 線路以實現冗餘。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
- "severity": "高",
- "text": "不要使用 AKS HTTP 路由載入項，而是將託管 NGINX 入口與應用程式路由載入項一起使用。",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "如果僅使用單個 ExpressRoute 線路，請使用網站到網站 VPN 作為 ExpressRoute 的故障轉移。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
- "severity": "中等",
- "text": "對於 Windows 工作負載，請使用加速網路",
- "waf": "性能"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "severity": "高",
+ "text": "如果您在 GatewaySubnet 中使用路由表，請確保傳播閘道路由。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
"severity": "高",
- "text": "使用標準 ALB（而不是基本 ALB）",
+ "text": "如果使用 ExpressRoute，則本地路由應該是動態的：如果連接失敗，它應收斂到線路的剩餘連接。理想情況下，負載應在兩個連接之間共用，即主動/主動，但也支持主動/被動。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "如果使用 Azure CNI，請考慮對 NodePool 使用不同的子網",
- "waf": "安全"
+ "text": "確保 ExpressRoute 線路的兩個物理連結連接到網路中的兩個不同的邊緣設備。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "使用專用終結點（首選）或虛擬網路服務終結點從群集訪問 PaaS 服務",
- "waf": "安全"
+ "text": "確保在客戶或供應商邊緣路由設備上啟用和配置雙向轉發檢測 （BFD）。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
"severity": "高",
- "text": "選擇最適合你要求的 CNI 網路外掛程式（建議使用 Azure CNI）",
+ "text": "將 ExpressRoute 閘道連接到來自不同對等互連位置的兩條或多條線路，以獲得更高的復原能力。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "高",
- "text": "如果使用 Azure CNI，請根據每個節點的最大 Pod 數相應地調整子網的大小",
- "waf": "性能"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "為 ExpressRoute 虛擬網路閘道配置診斷日誌和警報。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
- "severity": "高",
- "text": "如果使用 Azure CNI，請檢查每個節點的最大 Pod 數（預設為 30）",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "severity": "中等",
+ "text": "不要使用 ExpressRoute 線路進行 VNet 到 VNet 通信。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
"waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "對於內部應用，組織通常會在其防火牆中打開整個AKS子網。這也會打開對節點的網路訪問，並可能打開對 Pod 的訪問（如果使用 Azure CNI）。如果 LoadBalancer IP 位於不同的子網中，則只有此子網可供應用用戶端使用。另一個原因是，如果 AKS 子網中的 IP 位址是稀缺資源，則將其 IP 位址用於服務會降低群集的最大可伸縮性。",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
"severity": "低",
- "text": "如果使用專用IP LoadBalancer服務，請使用專用子網（而不是 AKS 子網）",
- "waf": "安全"
+ "text": "不要將 Azure 流量發送到混合位置進行檢查。 相反，請遵循“Azure 中的流量保留在 Azure 中”的原則，以便通過 Microsoft 主幹網络進行 Azure 中資源的通信。",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
"severity": "高",
- "text": "相應調整服務 IP 位址範圍的大小（這將限制群集的可伸縮性）",
- "waf": "可靠性"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請添加您自己的 CNI 外掛程式",
+ "text": "使用 Azure 防火牆來管理到 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請在 AKS 中配置每個節點的公共 IP",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
"severity": "中等",
- "text": "使用入口控制器公開基於 Web 的應用，而不是使用 LoadBalancer 類型的服務公開它們",
- "waf": "可靠性"
+ "text": "創建全域 Azure 防火牆策略以管理全球網路環境中的安全狀況，並將其分配給所有 Azure 防火牆實例。通過 Azure 基於角色的訪問控制將增量防火牆策略委派給本地安全團隊，從而允許精細策略以滿足特定區域的要求。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
"severity": "低",
- "text": "使用 Azure NAT 閘道作為 outboundType 來縮放出口流量",
- "waf": "可靠性"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
- "severity": "中等",
- "text": "使用IP的動態分配來避免 Azure CNI IP 耗盡",
- "waf": "可靠性"
+ "text": "如果組織希望使用此類解決方案來幫助保護出站連接，請在 Firewall Manager 中配置受支援的合作夥伴 SaaS 安全提供者。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
"severity": "高",
- "text": "如果安全要求要求，請使用 AzFW/NVA 篩選出口流量",
+ "text": "使用應用程式規則篩選目標主機名上的出站流量，以瞭解支持的協定。 使用基於 FQDN 的網路規則和帶有 DNS 代理的 Azure 防火牆，通過其他協議篩選到 Internet 的出口流量。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
- "severity": "中等",
- "text": "如果使用公共 API 終端節點，請限制可以存取它的 IP 位址",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "severity": "高",
+ "text": "使用 Azure 防火牆高級版啟用其他安全功能。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
"severity": "高",
- "text": "如果要求要求，請使用私有集群",
+ "text": "將 Azure 防火牆威脅情報模式配置為 Alert 和 Deny 以獲得額外的保護。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
- "severity": "中等",
- "text": "對於 Windows 2019 和 2022 AKS 節點，可以使用 Calico 網路策略",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "高",
+ "text": "將 Azure 防火牆 IDPS 模式配置為 Deny 以獲得額外保護。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
"severity": "高",
- "text": "啟用 Kubernetes 網路策略選項 （Calico/Azure）",
+ "text": "對於 VNet 中未連接到虛擬 WAN 的子網，請附加路由表，以便將 Internet 流量重定向到 Azure 防火牆或網路虛擬設備。",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "添加診斷設置，以使用特定於資源的目標表保存所有 Azure 防火牆部署的日誌。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
"severity": "高",
- "text": "使用 Kubernetes 網路策略提高集群內安全性",
- "waf": "安全"
+ "text": "從 Azure 防火牆經典規則（如果存在）遷移到防火牆策略。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
"severity": "高",
- "text": "將 WAF 用於 Web 工作負載（UI 或 API）",
+ "text": "對 Azure 防火牆子網使用 /26 前置綴。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
"waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
"severity": "中等",
- "text": "在 AKS 虛擬網路中使用 DDoS 標準",
- "waf": "安全"
+ "text": "根據規則的使用頻率，將防火牆策略中的規則排列到規則集合組和規則集合中。",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請添加公司 HTTP 代理",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "使用IP組或IP前置綴來減少IP表規則的數量。",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
- "severity": "中等",
- "text": "考慮使用服務網格進行高級微服務通信管理",
- "waf": "安全"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "請勿使用通配符作為DNAT的源IP，例如*或任何，您應該為傳入的DNAT指定源IP。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
- "severity": "高",
- "text": "設定有關最關鍵指標的警報（請參閱容器見解以獲取建議）",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "通過監控 SNAT 埠使用方式、評估 NAT 閘道設置並確保無縫故障轉移，防止 SNAT 埠耗盡。如果埠計數接近限制，則表明 SNAT 耗儘可能即將耗盡。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
- "severity": "低",
- "text": "定期查看 Azure 顧問，瞭解有關群集的建議",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
+ "severity": "高",
+ "text": "如果使用的是 Azure 防火牆高級版，請啟用 TLS 檢查。",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
"severity": "低",
- "text": "啟用 AKS 自動證書輪換",
- "waf": "操作"
+ "text": "使用 Web 類別允許或拒絕對特定主題的出站訪問。",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
- "severity": "高",
- "text": "定期（例如，每季度）升級 kubernetes 版本，或使用 AKS 自動升級功能",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "作為 TLS 檢查的一部分，請規劃從 Azure 應用程式閘道接收流量進行檢查。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
- "severity": "高",
- "text": "如果您不使用 node-image 升級，請使用 kured 進行 Linux 節點升級",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "啟用 Azure 防火牆 DNS 代理配置。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
"severity": "高",
- "text": "定期（例如，每周）升級群集節點映像的常規過程",
- "waf": "操作"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
- "severity": "低",
- "text": "考慮使用 gitops 將應用程式或集群配置部署到多個集群",
+ "text": "將 Azure 防火牆與 Azure Monitor 集成，並啟用診斷日誌記錄來存儲和分析防火牆日誌和指標。",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
"severity": "低",
- "text": "請考慮在專用群集上使用 AKS 命令調用",
+ "text": "為防火牆規則實施備份",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
- "severity": "低",
- "text": "對於計劃的事件，請考慮使用 Node Auto Drain",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
+ "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
+ "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
+ "service": "Firewall",
+ "severity": "高",
+ "text": "跨多個可用性區域部署 Azure 防火牆。Azure 防火牆根據其部署提供不同的 SLA;在單個可用區或跨多個可用區，從而可能提高可靠性和性能。",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
+ "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
+ "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
+ "service": "Firewall",
"severity": "高",
- "text": "開發自己的治理實踐，以確保節點 RG（又名“基礎設施 RG”）中的操作員不會執行任何更改",
- "waf": "操作"
+ "text": "在 Azure 防火牆 VNet 上配置 DDoS 防護，將 DDoS 防護計劃與託管 Azure 防火牆的虛擬網路相關聯，以提供針對 DDoS 攻擊的增強緩解。Azure 防火牆管理器集成了防火牆基礎結構和 DDoS 防護計劃的創建。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "低",
- "text": "使用自定義節點 RG（又名“Infra RG”）名稱",
- "waf": "操作"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
+ "severity": "高",
+ "text": "不要中斷注入虛擬網路的 Azure PaaS 服務的控制平面通信，例如使用 0.0.0.0/0 路由或阻止控制平面流量的 NSG 規則。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
"severity": "中等",
- "text": "請勿在 YAML 清單中使用已棄用的 Kubernetes API",
- "waf": "操作"
+ "text": "通過專用終結點和 ExpressRoute 專用對等互連從本地訪問 Azure PaaS 服務。此方法可避免通過公共 Internet 傳輸。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
- "severity": "低",
- "text": "污染 Windows 節點",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "severity": "高",
+ "text": "默認情況下，不要在所有子網上啟用虛擬網路服務終端節點。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
- "severity": "低",
- "text": "使 Windows 容器修補程式級別與主機修補程式級別保持同步",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "severity": "中等",
+ "text": "使用 FQDN 而不是 Azure 防火牆或 NVA 中的 IP 位址篩選到 Azure PaaS 服務的出口流量，以防止數據外洩。如果使用專用連結，則可以阻止所有 FQDN，否則僅允許所需的 PaaS 服務。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "通過群集級別的診斷設置",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
- "severity": "低",
- "text": "將主日誌（又名 API 紀錄）發送到 Azure Monitor 或首選日誌管理解決方案",
- "waf": "操作"
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "severity": "高",
+ "text": "至少為您的閘道子網使用 /27 前置綴。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請使用 nodePool 快照",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
- "severity": "低",
- "text": "考慮將現成節點池用於對時間敏感的工作負載",
- "waf": "操作"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
- "severity": "低",
- "text": "考慮用於快速突發的 AKS 虛擬節點",
- "waf": "操作"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
"severity": "高",
- "text": "使用 Container Insights（或 Prometheus 等其他工具）監控集群指標",
- "waf": "操作"
+ "text": "不要依賴使用 VirtualNetwork 服務標記的 NSG 入站預設規則來限制連接。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
- "severity": "高",
- "text": "使用 Container Insights（或 Telegraf/ElasticSearch 等其他工具）存儲和分析集群日誌",
- "waf": "操作"
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "severity": "中等",
+ "text": "使用 NSG 説明保護跨子網的流量，以及跨平台的東西向流量（登陸區域之間的流量）。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
"severity": "中等",
- "text": "監控節點的 CPU 和記憶體利用率",
- "waf": "操作"
+ "text": "使用 NSG 和應用程式安全組對登陸區域內的流量進行微分段，並避免使用中央 NVA 來篩選流量。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
"severity": "中等",
- "text": "如果使用 Azure CNI，請監視每個節點消耗的 Pod IP 的百分比",
- "waf": "操作"
+ "text": "啟用 VNet 流日誌並將其饋送到流量分析中，以深入了解內部和外部流量流。",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "OS 磁碟上的 I/O 是關鍵資源。如果節點中的操作系統在 I/O 上受到限制，這可能會導致不可預知的行為，通常最終導致節點被聲明為 NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
"severity": "中等",
- "text": "監視節點中的OS磁碟佇列深度",
- "waf": "操作"
+ "text": "由於規則數限制為 1000 個，因此每個 NSG 實施的 NSG 規則不要超過 900 個。",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
"severity": "中等",
- "text": "如果不對 AzFW/NVA 使用出口篩選，請監視標準 ALB 分配的 SNAT 連接埠",
+ "text": "如果您的方案在虛擬 WAN 路由設計清單中明確描述，請使用虛擬 WAN。",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
"severity": "中等",
- "text": "訂閱 AKS 群集的資源運行狀況通知",
- "waf": "操作"
+ "text": "使用每個 Azure 區域的虛擬 WAN 中心，透過通用的全球 Azure 虛擬 WAN 跨 Azure 區域將多個登陸區域連接在一起。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
- "severity": "高",
- "text": "在 Pod 規範中配置請求和限制",
- "waf": "操作"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "severity": "中等",
+ "text": "對於出站 Internet 流量保護和篩選，請在安全中心部署 Azure 防火牆。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
"severity": "中等",
- "text": "強制實施命名空間的資源配額",
- "waf": "操作"
+ "text": "確保您的虛擬 WAN 網路架構與已確定的架構方案保持一致。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
- "severity": "高",
- "text": "確保訂閱具有足夠的配額來橫向擴展節點池",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "severity": "中等",
+ "text": "使用適用於虛擬 WAN 的 Azure Monitor Insights 來監視虛擬 WAN 的端到端拓撲、狀態和關鍵指標。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
"waf": "操作"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
"severity": "中等",
- "text": "使用群集自動縮放程式",
- "waf": "性能"
+ "text": "不要在虛擬 WAN 中禁用分支到分支流量，除非應明確阻止這些流。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
- "severity": "低",
- "text": "自定義 AKS 節點池的節點配置",
- "waf": "性能"
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "severity": "中等",
+ "text": "使用 AS-Path 作為中心路由首選項，因為它比 ExpressRoute 或 VPN 更靈活。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
"severity": "中等",
- "text": "需要時使用 Horizontal Pod Autoscaler",
- "waf": "性能"
+ "text": "在虛擬 WAN 中配置基於標籤的傳播，否則虛擬中心之間的連接將受到影響。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "description": "更大的節點將帶來更高的性能和功能，例如臨時磁碟和加速網路，但它們會增加爆炸半徑並降低擴展粒度",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
"severity": "高",
- "text": "考慮適當的節點大小，不要太大或太小",
- "waf": "性能"
+ "text": "為虛擬中心分配至少 /23 前置綴，以確保有足夠的IP空間可用。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
- "severity": "低",
- "text": "如果可伸縮性需要超過 5000 個節點，請考慮使用其他 AKS 群集",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
- "severity": "低",
- "text": "考慮訂閱 EventGrid Events for AKS 自動化",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
- "severity": "低",
- "text": "若要在 AKS 群集上長時間運行操作，請考慮事件終止",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
- "severity": "低",
- "text": "如果需要，請考慮將 Azure 專用主機用於 AKS 節點",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
- "severity": "高",
- "text": "使用臨時OS磁碟",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "高",
- "text": "對於非臨時磁碟，在運行多個 Pod/節點時，請為節點使用高 IOPS 和更大的 OS 磁碟，因為它需要高性能才能運行多個 Pod，並且會生成具有預設 AKS 日誌輪換閾值的大量日誌",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
- "severity": "低",
- "text": "對於超高性能存儲選項，請在 AKS 上使用超級磁碟For hyper performance storage option use Ultra Disks on AKS",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
- "severity": "中等",
- "text": "避免將狀態保留在群集中，並將數據存儲在外部（AzStorage、AzSQL、Cosmos 等）",
- "waf": "性能"
+ "text": "戰略性地利用 Azure Policy，使用策略計劃對相關策略進行分組，為您的環境定義控制措施。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "中等",
- "text": "如果使用 AzFiles Standard，出於性能原因，請考慮使用 AzFiles Premium 和/或 ANF",
- "waf": "性能"
+ "text": "將法規和合規性要求映射到 Azure Policy 定義和 Azure 角色分配。",
+ "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
- "checklist": "Azure AKS Review",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "中等",
- "text": "如果使用 Azure 磁碟和可用區，請考慮在區域內為 LRS 磁碟設置節點池，並使用 VolumeBindingMode：WaitForFirstConsumer 在正確的區域中預配存儲，或將 ZRS 磁碟用於跨多個區域的節點池",
- "waf": "性能"
+ "text": "在中間根管理組建立 Azure Policy 定義，以便可以在繼承的範圍內分配這些定義。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "高",
- "text": "確保在本機 Azure 的標識訂閱中部署了 ADDS 域控制器",
+ "text": "如果需要，在最高適當的級別管理策略分配，並在最低級別管理排除項。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
- "severity": "中等",
- "text": "確保將 ADDS 網站和服務配置為將來自基於 Azure 的資源（包括 Azure VMware 解決方案）的身份驗證請求保留到 Azure 本地",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "低",
+ "text": "使用 Azure Policy 控制使用者可以在訂閱/管理組級別預配哪些服務。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "高",
- "text": "確保 vCenter 已連接到 ADDS，以啟用基於「指定用戶帳戶」的身份驗證",
+ "text": "盡可能使用內置策略，以最大程度地減少運營開銷。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "通過將 Resource Policy Contributor 角色分配給特定範圍，您可以將策略管理委派給相關團隊。例如，中央IT團隊可以監督管理組級別的策略，而應用程式團隊則處理其訂閱的策略，從而在遵守組織標準的情況下實現分散式治理。",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
"severity": "中等",
- "text": "確保從 vCenter 到 ADDS 的連接使用安全協定 （LDAPS）",
+ "text": "在特定範圍內分配內置的 Resource Policy Contributor 角色，以啟用應用程式級監管。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
"severity": "中等",
- "text": "vCenter IdP 中的 CloudAdmin 帳戶僅用作緊急帳戶 （break-glass）",
+ "text": "限制在根管理組範圍內進行的 Azure Policy 分配的數量，以避免通過繼承範圍內的排除項進行管理。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
- "severity": "高",
- "text": "確保 NSX-Manager 與外部身份提供程式 （LDAPS） 集成",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "severity": "中等",
+ "text": "如果存在任何數據主權要求，則應部署 Azure 策略來強制實施這些要求。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
"severity": "中等",
- "text": "是否已創建 RBAC 模型以在 VMware vSphere 中使用",
+ "text": "對於 Sovereign Landing Zone，請部署主權策略基線並在正確的管理組級別進行分配。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
"severity": "中等",
- "text": "RBAC 許可權應授予 ADDS 組，而不是特定使用者",
+ "text": "對於 Sovereign Landing Zone，將 Sovereign Control 目標記錄到策略映射。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
- "severity": "高",
- "text": "Azure 中 Azure VMware 解決方案資源的 RBAC 許可權僅「鎖定」為一組有限的擁有者",
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "severity": "中等",
+ "text": "對於 Sovereign Landing Zone，請確保已制定管理“主權控制目標到策略映射”的流程。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
- "severity": "高",
- "text": "確保所有自定義角色的範圍都具有 CloudAdmin 允許的授權",
- "waf": "安全"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
+ "service": "Monitor",
+ "severity": "中等",
+ "text": "使用單個監視器日誌工作區集中管理平臺，除非 Azure 基於角色的訪問控制 （Azure RBAC）、數據主權要求或數據保留策略要求單獨的工作區。",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
- "severity": "高",
- "text": "是否為手頭的客戶用例選擇了正確的 Azure VMware 解決方案連接模型",
- "waf": "性能"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "中等",
+ "text": "決定是對所有區域使用單個 Azure Monitor 日誌工作區，還是創建多個工作區以涵蓋不同的地理區域。每種方法都有優點和缺點，包括潛在的跨區域網路費用",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
"severity": "高",
- "text": "確保使用「連接監視器」監視從本地到 Azure 的 ExpressRoute 或 VPN 連接",
+ "text": "如果您的日誌保留要求超過 12 年，請將日誌匯出到 Azure 存儲。將不可變存儲與一次寫入、多次讀取策略結合使用，使數據在使用者指定的時間間隔內不可擦除且不可修改。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
"severity": "中等",
- "text": "確保創建從 Azure 本機資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視 Azure VMware 解決方案後端 ExpressRoute 連接",
+ "text": "使用 Azure Policy 監視 OS 等級的虛擬機 （VM） 配置偏移。通過策略啟用 Azure Automanage 計算機配置審核功能可幫助應用程式團隊工作負載輕鬆立即使用功能。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
"severity": "中等",
- "text": "確保創建從本地資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視端到端連接",
+ "text": "使用 Azure 更新管理員作為 Azure 中 Windows 和 Linux VM 的修補機制。",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
- "severity": "高",
- "text": "使用路由伺服器時，請確保從路由伺服器到 ExR 閘道再到本地的路由不超過 1000 個（ARS 限制）。",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "severity": "中等",
+ "text": "使用 Azure Update Manager 作為使用 Azure Arc 的 Azure 外部 Windows 和 Linux VM 的修補機制。",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
- "severity": "高",
- "text": "是否為在 Azure 門戶中管理 Azure VMware 解決方案資源的角色實現了 Privileged Identity Management（不允許長期許可權）",
- "waf": "安全"
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "中等",
+ "text": "使用網路觀察程序主動監控流量。",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
- "severity": "高",
- "text": "應為 Azure VMware 解決方案 PIM 角色實現 Privileged Identity Management 審核報告",
- "waf": "安全"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "中等",
+ "text": "使用 Azure Monitor 紀錄獲取見解和報告。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
"severity": "中等",
- "text": "如果使用 Privileged Identity Management，請確保使用有效的 SMTP 記錄創建啟用了 Entra ID 的有效帳戶，以便 Azure VMware 解決方案自動主機更換通知。（需要長期許可）",
- "waf": "安全"
+ "text": "使用 Azure Monitor 警報生成操作警報。",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
- "severity": "高",
- "text": "將 CloudAdmin 帳戶的使用限制為僅緊急訪問",
- "waf": "安全"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "中等",
+ "text": "通過 Azure 自動化帳戶使用更改和清單跟蹤時，請確保已選擇受支持的區域，以便將 Log Analytics 工作區和自動化帳戶連結在一起。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
- "severity": "中等",
- "text": "在 vCenter 中創建自定義 RBAC 角色，以在 vCenter 中實施最小特權模型",
- "waf": "安全"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "低",
+ "text": "使用Azure備份時，請使用正確的備份類型（GRS，ZRS和LRS）進行備份，因為預設設置是GRS。",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
"severity": "中等",
- "text": "是定義為定期輪換 cloudadmin （vCenter） 和管理員 （NSX） 憑據的過程",
+ "text": "使用 Azure 來賓策略通過 VM 擴展自動部署軟體配置，並強制實施合規的基線 VM 配置。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
- "severity": "高",
- "text": "使用集中式識別提供者用於在 Azure VMware 解決方案上運行的工作負載 （VM）",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "使用 Azure Policy 的來賓配置功能來審核和修正電腦設置（例如，操作系統、應用程式、環境），以確保資源與預期配置保持一致，並且更新管理可以對 VM 強制實施修補程式管理。",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "severity": "中等",
+ "text": "通過 Azure Policy 監視 VM 安全配置偏移。",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"severity": "中等",
- "text": "是否在 NSX-T 中實施了東西向流量篩選",
- "waf": "安全"
+ "text": "將 Azure Site Recovery 用於 Azure 到 Azure 虛擬機的災難恢復方案。這使您能夠跨區域複製工作負載。",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
- "severity": "高",
- "text": "Azure VMware 解決方案上的工作負載不會直接向 Internet 公開。流量由 Azure 應用程式閘道、Azure 防火牆或第三方解決方案進行篩選和檢查",
- "waf": "安全"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "中等",
+ "text": "使用 Azure 原生備份功能或與 Azure 相容的第三方備份解決方案。",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
"severity": "高",
- "text": "對 Azure VMware 解決方案和基於 Azure VMware 解決方案的工作負載的入站 Internet 請求實施審核和日誌記錄",
- "waf": "安全"
+ "text": "添加診斷設置以保存來自應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）的 WAF 日誌。定期查看日誌以檢查是否存在攻擊和誤報檢測。",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
"severity": "中等",
- "text": "對來自 Azure VMware 解決方案或基於 Azure VMware 解決方案的工作負載的出站 Internet 連接實施會話監視，以識別可疑/惡意活動",
+ "text": "將 WAF 日誌從應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）發送到 Microsoft Sentinel。檢測攻擊並將 WAF 遙測集成到整個 Azure 環境中。",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
+ "severity": "高",
+ "text": "使用 Azure Key Vault 儲存機密和憑據。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
"severity": "中等",
- "text": "是否在 Azure 的 ExR/VPN 閘道子網上啟用了 DDoS 標準防護",
+ "text": "對不同的應用程式和區域使用不同的 Azure Key Vault，以避免事務規模限制並限制對機密的訪問。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "使用專用特權訪問工作站 （PAW） 管理 Azure VMware 解決方案、vCenter、NSX Manager 和 HCX Manager",
+ "text": "預配 Azure Key Vault 並啟用軟刪除和清除策略，以允許對已刪除的物件進行保留保護。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "為 Azure VMware 解決方案上運行的工作負載啟用高級威脅檢測（Microsoft Defender for Cloud，又名 ASC）",
+ "text": "通過將永久刪除密鑰、機密和證書的授權限制為專門的自定義 Microsoft Entra ID 角色，遵循最低許可權模型。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "使用適用於伺服器的 Azure ARC 使用 Azure 本機技術正確管理在 Azure VMware 解決方案上運行的工作負載（適用於 Azure VMware 解決方案的 Azure ARC 尚不可用）",
+ "text": "與公共證書頒發機構一起自動執行證書管理和續訂流程，以簡化管理。",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
- "severity": "低",
- "text": "確保 Azure VMware 解決方案上的工作負載在運行時使用足夠的數據加密（如來賓內磁碟加密和 SQL TDE）。（vSAN 靜態加密為預設加密）",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "建立金鑰和證書輪換的自動化流程。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
- "severity": "低",
- "text": "使用來賓內加密時，請盡可能將加密密鑰存儲在 Azure Key Vault 中",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "在保管庫上啟用防火牆和虛擬網路服務終結點或專用終結點，以控制對密鑰保管庫的訪問。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
"severity": "中等",
- "text": "請考慮對 Azure VMware 解決方案上運行的工作負載使用擴展的安全更新支援（Azure VMware 解決方案符合 ESU 條件）",
+ "text": "使用平臺中心的 Azure Monitor Log Analytics 工作區來審核 Key Vault 的每個實例中的密鑰、證書和機密使用方式。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
- "severity": "高",
- "text": "確保使用適當的 vSAN 資料冗餘方法（RAID 規範）",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
- "severity": "高",
- "text": "確保允許失敗策略已到位，以滿足您的 vSAN 儲存需求",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
- "severity": "高",
- "text": "確保已請求足夠的配額，確保已考慮增長和災難恢復要求",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "確保瞭解對 ESXi 的訪問限制，其中存在可能影響第三方解決方案的訪問限制。",
- "waf": "操作"
+ "text": "委託 Key Vault 實例化和特權訪問，並使用 Azure Policy 強制實施一致的合規配置。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "確保您制定了有關ESXi主機密度和效率的策略，並牢記請求新節點的提前期",
- "waf": "操作"
+ "text": "每個區域每個環境的每個應用程式使用 Azure Key Vault。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
"severity": "中等",
- "text": "確保 Azure VMware 解決方案的良好成本管理流程已到位 - 可以使用 Azure 成本管理",
- "waf": "成本"
+ "text": "如果您想使用自己的金鑰，則可能並非所有考慮的服務都支援此功能。實施相關的緩解措施，以便不一致不會妨礙預期的結果。選擇適當的區域對和災難恢復區域，以最大限度地減少延遲。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
- "severity": "低",
- "text": "Azure 預留實例是否用於優化使用 Azure VMware 解決方案的成本",
- "waf": "成本"
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
+ "severity": "中等",
+ "text": "對於主權登陸區域，請使用 Azure Key Vault 託管 HSM 來儲存機密和憑據。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
"severity": "中等",
- "text": "使用其他 Azure 本機服務時，請考慮使用 Azure 專用連結",
+ "text": "使用 Microsoft Entra ID 報告功能生成訪問控制審核報告。",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
"severity": "高",
- "text": "確保所有必需的資源都駐留在同一個 Azure 可用性區域中",
- "waf": "性能"
+ "text": "為所有訂閱啟用Defender Cloud安全態勢管理。",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
- "severity": "中等",
- "text": "為 Azure VMware 解決方案來賓 VM 工作負載啟用 Microsoft Defender for Cloud",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "高",
+ "text": "為所有訂閱上的伺服器啟用Defender雲工作負載保護計劃。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
- "severity": "中等",
- "text": "使用已啟用 Azure Arc 的伺服器管理 Azure VMware 解決方案來賓 VM 工作負載",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "高",
+ "text": "在所有訂閱上為 Azure 資源啟用 Defender Cloud 工作負載保護計劃。",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
"severity": "高",
- "text": "在 Azure VMware 解決方案上啟用診斷和指標日誌記錄",
- "waf": "操作"
+ "text": "在 IaaS 伺服器上啟用 Endpoint Protection。",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
"severity": "中等",
- "text": "將Log Analytics代理部署到 Azure VMware 解決方案來賓 VM 工作負載",
- "waf": "操作"
+ "text": "通過 Azure Monitor 紀錄和 Defender for Cloud 監視基本作業系統修補偏差。",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
"severity": "中等",
- "text": "確保已針對 Azure VMware 解決方案 VM 工作負載記錄並實施了備份策略和解決方案",
- "waf": "操作"
+ "text": "將預設資源配置連接到集中式 Azure Monitor Log Analytics 工作區。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
- "severity": "中等",
- "text": "使用 Microsoft Defender for Cloud 對 Azure VMware 解決方案上運行的工作負載進行合規性監視",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
+ "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
+ "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
+ "service": "Entra",
+ "severity": "高",
+ "text": "使用關聯日誌進行集中威脅檢測 - 將安全數據整合到一個中心位置，以便通過SIEM（安全資訊和事件管理）在各種服務之間關聯數據",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
"severity": "中等",
- "text": "是否將適用的合規性基線添加到 Microsoft Defender for Cloud",
+ "text": "對於 Sovereign Landing Zone，請在 Entra ID 租戶上啟用透明度日誌。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
- "severity": "高",
- "text": "在選擇要用於 Azure VMware 解決方案部署的 Azure 區域時是否評估了數據駐留",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
+ "severity": "中等",
+ "text": "對於 Sovereign Landing Zone，請在 Entra ID 租戶上啟用客戶密碼箱。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
"severity": "高",
- "text": "數據處理影響（服務提供者/服務消費者模型）是否清晰且有據可查",
+ "text": "啟用到存儲帳戶的安全傳輸。",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
- "severity": "中等",
- "text": "僅當出於合規性原因需要時，才考慮將CMK（客戶管理的密鑰）用於 vSAN。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "高",
+ "text": "為存儲帳戶啟用容器軟刪除，以恢復已刪除的容器及其內容。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
"severity": "高",
- "text": "創建儀錶板以啟用核心 Azure VMware 解決方案監視見解",
+ "text": "使用 Key Vault 機密來避免對敏感資訊進行硬編碼，例如憑據（虛擬機用戶密碼）、證書或密鑰。",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
- "severity": "高",
- "text": "針對 Azure VMware 解決方案性能（CPU >80%、平均記憶體 >80%、vSAN >70%）自動警報的關鍵閾值創建警告警報",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果 AKS Windows 工作負載需要，可以使用 HostProcess 容器",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
- "severity": "高",
- "text": "確保創建嚴重警示以監控 vSAN 消耗量是否低於 75%，因為這是 VMware 的支援閾值",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果運行事件驅動的工作負載，請使用KEDA",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
- "severity": "高",
- "text": "確保為 Azure 服務運行狀況警報和通知配置警報",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
+ "severity": "低",
+ "text": "使用 Dapr 簡化微服務開發",
"waf": "操作"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
- "severity": "中等",
- "text": "將 Azure VMware 解決方案記錄設定為發送到 Azure 儲存帳戶或 Azure EventHub 進行處理",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
+ "severity": "高",
+ "text": "使用 SLA 支援的 AKS 產品/服務",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "低",
- "text": "如果需要深入瞭解 VMware vSphere：解決方案中是否使用了 vRealize Operations 和/或 vRealize Network Insights？",
- "waf": "操作"
+ "text": "在容器和部署定義中使用中斷預算",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"severity": "高",
- "text": "確保虛擬機的 vSAN 儲存策略不是預設存儲策略，因為此策略應用厚置備",
- "waf": "操作"
+ "text": "如果使用專用註冊表，請配置區域複製以將映像存儲在多個區域中",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
- "severity": "中等",
- "text": "確保未將 vSphere 內容庫放置在 vSAN 上，因為 vSAN 是有限的資源",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
+ "severity": "低",
+ "text": "使用外部應用（如 kubecost）將成本分配給不同的使用者",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
- "severity": "中等",
- "text": "確保備份解決方案的數據存儲庫存儲在 vSAN 儲存之外。在 Azure 本機或磁碟池支持的數據存儲中",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
+ "severity": "低",
+ "text": "使用縮減模式刪除/取消分配節點",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"severity": "中等",
- "text": "確保使用 Azure Arc for Servers 進行混合管理，確保在 Azure VMware 解決方案上運行的工作負載（Arc for Azure VMware 解決方案處於預覽狀態）",
- "waf": "操作"
+ "text": "需要時，請在 AKS 群集上使用多實例分組 GPU",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
- "severity": "中等",
- "text": "確保使用 Azure Log Analytics 和 Azure Monitor 監視在 Azure VMware 解決方案上運行的工作負載",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果運行開發/測試群集，請使用 NodePool Start/Stop",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"severity": "中等",
- "text": "在現有更新管理工具或 Azure 更新管理中包括在 Azure VMware 解決方案上運行的工作負載",
- "waf": "操作"
+ "text": "使用適用於 Kubernetes 的 Azure Policy 確保群集符合性",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"severity": "中等",
- "text": "使用 Azure Policy 在 Azure 管理、監視和安全解決方案中加入 Azure VMware 解決方案工作負載",
- "waf": "操作"
+ "text": "使用使用者/系統節點池將應用程式與控制平面分開",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
- "severity": "中等",
- "text": "確保在 Azure VMware 解決方案上運行的工作負載已載入 Microsoft Defender for Cloud",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
+ "severity": "低",
+ "text": "向系統節點池添加污點以使其專用",
"waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"severity": "中等",
- "text": "確保備份不存儲在 vSAN 上，因為 vSAN 是有限的資源",
- "waf": "可靠性"
+ "text": "對映像使用專用註冊表，例如 ACR",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "arm-service": "microsoft.containerregistry/registries",
+ "checklist": "Azure AKS Review",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"severity": "中等",
- "text": "是否考慮了所有災難恢復解決方案，並決定了最適合您業務的解決方案？[SRM/JetStream/Zerto/Veeam/...]",
- "waf": "可靠性"
+ "text": "掃描映像以查找漏洞",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
+ "severity": "高",
+ "text": "定義應用分離要求（命名空間/節點池/集群）",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"severity": "中等",
- "text": "當災難恢復技術是本機 Azure IaaS 時，請使用 Azure Site Recovery",
- "waf": "可靠性"
+ "text": "使用 CSI 機密存儲驅動程式將機密存儲在 Azure Key Vault 中",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"severity": "高",
- "text": "將自動恢復計劃與任一災難解決方案結合使用，盡可能避免手動任務",
- "waf": "可靠性"
+ "text": "如果將服務主體用於群集，請定期刷新憑據（如每季度）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"severity": "中等",
- "text": "使用地緣政治區域對作為輔助災難恢復環境",
- "waf": "可靠性"
+ "text": "如果需要，請添加金鑰管理服務 etcd 加密",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
- "severity": "高",
- "text": "在區域之間使用 2 個不同的地址空間，例如：10.0.0.0/16 和 192.168.0.0/16 用於不同的區域",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請考慮使用適用於 AKS 的機密計算",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"severity": "中等",
- "text": "ExpressRoute Global Reach 是用於主 Azure VMware 解決方案私有雲和輔助 Azure VMware 解決方案私有雲之間的連接，還是通過網路虛擬設備完成路由？",
- "waf": "可靠性"
+ "text": "考慮使用 Defender for Containers",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
- "severity": "中等",
- "text": "是否考慮了所有備份解決方案，並決定了最適合您業務的解決方案？[ MABS/CommVault/Metallic.io/Veeam/ .",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
+ "severity": "高",
+ "text": "使用託管標識而不是服務主體",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"severity": "中等",
- "text": "將備份解決方案部署在與 Azure VMware 解決方案私有雲相同的區域中",
- "waf": "可靠性"
+ "text": "將身份驗證與 AAD（使用託管集成）集成",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"severity": "中等",
- "text": "在 vSan 外部的 Azure 本機組件上部署備份解決方案",
- "waf": "可靠性"
+ "text": "限制對管理員 kubeconfig （get-credentials --admin） 的訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
- "severity": "低",
- "text": "是否已制定請求還原由 Azure 平臺管理的 VMware 元件的流程？",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "將授權與 AAD RBAC 集成",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
- "severity": "低",
- "text": "對於手動部署，必須記錄所有配置和部署",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
+ "severity": "高",
+ "text": "在 Kubernetes 中使用命名空間限制 RBAC 許可權",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
- "severity": "低",
- "text": "對於手動部署，請考慮實施資源鎖，以防止對 Azure VMware 解決方案私有雲執行意外操作",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "對於 Pod Identity Access Management，請使用 Azure AD 工作負載標識（預覽版）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
- "severity": "低",
- "text": "對於自動化部署，請部署最小的私有雲並根據需要進行擴展",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "對於 AKS 非互動式登錄名，請使用 kubelogin（預覽版）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
- "severity": "低",
- "text": "對於自動部署，請在開始部署之前請求或預留配額",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "禁用 AKS 本地帳戶",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
"severity": "低",
- "text": "對於自動部署，請確保通過自動化或 Azure Policy 創建相關資源鎖，以便進行適當的治理",
- "waf": "操作"
+ "text": "如果需要，請配置 Just-in-time 群集訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
"severity": "低",
- "text": "為 ExR 授權金鑰實現人類可理解的名稱，以便輕鬆識別密鑰的目的/用途",
- "waf": "操作"
+ "text": "如果需要，為 AKS 配置 AAD 條件訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
"severity": "低",
- "text": "當使用單獨的服務原則部署 Azure VMware 解決方案和 ExpressRoute 時，請使用 Key Vault 儲存機密和授權密鑰",
- "waf": "操作"
+ "text": "如果 Windows AKS 工作負載需要，請配置 gMSA",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
- "severity": "低",
- "text": "當需要在 Azure VMware 解決方案中/上部署許多資源時，定義用於在 IaC 中序列化操作的資源依賴項，因為 Azure VMware 解決方案僅支援有限數量的並行操作。",
- "waf": "操作"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "為了獲得更精細的控制，請考慮使用託管的 Kubelet 身份",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
- "severity": "低",
- "text": "使用單個 Tier-1 閘道執行 NSX-T 分段的自動配置時，請使用 Azure 門戶 API 而不是 NSX-Manager API",
- "waf": "操作"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"severity": "中等",
- "text": "打算使用自動橫向擴展時，請務必為運行 Azure VMware 解決方案的訂閱申請足夠的 Azure VMware 解決方案配額",
- "waf": "性能"
+ "text": "如果使用 AGIC，請勿跨集群共用 AppGW",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
- "severity": "中等",
- "text": "打算使用自動縮減時，請務必在執行此操作之前考慮存儲策略要求",
- "waf": "性能"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
+ "severity": "高",
+ "text": "不要使用 AKS HTTP 路由載入項，而是將託管 NGINX 入口與應用程式路由載入項一起使用。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"severity": "中等",
- "text": "擴展操作始終需要在單個 SDDC 中序列化，因為一次只能執行一個擴展操作（即使使用多個集群也是如此）",
+ "text": "對於 Windows 工作負載，請使用加速網路",
"waf": "性能"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
- "severity": "中等",
- "text": "考慮並驗證體系結構中使用的第三方解決方案的縮放操作（支援與否）",
- "waf": "性能"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
+ "severity": "高",
+ "text": "使用標準 ALB（而不是基本 ALB）",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"severity": "中等",
- "text": "在自動化中為環境定義和強制實施橫向擴展/橫向擴展最大限制",
- "waf": "性能"
+ "text": "如果使用 Azure CNI，請考慮對 NodePool 使用不同的子網",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"severity": "中等",
- "text": "實施監控規則以監控自動擴展操作，並監控成功和失敗，以啟用適當的（自動化）回應",
- "waf": "操作"
+ "text": "使用專用終結點（首選）或虛擬網路服務終結點從群集訪問 PaaS 服務",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "高",
- "text": "使用 MON 時，請注意同時配置的 VM 的限制（HCX 的 MON 限制 [400 - 標準，1000 - 大型設備]）",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "text": "選擇最適合你要求的 CNI 網路外掛程式（建議使用 Azure CNI）",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "高",
- "text": "使用 MON 時，不能在超過 100 個網路分機上啟用 MON",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
- "severity": "中等",
- "text": "如果使用 VPN 連接進行遷移，請相應地調整 MTU 大小。",
+ "text": "如果使用 Azure CNI，請根據每個節點的最大 Pod 數相應地調整子網的大小",
"waf": "性能"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
- "severity": "中等",
- "text": "對於連接到 Azure（500Mbps 或更低）的低連接區域，請考慮部署 HCX WAN 優化設備",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "高",
+ "text": "如果使用 Azure CNI，請檢查每個節點的最大 Pod 數（預設為 30）",
"waf": "性能"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
- "severity": "中等",
- "text": "確保從本地裝置啟動遷移，而不是從雲端裝置啟動遷移（不要執行反向遷移）",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "對於內部應用，組織通常會在其防火牆中打開整個AKS子網。這也會打開對節點的網路訪問，並可能打開對 Pod 的訪問（如果使用 Azure CNI）。如果 LoadBalancer IP 位於不同的子網中，則只有此子網可供應用用戶端使用。另一個原因是，如果 AKS 子網中的 IP 位址是稀缺資源，則將其 IP 位址用於服務會降低群集的最大可伸縮性。",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果使用專用IP LoadBalancer服務，請使用專用子網（而不是 AKS 子網）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
- "severity": "中等",
- "text": "使用 Azure Netapp Files 擴展 Azure VMware 解決方案的儲存時，請考慮將其用作 VMware 資料儲存庫，而不是直接附加到 VM 。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
+ "severity": "高",
+ "text": "相應調整服務 IP 位址範圍的大小（這將限制群集的可伸縮性）",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
- "severity": "中等",
- "text": "確保將專用 ExpressRoute 閘道用於外部資料儲存解決方案",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請添加您自己的 CNI 外掛程式",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
- "severity": "中等",
- "text": "確保在用於外部數據存儲解決方案的 ExpressRoute 閘道上啟用了 FastPath",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請在 AKS 中配置每個節點的公共 IP",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
- "severity": "高",
- "text": "如果使用延伸群集，請確保供應商支援所選的災難恢復解決方案",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "使用入口控制器公開基於 Web 的應用，而不是使用 LoadBalancer 類型的服務公開它們",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
- "severity": "高",
- "text": "如果使用延伸群集，請確保提供的 SLA 符合您的要求",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
+ "severity": "低",
+ "text": "使用 Azure NAT 閘道作為 outboundType 來縮放出口流量",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
- "severity": "高",
- "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都連接到連接中心。",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "使用IP的動態分配來避免 Azure CNI IP 耗盡",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"severity": "高",
- "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都啟用了 GlobalReach。",
- "waf": "可靠性"
+ "text": "如果安全要求要求，請使用 AzFW/NVA 篩選出口流量",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
- "checklist": "Azure VMware Solution Design Review",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
- "severity": "高",
- "text": "是否正確考慮了網站容災設置，並在需要時為您的業務進行了更改。",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"severity": "中等",
- "text": "利用靈活伺服器",
- "waf": "可靠性"
+ "text": "如果使用公共 API 終端節點，請限制可以存取它的 IP 位址",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
"severity": "高",
- "text": "利用區域適用的可用區",
- "waf": "可靠性"
+ "text": "如果要求要求，請使用私有集群",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
- "checklist": "MySQL Review Checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "中等",
- "text": "將數據傳入複製用於跨區域災難恢復方案",
- "waf": "可靠性"
+ "text": "對於 Windows 2019 和 2022 AKS 節點，可以使用 Calico 網路策略",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"severity": "高",
- "text": "遵循 Metaprompting 護欄，實現 realible AI",
- "waf": "卓越運營"
+ "text": "啟用 Kubernetes 網路策略選項 （Calico/Azure）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "高",
- "text": "考慮使用APIM或 AI central 等解決方案的閘道模式，以實現更好的速率限制、負載均衡、身份驗證和日誌記錄",
- "waf": "卓越運營"
+ "text": "使用 Kubernetes 網路策略提高集群內安全性",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"severity": "高",
- "text": "為您的 AOAI 實例啟用監控",
- "waf": "卓越運營"
+ "text": "將 WAF 用於 Web 工作負載（UI 或 API）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "建立警報以通知團隊有關事件的通知，例如由對資源執行的操作（例如重新生成其訂閱金閜）創建的活動日誌中的條目或指標閾值（例如一小時內超過 10 的錯誤數）",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "在 AKS 虛擬網路中使用 DDoS 標準",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "監控令牌使用方式，防止由於容量導致服務中斷",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請添加公司 HTTP 代理",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"severity": "中等",
- "text": "觀察已處理的推理令牌、生成的完成令牌等指標，監視速率限制",
- "waf": "卓越運營"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
- "severity": "低",
- "text": "如果診斷對你來說還不夠，請考慮在 Azure OpenAI 前面使用閘道（例如 Azure API 管理）來記錄傳入提示和傳出回應（如果允許）",
- "waf": "卓越運營"
+ "text": "考慮使用服務網格進行高級微服務通信管理",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"severity": "高",
- "text": "使用基礎結構即代碼部署 Azure OpenAI 服務、模型部署和所有相關資源",
- "waf": "卓越運營"
+ "text": "設定有關最關鍵指標的警報（請參閱容器見解以獲取建議）",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "將 Microsoft Entra 身份驗證與託管標識（而不是 API 金鑰）配合使用",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
+ "severity": "低",
+ "text": "定期查看 Azure 顧問，瞭解有關群集的建議",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用已知的黃金數據集評估系統的性能/準確性，該數據集具有輸入和正確答案。利用 PromptFlow 中的功能進行評估。",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
+ "severity": "低",
+ "text": "啟用 AKS 自動證書輪換",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"severity": "高",
- "text": "評估預配輸送量模型的使用方式",
- "waf": "性能"
+ "text": "定期（例如，每季度）升級 kubernetes 版本，或使用 AKS 自動升級功能",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
"severity": "高",
- "text": "查看和實施 Azure AI 內容安全性",
- "waf": "卓越運營"
+ "text": "如果您不使用 node-image 升級，請使用 kured 進行 Linux 節點升級",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"severity": "高",
- "text": "根據令牌數和每分鐘的回應來定義和評估系統的輸送量，並符合要求",
- "waf": "性能"
+ "text": "定期（例如，每周）升級群集節點映像的常規過程",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "通過限制令牌大小、流式處理選項來改善系統的延遲",
- "waf": "性能"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
+ "severity": "低",
+ "text": "考慮使用 gitops 將應用程式或集群配置部署到多個集群",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "估計彈性需求，以根據優先順序確定同步和批量請求分離。對於高優先順序，使用同步方法，對於低優先順序，首選使用佇列的異步批處理",
- "waf": "性能"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "根據消費者的估計需求對代幣消費要求進行基準測試。如果使用的是預設輸送量單元部署，請考慮使用 Azure OpenAI 基準測試工具來幫助驗證輸送量",
- "waf": "性能"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
+ "severity": "低",
+ "text": "請考慮在專用群集上使用 AKS 命令調用",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "如果您使用的是預設輸送量單位 （PTU），請考慮為溢出請求部署每分鐘令牌 （TPM） 部署。當達到 PTU 限制時，使用閘道將請求路由到 TPM 部署。",
- "waf": "性能"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
+ "severity": "低",
+ "text": "對於計劃的事件，請考慮使用 Node Auto Drain",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"severity": "高",
- "text": "為正確的任務選擇正確的模型。選擇在速度、回應質量和輸出複雜性之間做出正確權衡的模型",
- "waf": "性能"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "有一個性能基線，而不進行微調，以瞭解微調是否提高了模型性能",
- "waf": "性能"
+ "text": "開發自己的治理實踐，以確保節點 RG（又名“基礎設施 RG”）中的操作員不會執行任何更改",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"severity": "低",
- "text": "跨區域部署多個 OAI 實例",
- "waf": "可靠性"
+ "text": "使用自定義節點 RG（又名“Infra RG”）名稱",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用閘道模式（如 APIM）實現重試和運行狀況檢查",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "請勿在 YAML 清單中使用已棄用的 Kubernetes API",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "確保為工作負載提供足夠的 TPM 和 RPM 配額",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
+ "severity": "低",
+ "text": "污染 Windows 節點",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "查看 HAI 工具包指南中的注意事項，並將這些交互實踐應用於 slution",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
+ "severity": "低",
+ "text": "使 Windows 容器修補程式級別與主機修補程式級別保持同步",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "如果採用微調，則跨區域部署單獨的微調模型",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "通過群集級別的診斷設置",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
+ "severity": "低",
+ "text": "將主日誌（又名 API 紀錄）發送到 Azure Monitor 或首選日誌管理解決方案",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "定期備份和複製關鍵數據，以確保數據丟失或系統故障時的數據可用性和可恢復性。利用 Azure 的備份和災難恢復服務來保護數據。",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請使用 nodePool 快照",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "應選擇 Azure AI 搜索服務層級以具有 SLA",
- "waf": "可靠性"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
+ "severity": "低",
+ "text": "考慮將現成節點池用於對時間敏感的工作負載",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "低",
- "text": "對數據和敏感度進行分類，在生成嵌入之前使用 Microsoft Purview 進行標記，並確保以相同的敏感度和分類處理生成的嵌入",
- "waf": "安全"
+ "text": "考慮用於快速突發的 AKS 虛擬節點",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "高",
- "text": "使用 SSE/磁碟加密和可選的 BYOK 加密來加密用於 RAG 的數據",
- "waf": "安全"
+ "text": "使用 Container Insights（或 Prometheus 等其他工具）監控集群指標",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"severity": "高",
- "text": "確保對跨數據源傳輸的數據實施 TLS，用於檢索增強生成 （RAG） 和 LLM 通信的 AI 搜索",
- "waf": "安全"
+ "text": "使用 Container Insights（或 Telegraf/ElasticSearch 等其他工具）存儲和分析集群日誌",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用 RBAC 管理對 Azure OpenAI 服務的訪問。為使用者分配適當的許可權，並根據其角色和職責限制訪問許可權",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "監控節點的 CPU 和記憶體利用率",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"severity": "中等",
- "text": "實施數據加密、遮罩或編輯技術，以在非生產環境中或出於測試或故障排除目的共用數據時隱藏敏感數據或將其替換為混淆值",
- "waf": "安全"
+ "text": "如果使用 Azure CNI，請監視每個節點消耗的 Pod IP 的百分比",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "利用 Azure Defender 來檢測和回應安全威脅，並設置監視和警報機制來識別可疑活動或違規行為。利用 Azure Sentinel 進行高級威脅檢測和回應",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "OS 磁碟上的 I/O 是關鍵資源。如果節點中的操作系統在 I/O 上受到限制，這可能會導致不可預知的行為，通常最終導致節點被聲明為 NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "監視節點中的OS磁碟佇列深度",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"severity": "中等",
- "text": "制定數據保留和處置策略，以遵守合規性法規。對不再需要的數據實施安全刪除方法，並維護數據保留和處置活動的審計跟蹤",
- "waf": "安全"
+ "text": "如果不對 AzFW/NVA 使用出口篩選，請監視標準 ALB 分配的 SNAT 連接埠",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用 Content Safety 實施 Prompt shields 和接地檢測",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "訂閱 AKS 群集的資源運行狀況通知",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "高",
- "text": "通過實施隱私控制並獲得數據處理活動所需的同意或許可，確保遵守相關的數據保護法規，例如GDPR或HIPAA。",
- "waf": "安全"
+ "text": "在 Pod 規範中配置請求和限制",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"severity": "中等",
- "text": "對員工進行有關數據安全最佳實踐、安全處理數據的重要性以及與數據洩露相關的潛在風險的教育。鼓勵他們勤奮地遵循數據安全協定。",
- "waf": "安全"
+ "text": "強制實施命名空間的資源配額",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
"severity": "高",
- "text": "將生產數據與開發和測試數據分開。僅在生產中使用真實的敏感數據，並在開發和測試環境中使用匿名或合成數據。",
- "waf": "安全"
+ "text": "確保訂閱具有足夠的配額來橫向擴展節點池",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"severity": "中等",
- "text": "如果您具有不同級別的數據敏感度，請考慮為每個級別創建單獨的索引。例如，您可以有一個用於常規數據的索引，另一個用於敏感數據的索引，每個索引都由不同的訪問協定管理",
- "waf": "安全"
+ "text": "使用群集自動縮放程式",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "通過將敏感數據集放置在服務的不同實例中，進一步實現隔離。每個實例都可以使用其自己的特定 RBAC 策略集進行控制",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
+ "severity": "低",
+ "text": "自定義 AKS 節點池的節點配置",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "認識到從敏感資訊生成的嵌入和向量本身就是敏感的。這些數據應得到與源材料相同的保護措施",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "需要時使用 Horizontal Pod Autoscaler",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "description": "更大的節點將帶來更高的性能和功能，例如臨時磁碟和加速網路，但它們會增加爆炸半徑並降低擴展粒度",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
"severity": "高",
- "text": "將 RBAC 應用於具有嵌入和向量的數據存儲，並根據角色的訪問要求確定存取範圍",
- "waf": "安全"
+ "text": "考慮適當的節點大小，不要太大或太小",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "為 AI 服務配置專用終結點，以限制網路內的服務訪問",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果可伸縮性需要超過 5000 個節點，請考慮使用其他 AKS 群集",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用 Azure 防火牆和 UDR 強制實施嚴格的入站和出站流量控制，並限制外部集成點",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
+ "severity": "低",
+ "text": "考慮訂閱 EventGrid Events for AKS 自動化",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "實施網路分段和訪問控制，將 LLM 應用程式的存取限製為僅授權使用者和系統，並防止橫向行動",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
+ "service": "AKS",
+ "severity": "低",
+ "text": "若要在 AKS 群集上長時間運行操作，請考慮事件終止",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "使用提示壓縮工具，如 LLMLingua 或 gprtrim",
- "waf": "成本優化"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
+ "service": "AKS",
+ "severity": "低",
+ "text": "如果需要，請考慮將 Azure 專用主機用於 AKS 節點",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"severity": "高",
- "text": "確保 LLM 應用程式使用的 API 和端點使用身份驗證和授權機制（例如託管標識、API 金鑰或 OAuth）得到適當保護，以防止未經授權的訪問。",
- "waf": "安全"
+ "text": "使用臨時OS磁碟",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "實施強大的最終使用者身份驗證機制，例如多因素身份驗證，以防止對 LLM 應用程式和相關網路資源的未經授權的訪問",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "AKS",
+ "severity": "高",
+ "text": "對於非臨時磁碟，在運行多個 Pod/節點時，請為節點使用高 IOPS 和更大的 OS 磁碟，因為它需要高性能才能運行多個 Pod，並且會生成具有預設 AKS 日誌輪換閾值的大量日誌",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "實施網路監控工具，以檢測和分析網路流量中的任何可疑或惡意活動。啟用日誌記錄以捕獲網路事件，並在發生安全事件時促進取證分析",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
+ "service": "AKS",
+ "severity": "低",
+ "text": "對於超高性能存儲選項，請在 AKS 上使用超級磁碟For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "進行安全審計和滲透測試，以識別和解決LLM應用程式的網路基礎設施中的任何網路安全弱點或漏洞",
- "waf": "安全"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "避免將狀態保留在群集中，並將數據存儲在外部（AzStorage、AzSQL、Cosmos 等）",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
- "severity": "低",
- "text": "Azure AI 服務已正確標記，以便更好地管理",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "如果使用 AzFiles Standard，出於性能原因，請考慮使用 AzFiles Premium 和/或 ANF",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
- "severity": "低",
- "text": "Azure AI 服務帳戶遵循組織命名約定",
- "waf": "卓越運營"
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Azure AKS Review",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
+ "service": "AKS",
+ "severity": "中等",
+ "text": "如果使用 Azure 磁碟和可用區，請考慮在區域內為 LRS 磁碟設置節點池，並使用 VolumeBindingMode：WaitForFirstConsumer 在正確的區域中預配存儲，或將 ZRS 磁碟用於跨多個區域的節點池",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "應啟用 Azure AI 服務資源中的診斷日誌",
- "waf": "卓越運營"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
+ "service": "Azure Data Factory",
+ "severity": "中等",
+ "text": "利用 Azure 數據工廠的 FTA 復原能力手冊",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
"severity": "高",
- "text": "為了安全起見，建議禁用密鑰訪問（本地身份驗證）。 禁用基於密鑰的訪問后，Microsoft Entra ID 將成為唯一的訪問方法，該方法允許保持最小許可權原則和精細控制。",
- "waf": "安全"
+ "text": "在支援可用區的區域中使用區域冗餘管道",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用 Azure Key Vault 安全地存儲和管理密鑰。避免在 LLM 應用程式的代碼中硬編碼或嵌入敏感密鑰，並使用託管標識從 Azure Key Vault 中安全地檢索它們",
- "waf": "安全"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
+ "link": "https://learn.microsoft.com/azure/data-factory/source-control",
+ "service": "Azure Data Factory",
+ "severity": "中等",
+ "text": "使用 DevOps 透過 Github/Azure DevOps 集成備份 ARM 範本",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "定期輪換和過期存儲在 Azure Key Vault 中的密鑰，以最大程度地降低未經授權訪問的風險。",
- "waf": "安全"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "中等",
+ "text": "請確保在另一個區域中複製自承載集成運行時 VM",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "使用 tiktoken 了解對話模式下令牌優化的令牌大小",
- "waf": "成本優化"
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
+ "service": "Azure Data Factory",
+ "severity": "中等",
+ "text": "請確保在姊妹區域中複製或複製您的網路。必須在另一個區域創建 Vnet 的副本",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "遵循安全編碼做法，以防止常見漏洞，例如注入攻擊、跨網站腳本 （XSS） 或安全配置錯誤",
+ "arm-service": "Microsoft.DataFactory/datafactories",
+ "checklist": "Azure Data Factory Review Checklist",
+ "description": "如果ADF管道使用Key Vault，則無需執行任何操作即可複製Key Vault。Key Vault 是一項託管服務，Microsoft 會為你處理它",
+ "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Azure Data Factory",
+ "severity": "低",
+ "text": "如果使用 Keyvault 集成，請使用 Keyvault 的 SLA 來瞭解可用性",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure 事件中心提供靜態數據加密。如果使用自己的金鑰，則仍使用 Microsoft 管理的金鑰對數據進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "severity": "低",
+ "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "設置一個流程來定期更新和修補 LLM 庫和其他系統元件",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure 事件中心命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將事件中心命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。如果事件中心命名空間需要最低版本的 TLS，則使用舊版本發出的任何請求都將失敗。",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
+ "severity": "中等",
+ "text": "對請求強制實施傳輸層安全性 （TLS） 的最低要求版本",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
- "severity": "高",
- "text": "遵守 Azure OpenAI 或其他 LLM 的使用條款、策略和指南以及允許的用例",
- "waf": "卓越運營"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "創建事件中心命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的策略規則。此策略具有整個命名空間的管理許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。建議將 AAD 用作 RBAC 的身份驗證提供程式。",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
+ "severity": "中等",
+ "text": "避免在不必要的情況下使用root帳戶",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure 資源的託管標識可以使用 Azure AD 憑據從 Azure 虛擬機 （VM）、函數應用、虛擬機規模集和其他服務中運行的應用程式授權訪問事件中心資源。通過將 Azure 資源的託管標識與 Azure AD 身份驗證結合使用，可以避免將憑據存儲在雲中運行的應用程式中。",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "了解基礎模型和微調模型的成本差異以及令牌步長",
- "waf": "成本優化"
+ "text": "如果可能，應用程式應使用託管標識向 Azure 事件中心進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中擁有存儲憑據（SAS、服務主體憑據）",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "創建許可權時，請對用戶端對 Azure 事件中心的訪問提供精細控制。Azure 事件中心中的許可權可以而且應該限定為單個資源級別，例如消費者組、事件中心實體、事件中心命名空間等。",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"severity": "高",
- "text": "在可能的情況下，批量請求，以最大程度地減少每次調用的開銷，從而降低總體成本。確保優化批量大小",
- "waf": "成本優化"
+ "text": "使用最低特權數據平面 RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "Azure 事件中心資源日誌包括操作日誌、虛擬網路和 Kafka 日誌。運行時審核日誌捕獲事件中心中所有數據平面訪問操作（例如發送或接收事件）的聚合診斷資訊。",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "設置成本跟蹤系統，用於監視模型使用方式，並使用該資訊來説明通知模型選擇和提示大小",
- "waf": "成本優化"
+ "text": "啟用記錄以進行安全調查。使用 Azure Monitor 捕獲指標和日誌，例如資源日誌、運行時審核日誌和 Kafka 紀錄",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "默認情況下，Azure 事件中心具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路和 Azure 事件中心之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公共終結點，則應禁用這些終結點。",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "為每個模型回應的令牌數設置最大限制。優化大小以確保其足夠大以實現有效的回應",
- "waf": "成本優化"
+ "text": "請考慮使用專用終結點訪問 Azure 事件中心，並在適用時禁用公用網路訪問。",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "使用IP防火牆，可以將公共終結點進一步限製為僅一組IPv4位址或 CIDR（無類別域間路由）表示法的IPv4位址範圍。",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "查看提供的有關設置 AI 搜索以實現可靠性的指南",
- "waf": "卓越運營"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "規劃和管理 AI 搜索向量存儲",
- "waf": "卓越運營"
+ "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 事件中心命名空間",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "應用 LLMOps 實踐來自動化 GenAI 應用程式的生命週期管理",
- "waf": "卓越運營"
+ "text": "利用 FTA 彈性手冊",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "對於從門戶創建的新 EH 命名空間，在啟用區域的區域中具有高級、專用或標準 SKU，將自動啟用此功能。EH 元數據和事件數據本身都是跨區域複製的",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"severity": "高",
- "text": "評估計費模型的使用方式 - PAYG 與 PTU",
- "waf": "成本優化"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "在模型版本之間切換時評估提示和應用程式的品質",
- "waf": "卓越運營"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "評估、監控和優化您的 GenAI 應用程式的特性，如接地氣、相關性、準確性、連貫性、流暢性、",
- "waf": "卓越運營"
+ "text": "利用可用區（如果區域適用）",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "根據不同的搜索參數評估 Azure AI 搜尋結果",
- "waf": "卓越運營"
+ "text": "使用高級或專用 SKU 實現可預測的性能",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
- "severity": "中等",
- "text": "只有在嘗試了其他基本方法（如提示工程和RAG處理數據）時，才將微調模型視為提高準確性的方法",
- "waf": "卓越運營"
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "啟用內置異地災難恢復功能后，可確保命名空間的整個配置（事件中心、消費者組和設置）從主命名空間持續複製到輔助命名空間，並允許隨時從主命名空間向輔助命名空間進行一次故障轉移。主動/被動功能旨在更輕鬆地從失敗的 Azure 區域中恢復和放棄，而無需更改應用程式配置",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
+ "severity": "高",
+ "text": "使用主動被動配置規劃異地災難恢復",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "description": "應用於無法容忍關閉區域中事件數據中斷或丟失的DR配置。對於這些情況，請遵循複製指南，不要使用內置的異地災難恢復功能（主動/被動）。使用「主動/主動」時，在不同區域和命名空間中維護多個事件中心，事件將在中心之間複製",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "使用提示工程技術來提高 LLM 回應的準確性",
- "waf": "卓越運營"
+ "text": "對於業務關鍵型應用程式，請使用 Active Active 配置",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "Azure Event Hub Review",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"severity": "中等",
- "text": "紅隊您的 GenAI 應用程式",
- "waf": "安全"
+ "text": "設計可復原的事件中心",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"severity": "中等",
- "text": "為最終使用者提供 LLM 回應的評分選項並跟蹤這些分數。",
- "waf": "卓越運營"
+ "text": "利用靈活伺服器",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"severity": "高",
- "text": "考慮配額管理做法",
- "waf": "成本優化"
+ "text": "利用區域適用的可用區",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "Azure OpenAI Review",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "arm-service": "Microsoft.DBforMySQL/servers",
+ "checklist": "MySQL Review Checklist",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"severity": "中等",
- "text": "使用負載均衡器解決方案（如基於APIM的閘道）在服務和區域之間平衡負載和容量",
- "waf": "卓越運營"
+ "text": "將數據傳入複製用於跨區域災難恢復方案",
+ "waf": "可靠性"
},
{
"arm-service": "microsoft.network/frontdoors",
@@ -4392,5595 +4375,5612 @@
"waf": "安全"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"severity": "中等",
- "text": "利用 Azure 數據工廠的 FTA 復原能力手冊",
+ "text": "遵循 Azure 機器人服務中的可靠性支持建議",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e503547c-d447-4e82-9138-a7200f1cac6d",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "高",
- "text": "在支援可用區的區域中使用區域冗餘管道",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
+ "severity": "中等",
+ "text": "部署具有本地數據駐留和區域合規性的機器人",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511",
- "link": "https://learn.microsoft.com/azure/data-factory/source-control",
- "service": "Azure Data Factory",
+ "arm-service": "Microsoft.BotService/botServices",
+ "checklist": "Azure Bot Service",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
"severity": "中等",
- "text": "使用 DevOps 透過 Github/Azure DevOps 集成備份 ARM 範本",
+ "text": "Azure 機器人服務在全域和區域服務的主動-主動模式下運行。發生中斷時，無需檢測錯誤或管理服務。Azure 機器人服務在多區域地理體系結構中自動執行自動故障轉移和自動恢復。對於歐盟機器人區域服務，Azure 機器人服務在歐洲境內提供兩個完整區域，並提供主動/主動複製，以確保冗餘。對於全球機器人服務，所有可用的區域/地理位置都可以作為全球足跡。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "中等",
- "text": "請確保在另一個區域中複製自承載集成運行時 VM",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
+ "severity": "高",
+ "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery",
- "service": "Azure Data Factory",
- "severity": "中等",
- "text": "請確保在姊妹區域中複製或複製您的網路。必須在另一個區域創建 Vnet 的副本",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
+ "severity": "高",
+ "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.DataFactory/datafactories",
- "checklist": "Azure Data Factory Review Checklist",
- "description": "如果ADF管道使用Key Vault，則無需執行任何操作即可複製Key Vault。Key Vault 是一項託管服務，Microsoft 會為你處理它",
- "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Azure Data Factory",
- "severity": "低",
- "text": "如果使用 Keyvault 集成，請使用 Keyvault 的 SLA 來瞭解可用性",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
+ "severity": "高",
+ "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "請考慮「存儲的 Azure 安全基線”",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"severity": "高",
- "text": "考慮將專用終結點用於 Azure 存儲",
- "waf": "安全"
+ "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Logic Apps checklist",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"severity": "中等",
- "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
- "waf": "安全"
+ "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"severity": "高",
- "text": "為所有存儲帳戶啟用 Microsoft DefenderEnable Defender for all of your storage accounts",
- "waf": "安全"
+ "text": "根據您的業務和 SLO 要求選擇正確的功能託管計劃",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "軟刪除機制允許恢復意外刪除的 Blob。",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "為 blob 啟用“軟刪除”",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
+ "severity": "高",
+ "text": "利用區域適用的可用區（不適用於消耗層）",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
"severity": "中等",
- "text": "禁用 blob 的“軟刪除”",
- "waf": "安全"
+ "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "容器的軟刪除使你能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
"severity": "高",
- "text": "為容器啟用“軟刪除”",
- "waf": "安全"
+ "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "Azure Functions",
+ "severity": "高",
+ "text": "確保為應用服務計劃上運行的所有函數應用啟用“始終開啟”",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"severity": "中等",
- "text": "禁用容器的“軟刪除”",
- "waf": "安全"
+ "text": "將函數應用與其自己的存儲帳戶配對。盡量不要重用函數應用的存儲帳戶，除非它們緊密耦合",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "通過強制使用者在刪除之前先刪除刪除鎖，防止意外刪除存儲帳戶",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
- "severity": "高",
- "text": "在存儲帳戶上啟用資源鎖",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Azure Function Review",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
+ "severity": "中等",
+ "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護函數應用代碼",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，這樣就無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;存儲帳戶包含不可變 blob 後，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
- "severity": "高",
- "text": "考慮不可變的 blob",
- "waf": "安全"
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
+ "text": "Azure Monitor 中的數據收集規則 -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
+ "text": "檢查未找到底層數據源的備份實例",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
+ "text": "刪除或存檔未關聯的服務（磁碟、網卡、IP 位址等）",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
+ "text": "考慮在網站恢復存儲和非任務關鍵型應用程式的備份之間取得良好的平衡",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
+ "text": "檢查 40 個不同 Log Analytics 工作區之間的支出和節省機會 - 對非生產工作區使用不同的保留和數據收集 - 創建每日上限以實現意識和層大小調整 - 如果確實設置了每日上限，除了在達到上限時創建警報外，請確保還創建警報規則，以便在達到某個百分比（例如 90%）時收到通知。- 如果可能，考慮工作空間改造 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
+ "text": "強制執行清除日誌策略和自動化（如果需要，可以將記錄移至冷存儲）",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
+ "text": "檢查磁碟是否確實需要，如果不是：刪除。如果需要，請尋找較低的儲存層或使用備份 -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "成本"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並對伺服器進行身份驗證。",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
- "severity": "高",
- "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
- "waf": "安全"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
+ "text": "考慮使用自定義規則將未使用的存儲移動到較低層 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
+ "text": "確保 advisor 配置為適合 VM 大小調整",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "description": "通過在成本分析系統中搜索計量類別許可證進行檢查",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
+ "text": "在所有 Windows VM 上運行腳本 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server - 如果頻繁創建 Windows VM，請考慮實施策略",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
+ "text": "如果您已經擁有許可證，也可以將其置於 AHUB https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
+ "text": "使用靈活性選項（不超過 4-5 個系列）整合保留的 VM 系列",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
+ "text": "利用 Azure 預留實例：此功能允許將 VM 預留 1 年或 3 年，與 PAYG 價格相比，可顯著節省成本。",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
+ "text": "只能保留較大的磁碟 => 1 TiB -",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
+ "text": "調整大小優化后",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Sql/servers",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "text": "檢查是否適用並強制執行策略/更改 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
+ "text": "虛擬機 + 許可證部分折扣 （ahub + 3YRI） 約為 70% 的折扣",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
+ "text": "考慮使用 VMSS 來滿足需求，而不是按比例調整",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "microsoft.containerservice/managedClusters",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "AKS",
+ "text": "使用 AKS 自動縮放程式符合群集使用方式（確保 Pod 要求與縮放程式符合）",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
+ "text": "將恢復點移至保管庫存檔（如果適用）（驗證）",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
- "severity": "高",
- "text": "強制實施 HTTPS（禁用 HTTP）時，請檢查是否未對儲存帳戶使用自定義域 （CNAME）。",
- "waf": "安全"
+ "arm-service": "Microsoft.Databricks/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "text": "請考慮盡可能使用帶回退功能的現成 VM。考慮群集的自動終止。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於將憑據丟失的風險降至最低。",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
+ "text": "功能 - 重用連接",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "在可能的情況下，AAD 令牌應優先於共用訪問簽名",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "高",
- "text": "使用 Azure Active Directory （Azure AD） 令牌進行 blob 訪問",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
+ "text": "函數 - 本地快取資料",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "將角色分配給使用者、組或應用程式時，請僅向該安全主體授予他們執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "IaM 許可權中的最低特權",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
+ "text": "函數 - 冷啟動 - 使用“從包運行”功能。這樣，代碼將下載為單個 zip 檔。例如，這可以顯著改進具有大量節點模組的 Javascript 函數。使用特定於語言的工具來減小包大小，例如，搖樹 Javascript 應用程式。",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但比服務 SAS 具有安全優勢。",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "高",
- "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "text": "功能 - 保持功能溫暖",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取密鑰副本，但一旦密鑰掌握在多個人手中，就不可能將使用方式歸因於特定使用者。僅依靠 AAD 身份驗證可以更輕鬆地將存儲存取許可權綁定到使用者。",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
- "severity": "高",
- "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 AAD 訪問（和使用者委派 SAS）。",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
+ "text": "使用具有不同功能的自動縮放時，可能會有一個資源驅動所有資源的所有自動縮放 - 請考慮將其移動到單獨的消耗計劃（並考慮更高的 CPU 計劃）",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "使用活動日誌數據來標識查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "高",
- "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
+ "text": "給定計劃中的函數應用都縮放在一起，因此縮放的任何問題都可能影響計劃中的所有應用。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果指定的時間間隔已過且鍵尚未旋轉，則會顯示提醒。",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
- "waf": "安全"
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
+ "text": "我需要為「等待時間」付費嗎？這個問題通常是在執行異步操作並等待結果的 C# 函數的上下文中提出的，例如 await Task.Delay（1000） 或 await client。GetAsync（'http：//google.com'）。答案是肯定的 - GB 秒計算基於函數的開始和結束時間以及該時間段內的記憶體使用方式。在這段時間內實際發生的CPU活動未計入計算。此規則的一個例外是，如果使用的是持久函數。您無需為在業務流程協調程式函數中等待所花費的時間付費。在可能的情況下應用需求塑造技術（開發環境？）https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS 過期策略指定 SAS 有效的建議時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們會看到警告。",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "考慮配置 SAS 過期策略",
- "waf": "安全"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
+ "text": "Frontdoor - 關閉預設主頁在應用的應用程式設置中，將 AzureWebJobsDisableHomepage 設置為 true。這將向PoP返回204（無內容），因此僅返回標頭數據。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "存儲存取策略提供了撤銷服務 SAS 許可權的選項，而無需重新生成儲存帳戶密鑰。",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "考慮將 SAS 連結到儲存存取策略",
- "waf": "安全"
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
+ "text": "Frontdoor - 路由到不返回任何內容的內容。設置函數、函數代理，或在 WebApp 中添加返回 200 （OK） 且不發送內容或發送最少內容的路由。這樣做的好處是您可以在調用時註銷。",
+ "waf": "成本"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
- "waf": "安全"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
+ "text": "考慮為使用較少的數據存檔層",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中使用存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "高",
- "text": "請考慮將連接字串儲存在 Azure KeyVault 中（在無法實現託管標識的情況下）",
- "waf": "安全"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
+ "text": "檢查大小與層不匹配的磁碟大小（即 513 GiB 磁碟將支付 P30 （1TiB） 並考慮調整大小",
+ "waf": "成本"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只能在很短的時間內有效。如果無法引用存儲訪問策略，則此做法尤為重要。近期過期時間還通過限制可上傳到 blob 的時間來限制可寫入 blob 的數據量。",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "高",
- "text": "爭取縮短臨時 SAS 的有效期",
- "waf": "安全"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
+ "text": "盡可能考慮使用標準 SSD，而不是 Premium 或 Ultra",
+ "waf": "成本"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "創建 SAS 時，請盡可能具體和嚴格。首選單個資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "將窄範圍應用於SAS",
- "waf": "安全"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
+ "text": "對於存儲帳戶，請確保所選層不會增加事務費用（移動到下一層可能會更便宜）",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
- "waf": "安全"
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
+ "text": "對於 ASR，如果 RPO/RTO 和複製輸送量允許，請考慮使用標準 SSD 磁碟",
+ "waf": "成本"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "SAS 無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能是有意義的。",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "低",
- "text": "請考慮在用戶端使用SAS上傳檔后檢查上傳的數據。",
- "waf": "安全"
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
+ "text": "存儲帳戶：檢查熱層和/或 GRS 必填",
+ "waf": "成本"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
+ "text": "磁碟 - 驗證高級 SSD 磁碟在任何地方的使用方式：例如，非生產磁碟可以交換到標準 SSD 或按需高級 SSD",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "使用「本地使用者帳戶」通過 SFTP 訪問 Blob 儲存時，“通常”RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更嚴格。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點當前支援的唯一身份管理形式",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
- "severity": "高",
- "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核一段時間內是否需要訪問。",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
+ "text": "創建預算以管理成本並創建警報，自動通知利益相關者支出異常和超支風險。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
+ "text": "將成本數據匯出到存儲帳戶以進行其他數據分析。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "存儲支援 CORS（跨域資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放寬同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
- "severity": "高",
- "text": "避免過於寬泛的 CORS 策略",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
+ "text": "通過在不使用資源時暫停資源來控制專用 SQL 池的成本。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
- "severity": "高",
- "text": "確定應如何加密靜態數據。了解數據的線程模型。",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
+ "text": "啟用無伺服器 Apache Spark 自動暫停功能，並相應地設置超時值。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "確定應使用哪種/是否應使用平臺加密。",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
+ "text": "創建多個不同大小的 Apache Spark 池定義。",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "確定應使用哪種/是否應使用用戶端加密。",
- "waf": "安全"
+ "arm-service": "Microsoft.Synapse/workspaces",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
+ "text": "使用預購計劃購買為期一年的 Azure Synapse 提交單元 （SCU），以節省 Azure Synapse Analytics 成本。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Blob Storage Review",
- "description": "利用 Resource Graph 資源管理器（資源 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true）查找允許匿名 blob 訪問的存儲帳戶。",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
- "severity": "高",
- "text": "考慮是否需要公共 blob 訪問，或者是否可以對某些存儲帳戶禁用公共 blob 訪問。",
- "waf": "安全"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
+ "text": "將現成 VM 用於可中斷作業：這些 VM 可以以折扣價競標和購買，為非關鍵工作負載提供經濟高效的解決方案。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "高",
- "text": "使 2 個副本具有 99.9% 的讀取操作可用性",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
+ "text": "合理調整所有 VM 的大小",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
- "severity": "中等",
- "text": "使 3 個副本具有 99.9% 的讀/寫操作可用性",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
+ "text": "將 VM 大小與規範化大小和最新大小交換",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
- "severity": "高",
- "text": "通過啟用讀取和/或寫入副本來利用可用區",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "調整 VM 大小 - 從低於 5% 的監視使用率開始，然後工作到 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
- "severity": "中等",
- "text": "對於區域冗餘，請在2個或更多區域中為搜索手動創建服務，因為它不提供跨地理區域複製搜索索引的自動方法",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Cost Optimization Checklist",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
+ "text": "容器化應用程式可以提高 VM 密度並節省擴展成本",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "成本"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
- "severity": "中等",
- "text": "若要跨多個服務同步數據，請使用索引器更新多個服務上的內容，或使用 REST API 推送多個服務上的內容更新",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
+ "severity": "高",
+ "text": "確保在本機 Azure 的標識訂閱中部署了 ADDS 域控制器",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 Azure 流量管理器協調請求",
- "waf": "可靠性"
+ "text": "確保將 ADDS 網站和服務配置為將來自基於 Azure 的資源（包括 Azure VMware 解決方案）的身份驗證請求保留到 Azure 本地",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Search/searchServices",
- "checklist": "Cognitive Search Review Checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"severity": "高",
- "text": "備份和還原 Azure 認知搜索索引。使用此範例代碼將索引定義和快照備份到一系列 Json 檔",
- "waf": "可靠性"
+ "text": "確保 vCenter 已連接到 ADDS，以啟用基於「指定用戶帳戶」的身份驗證",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
- "severity": "低",
- "text": "有關最佳實踐，請參閱基線高可用性區域冗餘 Web 應用程式體系結構",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "確保從 vCenter 到 ADDS 的連接使用安全協定 （LDAPS）",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"severity": "中等",
- "text": "使用高級層和標準層。這些層支援暫存槽和自動備份。",
- "waf": "可靠性"
+ "text": "vCenter IdP 中的 CloudAdmin 帳戶僅用作緊急帳戶 （break-glass）",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"severity": "高",
- "text": "利用區域適用的可用性區域（需要高級 v2 或 v3 層）",
- "waf": "可靠性"
+ "text": "確保 NSX-Manager 與外部身份提供程式 （LDAPS） 集成",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"severity": "中等",
- "text": "實施健康檢查",
- "waf": "可靠性"
+ "text": "是否已創建 RBAC 模型以在 VMware vSphere 中使用",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
- "severity": "高",
- "text": "請參閱 Azure 應用服務的備份和還原最佳做法",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "RBAC 許可權應授予 ADDS 組，而不是特定使用者",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"severity": "高",
- "text": "實現 Azure 應用服務可靠性最佳做法",
- "waf": "可靠性"
+ "text": "Azure 中 Azure VMware 解決方案資源的 RBAC 許可權僅「鎖定」為一組有限的擁有者",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
- "severity": "低",
- "text": "熟悉如何在災難期間將應用服務應用移動到另一個區域",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
+ "severity": "高",
+ "text": "確保所有自定義角色的範圍都具有 CloudAdmin 允許的授權",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"severity": "高",
- "text": "熟悉 Azure 應用服務中的可靠性支援",
- "waf": "可靠性"
+ "text": "是否為手頭的客戶用例選擇了正確的 Azure VMware 解決方案連接模型",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
- "severity": "中等",
- "text": "確保為在應用服務計劃上運行的函數應用啟用“Always On”",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
+ "severity": "高",
+ "text": "確保使用「連接監視器」監視從本地到 Azure 的 ExpressRoute 或 VPN 連接",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"severity": "中等",
- "text": "使用運行狀況檢查監視應用服務實例",
- "waf": "可靠性"
+ "text": "確保創建從 Azure 本機資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視 Azure VMware 解決方案後端 ExpressRoute 連接",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 Application Insights 可用性測試監視 Web 應用或網站的可用性和回應能力",
- "waf": "可靠性"
+ "text": "確保創建從本地資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視端到端連接",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
- "severity": "低",
- "text": "使用 Application Insights 標準測試監視 Web 應用或網站的可用性和回應能力",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
+ "severity": "高",
+ "text": "使用路由伺服器時，請確保從路由伺服器到 ExR 閘道再到本地的路由不超過 1000 個（ARS 限制）。",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用 Azure Key Vault 儲存應用程式所需的任何機密。 Key Vault 為儲存機密提供安全且經過審核的環境，並通過 Key Vault SDK 或應用服務 Key Vault 引用與應用服務很好地集成。",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"severity": "高",
- "text": "使用 Key Vault 儲存機密",
+ "text": "是否為在 Azure 門戶中管理 Azure VMware 解決方案資源的角色實現了 Privileged Identity Management（不允許長期許可權）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用託管標識通過 Key Vault SDK 或透過應用服務 Key Vault 引用連接到 Key Vault。",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"severity": "高",
- "text": "使用託管標識連接到 Key VaultUse Managed Identity to connect to Key Vault",
+ "text": "應為 Azure VMware 解決方案 PIM 角色實現 Privileged Identity Management 審核報告",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "將應用服務 TLS 證書存儲在 Key Vault 中。",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
- "severity": "高",
- "text": "使用 Key Vault 儲存 TLS 證書。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "如果使用 Privileged Identity Management，請確保使用有效的 SMTP 記錄創建啟用了 Entra ID 的有效帳戶，以便 Azure VMware 解決方案自動主機更換通知。（需要長期許可）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "處理敏感信息的系統應隔離。 為此，請使用單獨的應用服務計劃或應用服務環境，並考慮使用不同的訂閱或管理組。",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
- "severity": "中等",
- "text": "隔離處理敏感信息的系統",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
+ "severity": "高",
+ "text": "將 CloudAdmin 帳戶的使用限制為僅緊急訪問",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "應用服務上的本地磁碟未加密，敏感數據不應存儲在這些磁碟上。 （例如：D：\\\\Local 和 %TMP%）。",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
"severity": "中等",
- "text": "不要將敏感數據存儲在本地磁碟上",
+ "text": "在 vCenter 中創建自定義 RBAC 角色，以在 vCenter 中實施最小特權模型",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "對於經過身份驗證的 Web 應用程式，請使用成熟的標識提供者，例如 Azure AD 或 Azure AD B2C。 利用所選的應用程式框架與此提供程式整合，或使用應用服務身份驗證/授權功能。",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
"severity": "中等",
- "text": "使用已建立的身份提供程式進行身份驗證",
+ "text": "是定義為定期輪換 cloudadmin （vCenter） 和管理員 （NSX） 憑據的過程",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "將代碼從受控且受信任的環境（例如管理良好且安全的 DevOps 部署管道）部署到應用服務。這樣可以避免未經版本控制和驗證從惡意主機部署的代碼。",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"severity": "高",
- "text": "從受信任的環境部署",
+ "text": "使用集中式識別提供者用於在 Azure VMware 解決方案上運行的工作負載 （VM）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "禁用 FTP/FTPS 和 WebDeploy/SCM 的基本身份驗證。 這將禁止訪問這些服務，並強制使用 Azure AD 安全終結點進行部署。 請注意，還可以使用 Azure AD 憑據打開 SCM 網站。",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
- "severity": "高",
- "text": "禁用基本身份驗證",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "是否在 NSX-T 中實施了東西向流量篩選",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "如果可能，請使用託管標識連接到 Azure AD 受保護的資源。 如果無法做到這一點，請將機密存儲在 Key Vault 中，並改用託管標識連接到 Key Vault。",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"severity": "高",
- "text": "使用託管標識連接到資源",
+ "text": "Azure VMware 解決方案上的工作負載不會直接向 Internet 公開。流量由 Azure 應用程式閘道、Azure 防火牆或第三方解決方案進行篩選和檢查",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用託管標識拉取這些映像。",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"severity": "高",
- "text": "使用託管標識拉取容器",
+ "text": "對 Azure VMware 解決方案和基於 Azure VMware 解決方案的工作負載的入站 Internet 請求實施審核和日誌記錄",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "通過配置應用服務的診斷設置，可以將所有遙測數據發送到Log Analytics，作為日誌記錄和監視的中心目標。這允許你監視應用服務的運行時活動，例如 HTTP 日誌、應用程式日誌、平臺日誌等。",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
"severity": "中等",
- "text": "將應用服務運行時日誌發送到Log Analytics",
+ "text": "對來自 Azure VMware 解決方案或基於 Azure VMware 解決方案的工作負載的出站 Internet 連接實施會話監視，以識別可疑/惡意活動",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "設置診斷設置，將活動日誌發送到Log Analytics，作為日誌記錄和監視的中心目標。這樣，你就可以監視應用服務資源本身上的控制平面活動。",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"severity": "中等",
- "text": "將應用服務活動日誌發送到Log Analytics",
+ "text": "是否在 Azure 的 ExR/VPN 閘道子網上啟用了 DDoS 標準防護",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用區域 VNet 集成、網路安全組和 UDR 的組合來控制出站網路訪問。 流量應路由到 NVA，例如 Azure 防火牆。 確保監控防火牆的日誌。",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"severity": "中等",
- "text": "應控制出站網路訪問",
+ "text": "使用專用特權訪問工作站 （PAW） 管理 Azure VMware 解決方案、vCenter、NSX Manager 和 HCX Manager",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "可以使用 VNet 集成並使用 VNet NAT 閘道或 NVA（如 Azure 防火牆）來提供穩定的出站 IP。 這允許接收方根據需要根據IP列出允許清單。 請注意，對於與 Azure 服務的通信，通常不需要依賴於 IP 位址，應改用服務終結點等機制。 （此外，在接收端使用專用終結點可避免發生 SNAT，並提供穩定的出站 IP 範圍。",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
- "severity": "低",
- "text": "確保與互聯網位址的出站通信具有穩定的IP",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "為 Azure VMware 解決方案上運行的工作負載啟用高級威脅檢測（Microsoft Defender for Cloud，又名 ASC）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用應用服務訪問限制、服務終結點或專用終結點的組合來控制入站網路訪問。對於 Web 應用本身和 SCM 網站，可能需要和配置不同的訪問限制。",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "高",
- "text": "應控制入站網路訪問",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "使用適用於伺服器的 Azure ARC 使用 Azure 本機技術正確管理在 Azure VMware 解決方案上運行的工作負載（適用於 Azure VMware 解決方案的 Azure ARC 尚不可用）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用 Web 應用程式防火牆（如應用程式閘道或 Azure Front Door）防範惡意入站流量。 請務必監控 WAF 的日誌。",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
- "severity": "高",
- "text": "在應用服務前面使用 WAF",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
+ "severity": "低",
+ "text": "確保 Azure VMware 解決方案上的工作負載在運行時使用足夠的數據加密（如來賓內磁碟加密和 SQL TDE）。（vSAN 靜態加密為預設加密）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "確保僅鎖定對 WAF 的訪問，從而無法繞過 WAF。 結合使用訪問限制、服務終結點和專用終結點。",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
- "severity": "高",
- "text": "避免繞過 WAF",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
+ "severity": "低",
+ "text": "使用來賓內加密時，請盡可能將加密密鑰存儲在 Azure Key Vault 中",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "在應用服務配置中將最低 TLS 策略設置為 1.2。",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"severity": "中等",
- "text": "將最低 TLS 策略設置為 1.2",
+ "text": "請考慮對 Azure VMware 解決方案上運行的工作負載使用擴展的安全更新支援（Azure VMware 解決方案符合 ESU 條件）",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "將應用服務配置為僅使用 HTTPS。 這會導致應用服務從 HTTP 重定向到 HTTPS。 強烈建議在代碼或 WAF 中使用 HTTP 嚴格傳輸安全性 （HSTS），這會通知瀏覽器只能使用 HTTPS 訪問網站。",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"severity": "高",
- "text": "僅使用 HTTPS",
- "waf": "安全"
+ "text": "確保使用適當的 vSAN 資料冗餘方法（RAID 規範）",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "不要在 CORS 配置中使用通配符，因為這允許所有源訪問服務（從而破壞 CORS 的目的）。具體而言，僅允許您希望能夠訪問服務的源。",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"severity": "高",
- "text": "不得將通配符用於 CORS",
- "waf": "安全"
+ "text": "確保允許失敗策略已到位，以滿足您的 vSAN 儲存需求",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "不得在生產環境中啟用遠端調試，因為這會在服務上打開其他埠，從而增加攻擊面。請注意，該服務會在 48 小時後自動轉為遠端調試。",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"severity": "高",
- "text": "關閉遠端調試",
- "waf": "安全"
+ "text": "確保已請求足夠的配額，確保已考慮增長和災難恢復要求",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "啟用 Defender for App Service。 這（除其他威脅外）檢測與已知惡意IP位址的通信。 在操作過程中查看 Defender for App Service 中的建議。",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"severity": "中等",
- "text": "啟用 Defender for Cloud - Defender for App Service",
- "waf": "安全"
+ "text": "確保瞭解對 ESXi 的訪問限制，其中存在可能影響第三方解決方案的訪問限制。",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "Azure 在其網路上提供 DDoS 基本保護，可以通過智慧 DDoS 標準功能進行改進，該功能可以瞭解正常的流量模式並檢測異常行為。DDoS 標準適用於虛擬網路，因此必須為應用前面的網路資源（例如應用程式閘道或 NVA）配置它。",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"severity": "中等",
- "text": "在 WAF VNet 上啟用 DDOS 保護標準",
- "waf": "安全"
+ "text": "確保您制定了有關ESXi主機密度和效率的策略，並牢記請求新節點的提前期",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用其專用終結點和應用設置“WEBSITE_PULL_IMAGE_OVER_VNET”通過虛擬網络從 Azure 容器註冊表拉取這些映射。",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"severity": "中等",
- "text": "通過虛擬網路拉取容器",
- "waf": "安全"
+ "text": "確保 Azure VMware 解決方案的良好成本管理流程已到位 - 可以使用 Azure 成本管理",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "按照參與的滲透測試規則對 Web 應用程式進行滲透測試。",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
- "severity": "中等",
- "text": "進行滲透測試",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
+ "severity": "低",
+ "text": "Azure 預留實例是否用於優化使用 Azure VMware 解決方案的成本",
+ "waf": "成本"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "部署根據 DevSecOps 實踐驗證和掃描漏洞的受信任代碼。",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"severity": "中等",
- "text": "部署經過驗證的代碼",
+ "text": "使用其他 Azure 本機服務時，請考慮使用 Azure 專用連結",
"waf": "安全"
},
{
- "arm-service": "microsoft.web/sites",
- "checklist": "Azure App Service Review",
- "description": "使用最新版本的受支援平臺、程式設計語言、協定和框架。",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
"severity": "高",
- "text": "使用最新的平臺、語言、協定和框架",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7bc1c396-2461-4698-b57f-30ca69525252",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions",
- "service": "VNet",
- "severity": "中等",
- "text": "在多個區域中部署 Azure 登陸區域連接資源，以便可以快速支援多區域應用程式登陸區域和災難恢復方案。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "可靠性"
+ "text": "確保所有必需的資源都駐留在同一個 Azure 可用性區域中",
+ "waf": "性能"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"severity": "中等",
- "text": "使用一個 Entra 租戶來管理 Azure 資源，除非對多租戶有明確的法規或業務要求。",
- "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
- "waf": "操作"
+ "text": "為 Azure VMware 解決方案來賓 VM 工作負載啟用 Microsoft Defender for Cloud",
+ "waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Entra",
- "severity": "低",
- "text": "使用多租戶自動化方法管理您的 Microsoft Entra ID 租戶。",
- "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
- "waf": "操作"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "使用已啟用 Azure Arc 的伺服器管理 Azure VMware 解決方案來賓 VM 工作負載",
+ "waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
"severity": "高",
- "text": "使用具有相同 ID 的 Azure Lighthouse 進行多租戶管理。",
- "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "text": "在 Azure VMware 解決方案上啟用診斷和指標日誌記錄",
"waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Entra",
- "severity": "高",
- "text": "如果向合作夥伴授予管理租戶的許可權，請使用 Azure Lighthouse。",
- "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
- "waf": "成本"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "將Log Analytics代理部署到 Azure VMware 解決方案來賓 VM 工作負載",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "348ef254-c27d-442e-abba-c7571559ab91",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
- "service": "Entra",
- "severity": "高",
- "text": "實施與您的雲操作模型相一致的 RBAC 模型。跨管理組和訂閱確定範圍和分配。",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "確保已針對 Azure VMware 解決方案 VM 工作負載記錄並實施了備份策略和解決方案",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"severity": "中等",
- "text": "僅對所有帳戶類型使用身份驗證類型 Work or school account。避免使用 Microsoft 帳戶",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "使用 Microsoft Defender for Cloud 對 Azure VMware 解決方案上運行的工作負載進行合規性監視",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
"severity": "中等",
- "text": "僅使用組來分配許可權。如果組管理系統已就位，請將本地組添加到僅 Entra ID 組。",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "是否將適用的合規性基線添加到 Microsoft Defender for Cloud",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
- "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
"severity": "高",
- "text": "對 Azure 環境具有許可權的任何使用者強制實施 Microsoft Entra ID 條件訪問策略。",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "text": "在選擇要用於 Azure VMware 解決方案部署的 Azure 區域時是否評估了數據駐留",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
- "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
"severity": "高",
- "text": "對有權訪問 Azure 環境的任何使用者強制實施多重身份驗證。",
- "training": "https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication",
+ "text": "數據處理影響（服務提供者/服務消費者模型）是否清晰且有據可查",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"severity": "中等",
- "text": "強制實施 Microsoft Entra ID Privileged Identity Management （PIM） 以建立零長期訪問和最低許可權。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "僅當出於合規性原因需要時，才考慮將CMK（客戶管理的密鑰）用於 vSAN。",
"waf": "安全"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "中等",
- "text": "如果計劃從 Active Directory 域服務切換到 Entra 域服務，請評估所有工作負載的相容性。",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
+ "severity": "高",
+ "text": "創建儀錶板以啟用核心 Azure VMware 解決方案監視見解",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "0dd4e625-9c4b-4a56-b54a-4357bac12761",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
- "service": "Entra",
- "severity": "中等",
- "text": "使用 Microsoft Entra 域服務時，請使用副本集。副本集將提高託管域的復原能力，並允許您部署到其他區域。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-active-directory/6-examine-azure-domain-services",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
+ "severity": "高",
+ "text": "針對 Azure VMware 解決方案性能（CPU >80%、平均記憶體 >80%、vSAN >70%）自動警報的關鍵閾值創建警告警報",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
- "service": "Entra",
- "severity": "中等",
- "text": "將 Microsoft Entra ID 紀錄與平臺中心的 Azure Monitor 集成。Azure Monitor 允許 Azure 中日誌和監視數據的單一事實來源，為組織提供雲原生選項來滿足日誌收集和保留的要求。",
- "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
+ "severity": "高",
+ "text": "確保創建嚴重警示以監控 vSAN 消耗量是否低於 75%，因為這是 VMware 的支援閾值",
+ "waf": "操作"
},
{
- "ammp": true,
- "checklist": "Azure Landing Zone Review",
- "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"severity": "高",
- "text": "實施緊急訪問或不受限帳戶，以防止租戶範圍的帳戶鎖定。默認情況下，MFA 將於 2024 年 10 月為所有用戶開啟。我們建議更新這些帳戶以使用密鑰 （FIDO2） 或為 MFA 配置基於證書的身份驗證。",
- "training": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access#exclude-at-least-one-account-from-conditional-access-policies",
- "waf": "安全"
+ "text": "確保為 Azure 服務運行狀況警報和通知配置警報",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "35037e68-9349-4c15-b371-228514f4cdff",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"severity": "中等",
- "text": "請勿將本地同步帳戶用於 Microsoft Entra ID 角色分配，除非你的方案特別需要它。",
- "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
- "waf": "安全"
+ "text": "將 Azure VMware 解決方案記錄設定為發送到 Azure 儲存帳戶或 Azure EventHub 進行處理",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Entra",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
+ "severity": "低",
+ "text": "如果需要深入瞭解 VMware vSphere：解決方案中是否使用了 vRealize Operations 和/或 vRealize Network Insights？",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
+ "severity": "高",
+ "text": "確保虛擬機的 vSAN 儲存策略不是預設存儲策略，因為此策略應用厚置備",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對應用程式的訪問許可權時，請將其作為平臺資源進行管理，因為每個租戶只能有一個實例。",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "安全"
+ "text": "確保未將 vSphere 內容庫放置在 vSAN 上，因為 vSAN 是有限的資源",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
"severity": "中等",
- "text": "對於需要最大靈活性的網路方案，請使用中心輻射型網路拓撲。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "text": "確保備份解決方案的數據存儲庫存儲在 vSAN 儲存之外。在 Azure 本機或磁碟池支持的數據存儲中",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
- "service": "VNet",
- "severity": "高",
- "text": "在中心虛擬網路中部署共用網路服務，包括 ExpressRoute 閘道、VPN 閘道和 Azure 防火牆或合作夥伴 NVA。如有必要，還要部署 DNS 服務。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
- "waf": "成本"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "確保使用 Azure Arc for Servers 進行混合管理，確保在 Azure VMware 解決方案上運行的工作負載（Arc for Azure VMware 解決方案處於預覽狀態）",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "VNet",
- "severity": "高",
- "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "確保使用 Azure Log Analytics 和 Azure Monitor 監視在 Azure VMware 解決方案上運行的工作負載",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"severity": "中等",
- "text": "部署合作夥伴網路技術或 NVA 時，請遵循合作夥伴供應商的指導。",
- "waf": "可靠性"
+ "text": "在現有更新管理工具或 Azure 更新管理中包括在 Azure VMware 解決方案上運行的工作負載",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
- "service": "ExpressRoute",
- "severity": "低",
- "text": "如果需要在中心輻射型方案中在 ExpressRoute 和 VPN 閘道之間傳輸，請使用 Azure 路由伺服器。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "使用 Azure Policy 在 Azure 管理、監視和安全解決方案中加入 Azure VMware 解決方案工作負載",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualHubs",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
- "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
- "service": "ARS",
- "severity": "低",
- "text": "如果使用路由伺服器，請對路由伺服器子網使用 /27 前置綴。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "確保在 Azure VMware 解決方案上運行的工作負載已載入 Microsoft Defender for Cloud",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
"severity": "中等",
- "text": "對於跨 Azure 區域具有多個中心輻射型拓撲的網路體系結構，請在中心 VNet 之間使用全域虛擬網路對等互連將區域相互連接。",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
- "waf": "性能"
+ "text": "確保備份不存儲在 vSAN 上，因為 vSAN 是有限的資源",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"severity": "中等",
- "text": "使用適用於網路的 Azure Monitor 監視 Azure 上網路的端到端狀態。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "操作"
+ "text": "是否考慮了所有災難恢復解決方案，並決定了最適合您業務的解決方案？[SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
- "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
"severity": "中等",
- "text": "如果一個區域中的分支網路超過 400 個，請部署一個額外的中心以繞過 VNet 對等互連限制 （500） 和可通過 ExpressRoute 播發的最大前綴數 （1000）。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "text": "當災難恢復技術是本機 Azure IaaS 時，請使用 Azure Site Recovery",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
- "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
+ "severity": "高",
+ "text": "將自動恢復計劃與任一災難解決方案結合使用，盡可能避免手動任務",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"severity": "中等",
- "text": "將每個路由表的路由數限制為 400。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "text": "使用地緣政治區域對作為輔助災難恢復環境",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
- "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
"severity": "高",
- "text": "配置 VNet 對等互連時，請使用「允許流量流向遠端虛擬網路」設置。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "text": "在區域之間使用 2 個不同的地址空間，例如：10.0.0.0/16 和 192.168.0.0/16 用於不同的區域",
"waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PrivateSubnetId = toupper(feIPconfigs.properties.subnet.id), PrivateIPZones = feIPconfigs.zones, PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PrivateSubnetId) | where isnull(PrivateIPZones) or array_length(PrivateIPZones) < 2 | project name, feConfigName, id | union (resources | where type == 'microsoft.network/loadbalancers' | where tolower(sku.name) != 'basic' | mv-expand feIPconfigs = properties.frontendIPConfigurations | extend feConfigName = (feIPconfigs.name), PIPid = toupper(feIPconfigs.properties.publicIPAddress.id), JoinID = toupper(id) | where isnotempty(PIPid) | join kind=innerunique ( resources | where type == 'microsoft.network/publicipaddresses' | where isnull(zones) or array_length(zones) < 2 | extend LBid = toupper(substring(properties.ipConfiguration.id, 0, indexof(properties.ipConfiguration.id, '/frontendIPConfigurations'))), InnerID = toupper(id) ) on $left.PIPid == $right.InnerID) | project name, id, tags, param1='Zones: No Zone or Zonal', param2=strcat('Frontend IP Configuration:', ' ', feConfigName)",
- "guid": "9dcd6250-9c4a-4382-aa9b-5b84c64fc1fe",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
- "severity": "高",
- "text": "將標準負載均衡器 SKU 與區域冗餘部署配合使用，選擇標準 SKU 負載均衡器可通過可用性區域和區域復原能力增強可靠性，確保部署能夠承受區域和區域故障。與 Basic 不同，它支援全域負載平衡並提供 SLA。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "ExpressRoute Global Reach 是用於主 Azure VMware 解決方案私有雲和輔助 Azure VMware 解決方案私有雲之間的連接，還是通過網路虛擬設備完成路由？",
"waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools == 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name == 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "48682fb1-1e86-4458-a686-518ebd47393d",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-load-balancer?tabs=graph#zone-redundant",
- "service": "Load Balancers",
- "severity": "高",
- "text": "確保負載均衡器後端池至少包含兩個實例，在後端部署至少包含兩個實例的 Azure 負載均衡器可以防止單點故障並支援可伸縮性。",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "是否考慮了所有備份解決方案，並決定了最適合您業務的解決方案？[ MABS/CommVault/Metallic.io/Veeam/ .",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 ExpressRoute Direct 時，請配置 MACsec，以便在組織路由器和 MSEE 之間的第二層加密流量。該圖顯示了這種加密流程。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "安全"
+ "text": "將備份解決方案部署在與 Azure VMware 解決方案私有雲相同的區域中",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
"severity": "中等",
- "text": "對於無法使用MACsec的情況（例如，不使用ExpressRoute Direct），請使用 VPN 閘道通過 ExpressRoute 專用對等互連建立 IPsec 隧道。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
- "waf": "安全"
+ "text": "在 vSan 外部的 Azure 本機組件上部署備份解決方案",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "確保 Azure 區域和本地位置之間沒有使用重疊的 IP 位址空間。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "severity": "低",
+ "text": "是否已制定請求還原由 Azure 平臺管理的 VMware 元件的流程？",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
- "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
- "severity": "中等",
- "text": "使用私有互聯網的位址分配範圍 （RFC 1918） 中的IP位址。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
+ "severity": "低",
+ "text": "對於手動部署，必須記錄所有配置和部署",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
- "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "VNet",
- "severity": "高",
- "text": "確保IP位址空間不會浪費，不要創建不必要的大型虛擬網路（例如/16）。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "性能"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
+ "severity": "低",
+ "text": "對於手動部署，請考慮實施資源鎖，以防止對 Azure VMware 解決方案私有雲執行意外操作",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
- "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
- "service": "VNet",
- "severity": "高",
- "text": "不要對生產和災難恢復網站使用重疊的IP位址範圍。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
+ "severity": "低",
+ "text": "對於自動化部署，請部署最小的私有雲並根據需要進行擴展",
+ "waf": "操作"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "0c47f486-656d-4699-8c30-edef5b8a93c4",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses#availability-zone",
- "service": "Public IP Addresses",
- "severity": "高",
- "text": "使用標準 SKU 和區域冗餘 IP（如果適用），Azure 中的公共 IP 位址可以是標準 SKU，以非區域、區域或區域冗餘的形式提供。區域冗餘IP可跨所有區域訪問，可抵禦任何單個區域故障，從而提供更高的彈性。",
- "training": "https://learn.microsoft.com/en-gb/training/modules/configure-virtual-networks/6-create-public-ip-addressing",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
+ "severity": "低",
+ "text": "對於自動部署，請在開始部署之前請求或預留配額",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
- "service": "DNS",
- "severity": "中等",
- "text": "對於只需要在 Azure 中進行名稱解析的環境，請使用 Azure 專用 DNS 進行解析，並使用委託區域進行名稱解析（例如“azure.contoso.com”）。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
+ "severity": "低",
+ "text": "對於自動部署，請確保通過自動化或 Azure Policy 創建相關資源鎖，以便進行適當的治理",
"waf": "操作"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
- "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
- "service": "DNS",
- "severity": "中等",
- "text": "對於需要跨 Azure 和本地進行名稱解析且沒有 Active Directory 等現有企業 DNS 服務的環境，請使用 Azure DNS 專用解析程式將 DNS 請求路由到 Azure 或本地 DNS 伺服器。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
+ "severity": "低",
+ "text": "為 ExR 授權金鑰實現人類可理解的名稱，以便輕鬆識別密鑰的目的/用途",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
- "service": "DNS",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
"severity": "低",
- "text": "需要並部署自己的 DNS 的特殊工作負載（例如 Red Hat OpenShift）應使用其首選的 DNS 解決方案。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "text": "當使用單獨的服務原則部署 Azure VMware 解決方案和 ExpressRoute 時，請使用 Key Vault 儲存機密和授權密鑰",
"waf": "操作"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "614658d3-558f-4d77-849b-821112df27ee",
- "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
- "service": "DNS",
- "severity": "高",
- "text": "為 Azure DNS 啟用自動註冊，以自動管理虛擬網路中部署的虛擬機的 DNS 記錄的生命週期。",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
+ "severity": "低",
+ "text": "當需要在 Azure VMware 解決方案中/上部署許多資源時，定義用於在 IaC 中序列化操作的資源依賴項，因為 Azure VMware 解決方案僅支援有限數量的並行操作。",
"waf": "操作"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
- "checklist": "Azure Landing Zone Review",
- "guid": "18c80eb0-582a-4198-bf5c-d8800b2d263b",
- "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale#private-link-and-dns-integration-in-hub-and-spoke-network-architectures",
- "service": "DNS",
- "severity": "中等",
- "text": "實施一個計劃，用於管理多個 Azure 區域之間的 DNS 解析以及服務故障轉移到另一個區域時",
- "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
- "waf": "可靠性"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
+ "severity": "低",
+ "text": "使用單個 Tier-1 閘道執行 NSX-T 分段的自動配置時，請使用 Azure 門戶 API 而不是 NSX-Manager API",
+ "waf": "操作"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
- "service": "Bastion",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 Azure Bastion 安全地連接到您的網路。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "安全"
+ "text": "打算使用自動橫向擴展時，請務必為運行 Azure VMware 解決方案的訂閱申請足夠的 Azure VMware 解決方案配額",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/bastionHosts",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
- "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
- "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
- "service": "Bastion",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"severity": "中等",
- "text": "在子網 /26 或更大的子網中使用 Azure Bastion。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
- "waf": "安全"
+ "text": "打算使用自動縮減時，請務必在執行此操作之前考慮存儲策略要求",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "WAF",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"severity": "中等",
- "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為到登陸區域的入站 HTTP/S 連接提供全域保護。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "text": "擴展操作始終需要在單個 SDDC 中序列化，因為一次只能執行一個擴展操作（即使使用多個集群也是如此）",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "低",
- "text": "使用 Azure Front Door 和 Azure 應用程式閘道幫助保護 HTTP/S 應用時，請使用 Azure Front Door 中的 WAF 策略。鎖定 Azure 應用程式閘道以僅接收來自 Azure Front Door 的流量。",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "考慮並驗證體系結構中使用的第三方解決方案的縮放操作（支援與否）",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "WAF",
- "severity": "高",
- "text": "當入站 HTTP/S 連接需要 WAF 和其他反向代理時，請將它們部署在登陸區虛擬網路中，並與它們保護並公開給 Internet 的應用程式一起部署。",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "在自動化中為環境定義和強制實施橫向擴展/橫向擴展最大限制",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "高",
- "text": "使用 Azure DDoS 網路或 IP 保護計劃來幫助保護虛擬網路中的公共 IP 位址終結點。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "實施監控規則以監控自動擴展操作，並監控成功和失敗，以啟用適當的（自動化）回應",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
- "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
- "service": "VNet",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"severity": "高",
- "text": "規劃如何在即將到來的重大更改之前管理您的網路出站流量配置和策略。2025 年 9 月 30 日，新部署的預設出站訪問將停用，僅允許顯式訪問配置。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "text": "使用 MON 時，請注意同時配置的 VM 的限制（HCX 的 MON 限制 [400 - 標準，1000 - 大型設備]）",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
- "service": "VNet",
- "severity": "高",
- "text": "添加診斷設置以保存所有受保護的公有IP位址（DDoS IP或網路保護）的 DDoS 相關日誌。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
- "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
- "service": "Policy",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"severity": "高",
- "text": "確保有一個策略分配來拒絕直接連接到虛擬機的公有IP位址。 如果特定 VM 上需要公共 IP，請使用排除項。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
- "waf": "安全"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
- "severity": "中等",
- "text": "使用 ExpressRoute 作為與 Azure 的主要連接。 使用 VPN 作為備份連接的源。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "性能"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "description": "您可以使用 AS 路徑預置和連接權重來影響從 Azure 到本地的流量，並使用您自己的路由器中的所有 BGP 屬性來影響從本地到 Azure 的流量。",
- "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
- "service": "ExpressRoute",
- "severity": "中等",
- "text": "使用多個 ExpressRoute 線路或多個本地位置時，請使用 BGP 屬性來優化路由。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "使用 MON 時，不能在超過 100 個網路分機上啟用 MON",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
- "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"severity": "中等",
- "text": "根據頻寬和性能要求為 ExpressRoute/VPN 閘道選擇正確的 SKU。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "如果使用 VPN 連接進行遷移，請相應地調整 MTU 大小。",
"waf": "性能"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
- "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
- "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "確保僅在達到與成本相稱的頻寬時才使用無限數據 ExpressRoute 線路。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "成本"
- },
- {
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
- "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "如果你的線路對等互連位置支援本地 SKU 的 Azure 區域，請利用 ExpressRoute 的本地 SKU 來降低線路的成本。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
- "waf": "成本"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
+ "severity": "中等",
+ "text": "對於連接到 Azure（500Mbps 或更低）的低連接區域，請考慮部署 HCX WAN 優化設備",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
"severity": "中等",
- "text": "在支援的 Azure 區域中部署區域冗餘 ExpressRoute 閘道。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "確保從本地裝置啟動遷移，而不是從雲端裝置啟動遷移（不要執行反向遷移）",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"severity": "中等",
- "text": "對於需要高於 10 Gbps 的頻寬或專用 10/100 Gbps 埠的方案，請使用 ExpressRoute Direct。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "性能"
+ "text": "使用 Azure Netapp Files 擴展 Azure VMware 解決方案的儲存時，請考慮將其用作 VMware 資料儲存庫，而不是直接附加到 VM 。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
- "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"severity": "中等",
- "text": "當需要低延遲，或者從本地到 Azure 的輸送量必須大於 10 Gbps 時，請啟用 FastPath 以從數據路徑繞過 ExpressRoute 閘道。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "性能"
+ "text": "確保將專用 ExpressRoute 閘道用於外部資料儲存解決方案",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
- "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
- "service": "VPN",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"severity": "中等",
- "text": "使用區域冗餘 VPN 閘道將分支或遠端位置連接到 Azure（如果可用）。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "text": "確保在用於外部數據存儲解決方案的 ExpressRoute 閘道上啟用了 FastPath",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualNetworkGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
- "service": "VPN",
- "severity": "中等",
- "text": "在本地使用冗餘 VPN 設備（主動/主動或主動/被動）。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
+ "severity": "高",
+ "text": "如果使用延伸群集，請確保供應商支援所選的災難恢復解決方案",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
"severity": "高",
- "text": "如果使用 ExpressRoute Direct，請考慮使用連接到本地 Azure 區域的 ExpressRoute 本地線路以節省成本。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "成本"
+ "text": "如果使用延伸群集，請確保提供的 SLA 符合您的要求",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
- "service": "ExpressRoute",
- "severity": "中等",
- "text": "當需要流量隔離或專用頻寬時（例如用於分離生產和非生產環境），請使用不同的 ExpressRoute 線路。它將幫助您確保隔離的路由域並減輕嘈雜的鄰居風險。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "安全"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
+ "severity": "高",
+ "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都連接到連接中心。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
- "service": "ExpressRoute",
- "severity": "中等",
- "text": "使用內置的 Express Route Insights 監控 ExpressRoute 的可用性和利用率。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "操作"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
+ "severity": "高",
+ "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都啟用了 GlobalReach。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
- "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
- "service": "ExpressRoute",
- "severity": "中等",
- "text": "使用連接監視器進行跨網路的連接監控，尤其是本地和 Azure 之間的連接。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "操作"
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "Azure VMware Solution Design Review",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
+ "severity": "高",
+ "text": "是否正確考慮了網站容災設置，並在需要時為您的業務進行了更改。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
- "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"severity": "中等",
- "text": "使用來自不同對等互連位置的 ExpressRoute 線路以實現冗餘。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "使用長期可撤銷令牌，緩存令牌並使用 Microsoft 標識庫以靜默方式獲取令牌",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"severity": "中等",
- "text": "如果僅使用單個 ExpressRoute 線路，請使用網站到網站 VPN 作為 ExpressRoute 的故障轉移。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "text": "請確保登錄使用者流已備份並具有復原能力。請確保用於登錄使用者的代碼已備份且可恢復。與外部進程的彈性介面",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
- "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "如果您在 GatewaySubnet 中使用路由表，請確保傳播閘道路由。",
- "waf": "可靠性"
+ "checklist": "Identity Review Checklist",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
+ "severity": "中等",
+ "text": "自訂品牌資產應託管在CDN上",
+ "waf": "性能"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "d581a947-69a2-4783-942e-9df3664324c8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "如果使用 ExpressRoute，則本地路由應該是動態的：如果連接失敗，它應收斂到線路的剩餘連接。理想情況下，負載應在兩個連接之間共用，即主動/主動，但也支持主動/被動。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "checklist": "Identity Review Checklist",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
+ "severity": "低",
+ "text": "擁有多個標識提供者（即使用您的 Microsoft、Google、Facebook 帳戶登錄）",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "中等",
- "text": "確保 ExpressRoute 線路的兩個物理連結連接到網路中的兩個不同的邊緣設備。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "遵循 VM 規則，實現 VM 級別的高可用性（高級磁碟，一個區域中的兩個或更多磁碟，位於不同的可用性區域）",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"severity": "中等",
- "text": "確保在客戶或供應商邊緣路由設備上啟用和配置雙向轉發檢測 （BFD）。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "不要複製！複製可能會產生目錄同步問題",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "ExpressRoute",
- "severity": "高",
- "text": "將 ExpressRoute 閘道連接到來自不同對等互連位置的兩條或多條線路，以獲得更高的復原能力。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "checklist": "Identity Review Checklist",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
+ "severity": "中等",
+ "text": "對多區域具有主動-主動",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
- "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "中等",
- "text": "為 ExpressRoute 虛擬網路閘道配置診斷日誌和警報。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "操作"
+ "text": "將 Azure AD 域服務標記添加到其他區域和位置",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
- "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
- "service": "ExpressRoute",
+ "checklist": "Identity Review Checklist",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"severity": "中等",
- "text": "不要使用 ExpressRoute 線路進行 VNet 到 VNet 通信。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
- "waf": "性能"
+ "text": "將副本集用於DR",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "service": "N/A",
- "severity": "低",
- "text": "不要將 Azure 流量發送到混合位置進行檢查。 相反，請遵循“Azure 中的流量保留在 Azure 中”的原則，以便通過 Microsoft 主幹網络進行 Azure 中資源的通信。",
- "waf": "性能"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "請考慮「存儲的 Azure 安全基線”",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
- "link": "https://learn.microsoft.com/azure/firewall/overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "高",
- "text": "使用 Azure 防火牆來管理到 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "考慮將專用終結點用於 Azure 存儲",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
- "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "創建全域 Azure 防火牆策略以管理全球網路環境中的安全狀況，並將其分配給所有 Azure 防火牆實例。通過 Azure 基於角色的訪問控制將增量防火牆策略委派給本地安全團隊，從而允許精細策略以滿足特定區域的要求。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
- "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
- "service": "Firewall",
- "severity": "低",
- "text": "如果組織希望使用此類解決方案來幫助保護出站連接，請在 Firewall Manager 中配置受支援的合作夥伴 SaaS 安全提供者。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "為所有存儲帳戶啟用 Microsoft DefenderEnable Defender for all of your storage accounts",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
- "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
- "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
- "service": "Firewall",
- "severity": "高",
- "text": "使用應用程式規則篩選目標主機名上的出站流量，以瞭解支持的協定。 使用基於 FQDN 的網路規則和帶有 DNS 代理的 Azure 防火牆，通過其他協議篩選到 Internet 的出口流量。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "軟刪除機制允許恢復意外刪除的 Blob。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "為 blob 啟用“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
- "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features",
- "service": "Firewall",
- "severity": "高",
- "text": "使用 Azure 防火牆高級版啟用其他安全功能。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "禁用 blob 的“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
- "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "容器的軟刪除使你能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "高",
- "text": "將 Azure 防火牆威脅情報模式配置為 Alert 和 Deny 以獲得額外的保護。",
+ "text": "為容器啟用“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
- "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
- "service": "Firewall",
- "severity": "高",
- "text": "將 Azure 防火牆 IDPS 模式配置為 Deny 以獲得額外保護。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "禁用容器的“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
- "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "通過強制使用者在刪除之前先刪除刪除鎖，防止意外刪除存儲帳戶",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "高",
- "text": "對於 VNet 中未連接到虛擬 WAN 的子網，請附加路由表，以便將 Internet 流量重定向到 Azure 防火牆或網路虛擬設備。",
+ "text": "在存儲帳戶上啟用資源鎖",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
- "service": "Firewall",
- "severity": "中等",
- "text": "添加診斷設置，以使用特定於資源的目標表保存所有 Azure 防火牆部署的日誌。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，這樣就無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;存儲帳戶包含不可變 blob 後，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮不可變的 blob",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
- "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
- "service": "Firewall",
- "severity": "重要",
- "text": "從 Azure 防火牆經典規則（如果存在）遷移到防火牆策略。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並對伺服器進行身份驗證。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
- "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"severity": "高",
- "text": "對 Azure 防火牆子網使用 /26 前置綴。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "text": "強制實施 HTTPS（禁用 HTTP）時，請檢查是否未對儲存帳戶使用自定義域 （CNAME）。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
- "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於將憑據丟失的風險降至最低。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "根據規則的使用頻率，將防火牆策略中的規則排列到規則集合組和規則集合中。",
- "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
- "waf": "性能"
+ "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
- "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
- "service": "Firewall",
- "severity": "中等",
- "text": "使用IP組或IP前置綴來減少IP表規則的數量。",
- "waf": "性能"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "在可能的情況下，AAD 令牌應優先於共用訪問簽名",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "使用 Azure Active Directory （Azure AD） 令牌進行 blob 訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
- "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "將角色分配給使用者、組或應用程式時，請僅向該安全主體授予他們執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "請勿使用通配符作為DNAT的源IP，例如*或任何，您應該為傳入的DNAT指定源IP。",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "性能"
+ "text": "IaM 許可權中的最低特權",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
- "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
- "service": "Firewall",
- "severity": "中等",
- "text": "通過監控 SNAT 埠使用方式、評估 NAT 閘道設置並確保無縫故障轉移，防止 SNAT 埠耗盡。如果埠計數接近限制，則表明 SNAT 耗儘可能即將耗盡。",
- "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
- "waf": "性能"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但比服務 SAS 具有安全優勢。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "346840b8-1064-496e-8396-4b1340172d52",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取密鑰副本，但一旦密鑰掌握在多個人手中，就不可能將使用方式歸因於特定使用者。僅依靠 AAD 身份驗證可以更輕鬆地將存儲存取許可權綁定到使用者。",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"severity": "高",
- "text": "如果使用的是 Azure 防火牆高級版，請啟用 TLS 檢查。",
- "waf": "性能"
+ "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 AAD 訪問（和使用者委派 SAS）。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
- "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
- "service": "Firewall",
- "severity": "低",
- "text": "使用 Web 類別允許或拒絕對特定主題的出站訪問。",
- "waf": "性能"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "使用活動日誌數據來標識查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果指定的時間間隔已過且鍵尚未旋轉，則會顯示提醒。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "作為 TLS 檢查的一部分，請規劃從 Azure 應用程式閘道接收流量進行檢查。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
- "waf": "性能"
+ "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/firewallPolicies' | where array_length(properties.firewalls) > 0 | extend compliant = (properties.dnsSettings.enableProxy =~ 'true') | distinct id, compliant",
- "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
- "link": "https://learn.microsoft.com/azure/firewall/dns-details",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS 過期策略指定 SAS 有效的建議時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們會看到警告。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "啟用 Azure 防火牆 DNS 代理配置。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "text": "考慮配置 SAS 過期策略",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
- "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
- "service": "Firewall",
- "severity": "高",
- "text": "將 Azure 防火牆與 Azure Monitor 集成，並啟用診斷日誌記錄來存儲和分析防火牆日誌和指標。",
- "training": "https://learn.microsoft.com/training/courses/az-700t00/",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "存儲存取策略提供了撤銷服務 SAS 許可權的選項，而無需重新生成儲存帳戶密鑰。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "考慮將 SAS 連結到儲存存取策略",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
- "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
- "service": "Firewall",
- "severity": "低",
- "text": "為防火牆規則實施備份",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/azurefirewalls' | where array_length(zones) <= 1 or isnull(zones) | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | project name, id, tags, param1='multipleZones:false'",
- "guid": "d38ad60c-bc9e-4d49-b699-97e5d4dcf707",
- "link": "https://learn.microsoft.com/azure/firewall/deploy-availability-zone-powershell",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中使用存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"severity": "高",
- "text": "跨多個可用性區域部署 Azure 防火牆。Azure 防火牆根據其部署提供不同的 SLA;在單個可用區或跨多個可用區，從而可能提高可靠性和性能。",
- "training": "https://learn.microsoft.com/training/courses/az-104t00/",
- "waf": "可靠性"
+ "text": "請考慮將連接字串儲存在 Azure KeyVault 中（在無法實現託管標識的情況下）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, /subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | where isempty(ddosProtectionPlanId) | , name, id = firewallId, tags, param1 = strcat('vNet: ', vNetName), param2 = 'ddosProtection: Disabled'",
- "guid": "e8143efa-0301-4d62-be54-ca7b5ce566dc",
- "link": "https://learn.microsoft.com/en-gb/azure/ddos-protection/ddos-protection-overview",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只能在很短的時間內有效。如果無法引用存儲訪問策略，則此做法尤為重要。近期過期時間還通過限制可上傳到 blob 的時間來限制可寫入 blob 的數據量。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "高",
- "text": "在 Azure 防火牆 VNet 上配置 DDoS 防護，將 DDoS 防護計劃與託管 Azure 防火牆的虛擬網路相關聯，以提供針對 DDoS 攻擊的增強緩解。Azure 防火牆管理器集成了防火牆基礎結構和 DDoS 防護計劃的創建。",
- "waf": "可靠性"
+ "text": "爭取縮短臨時 SAS 的有效期",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/applicationGateways",
- "checklist": "Azure Landing Zone Review",
- "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "App Gateway",
- "severity": "高",
- "text": "不要中斷注入虛擬網路的 Azure PaaS 服務的控制平面通信，例如使用 0.0.0.0/0 路由或阻止控制平面流量的 NSG 規則。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "創建 SAS 時，請盡可能具體和嚴格。首選單個資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "將窄範圍應用於SAS",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
- "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "通過專用終結點和 ExpressRoute 專用對等互連從本地訪問 Azure PaaS 服務。此方法可避免通過公共 Internet 傳輸。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/virtualNetworks",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
- "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
- "service": "VNet",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "SAS 無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能是有意義的。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低",
+ "text": "請考慮在用戶端使用SAS上傳檔后檢查上傳的數據。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "使用「本地使用者帳戶」通過 SFTP 訪問 Blob 儲存時，“通常”RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更嚴格。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點當前支援的唯一身份管理形式",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "高",
- "text": "默認情況下，不要在所有子網上啟用虛擬網路服務終端節點。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核一段時間內是否需要訪問。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/azureFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
- "link": "azure/private-link/inspect-traffic-with-azure-firewall",
- "service": "Firewall",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用 FQDN 而不是 Azure 防火牆或 NVA 中的 IP 位址篩選到 Azure PaaS 服務的出口流量，以防止數據外洩。如果使用專用連結，則可以阻止所有 FQDN，否則僅允許所需的 PaaS 服務。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
"waf": "安全"
},
{
- "arm-service": "microsoft.network/expressRouteCircuits",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
- "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
- "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
- "service": "ExpressRoute",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "存儲支援 CORS（跨域資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放寬同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "高",
- "text": "至少為您的閘道子網使用 /27 前置綴。",
+ "text": "避免過於寬泛的 CORS 策略",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
- "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
- "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
- "service": "NSG",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"severity": "高",
- "text": "不要依賴使用 VirtualNetwork 服務標記的 NSG 入站預設規則來限制連接。",
+ "text": "確定應如何加密靜態數據。了解數據的線程模型。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "確定應使用哪種/是否應使用平臺加密。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | where subnet.name !in~ ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet') | extend compliant = iff(isnotnull(subnet.properties.networkSecurityGroup.id), true, false) | project id, subnetName = subnet.name, vnetName = name, NSG = subnet.properties.networkSecurityGroup.id, compliant",
- "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
- "service": "NSG",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用 NSG 説明保護跨子網的流量，以及跨平台的東西向流量（登陸區域之間的流量）。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "text": "確定應使用哪種/是否應使用用戶端加密。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "NSG",
- "severity": "中等",
- "text": "使用 NSG 和應用程式安全組對登陸區域內的流量進行微分段，並避免使用中央 NVA 來篩選流量。",
- "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Blob Storage Review",
+ "description": "利用 Resource Graph 資源管理器（資源 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true）查找允許匿名 blob 訪問的存儲帳戶。",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮是否需要公共 blob 訪問，或者是否可以對某些存儲帳戶禁用公共 blob 訪問。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'Microsoft.Network/virtualnetworks' | project subscriptionId, lowerCaseVNetId = tolower(id) | join kind = leftouter ( resources | where type =~ 'microsoft.network/networkwatchers/flowlogs' and properties.enabled == true and properties.provisioningState =~ 'succeeded' | where properties.targetResourceId contains '/Microsoft.Network/virtualNetworks/' | project flowlogId = id, trafficAnalyticsEnabled = properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled, lowerCaseTargetVNetId = tolower(properties.targetResourceId) ) on $left.lowerCaseVNetId == $right.lowerCaseTargetVNetId | extend compliant = iff(isnotempty(lowerCaseTargetVNetId), true, false) | project id = lowerCaseVNetId, flowlogId, trafficAnalyticsEnabled, compliant",
- "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
- "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
- "service": "NSG",
- "severity": "中等",
- "text": "啟用 VNet 流日誌並將其饋送到流量分析中，以深入了解內部和外部流量流。",
- "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
- "waf": "安全"
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
+ "severity": "高",
+ "text": "為 Azure Cache for Redis 啟用區域冗餘。Azure Cache for Redis 支持高級層和企業層中的區域冗餘配置。區域冗餘緩存可以將其節點放置在同一區域的不同 Azure 可用性區域中。它消除了作為單點故障的數據中心或可用區中斷，並提高了緩存的整體可用性。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Network/networkSecurityGroups",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
- "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "NSG",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"severity": "中等",
- "text": "由於規則數限制為 1000 個，因此每個 NSG 實施的 NSG 規則不要超過 900 個。",
- "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "text": "為 Azure Cache for Redis 實例配置數據持久性。由於緩存數據存儲在記憶體中，因此多個節點的罕見和計劃外故障可能會導致所有數據被丟棄。為了避免完全丟失數據，Redis 持久性允許您定期拍攝記憶體中數據的快照，並將其存儲到存儲帳戶中。",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
- "service": "VWAN",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"severity": "中等",
- "text": "如果您的方案在虛擬 WAN 路由設計清單中明確描述，請使用虛擬 WAN。",
- "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
- "waf": "操作"
+ "text": "使用異地冗餘存儲帳戶保留 Azure Cache for Redis 數據，或在異地冗餘不可用的情況下使用區域冗餘",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
- "service": "VWAN",
+ "arm-service": "microsoft.cache/redis",
+ "checklist": "Redis Resiliency checklist",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"severity": "中等",
- "text": "使用每個 Azure 區域的虛擬 WAN 中心，透過通用的全球 Azure 虛擬 WAN 跨 Azure 區域將多個登陸區域連接在一起。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "性能"
+ "text": "為高級 Azure Cache for Redis 實例配置被動異地複製。異地複製是一種用於連結兩個或多個 Azure Cache for Redis 實例的機制，通常跨越兩個 Azure 區域。異地複製主要用於跨區域災難恢復。兩個高級層緩存實例通過異地複製進行連接，從而提供對主緩存的讀取和寫入，並將數據複製到輔助緩存。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
- "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
- "service": "VWAN",
- "severity": "中等",
- "text": "對於出站 Internet 流量保護和篩選，請在安全中心部署 Azure 防火牆。",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "安全"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
+ "severity": "高",
+ "text": "使 2 個副本具有 99.9% 的讀取操作可用性",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
- "service": "VWAN",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"severity": "中等",
- "text": "確保您的虛擬 WAN 網路架構與已確定的架構方案保持一致。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "使 3 個副本具有 99.9% 的讀/寫操作可用性",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
- "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
- "service": "VWAN",
- "severity": "中等",
- "text": "使用適用於虛擬 WAN 的 Azure Monitor Insights 來監視虛擬 WAN 的端到端拓撲、狀態和關鍵指標。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
- "waf": "操作"
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
+ "severity": "高",
+ "text": "通過啟用讀取和/或寫入副本來利用可用區",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic == 'true') | distinct id,compliant",
- "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
- "service": "VWAN",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"severity": "中等",
- "text": "不要在虛擬 WAN 中禁用分支到分支流量，除非應明確阻止這些流。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "對於區域冗餘，請在2個或更多區域中為搜索手動創建服務，因為它不提供跨地理區域複製搜索索引的自動方法",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs'| extend compliant= (properties.hubRoutingPreference =~ 'ASPath') | distinct id,compliant",
- "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
- "service": "VWAN",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"severity": "中等",
- "text": "使用 AS-Path 作為中心路由首選項，因為它比 ExpressRoute 或 VPN 更靈活。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "若要跨多個服務同步數據，請使用索引器更新多個服務上的內容，或使用 REST API 推送多個服務上的內容更新",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
- "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
- "service": "VWAN",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"severity": "中等",
- "text": "在虛擬 WAN 中配置基於標籤的傳播，否則虛擬中心之間的連接將受到影響。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "使用 Azure 流量管理器協調請求",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.network/virtualWans",
- "checklist": "Azure Landing Zone Review",
- "graph": "resources | where type =~ 'microsoft.network/virtualhubs' | extend addressSpace = properties.addressPrefix | extend compliant= (toint(substring(addressSpace, indexof(addressSpace, '/') + 1)) < 23) | distinct name, id, compliant",
- "guid": "9c75dfef-573c-461c-a698-68598595581a",
- "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
- "service": "VWAN",
+ "arm-service": "Microsoft.Search/searchServices",
+ "checklist": "Cognitive Search Review Checklist",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"severity": "高",
- "text": "為虛擬中心分配至少 /23 前置綴，以確保有足夠的IP空間可用。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "text": "備份和還原 Azure 認知搜索索引。使用此範例代碼將索引定義和快照備份到一系列 Json 檔",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "請考慮「存儲的 Azure 安全基線”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"severity": "高",
- "text": "戰略性地利用 Azure Policy，使用策略計劃對相關策略進行分組，為您的環境定義控制措施。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "考慮將專用終結點用於 Azure 存儲",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "將法規和合規性要求映射到 Azure Policy 定義和 Azure 角色分配。",
- "training": "https://learn.microsoft.com/training/modules/governance-security/",
+ "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "為所有存儲帳戶啟用 Microsoft Defender",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "軟刪除機制允許恢復意外刪除的 blob。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "為 blob 啟用“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "在中間根管理組建立 Azure Policy 定義，以便可以在繼承的範圍內分配這些定義。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "禁用 blob 的“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "容器的軟刪除使您能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"severity": "高",
- "text": "如果需要，在最高適當的級別管理策略分配，並在最低級別管理排除項。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "為容器啟用“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "43334f24-9116-4341-a2ba-527526944008",
- "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
- "service": "Policy",
- "severity": "低",
- "text": "使用 Azure Policy 控制使用者可以在訂閱/管理組級別預配哪些服務。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "禁用容器的“軟刪除”",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過強制使用者先刪除刪除鎖，然後再刪除存儲帳戶，防止意外刪除存儲帳戶",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"severity": "高",
- "text": "盡可能使用內置策略，以最大程度地減少運營開銷。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "text": "在存儲帳戶上啟用資源鎖定",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "description": "通過將 Resource Policy Contributor 角色分配給特定範圍，您可以將策略管理委派給相關團隊。例如，中央IT團隊可以監督管理組級別的策略，而應用程式團隊則處理其訂閱的策略，從而在遵守組織標準的情況下實現分散式治理。",
- "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
- "service": "Policy",
- "severity": "中等",
- "text": "在特定範圍內分配內置的 Resource Policy Contributor 角色，以啟用應用程式級監管。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，以便無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;一旦存儲帳戶包含不可變的 blob，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮不可變的 blob",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "19048384-5c98-46cb-8913-156a12476e49",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Policy",
- "severity": "中等",
- "text": "限制在根管理組範圍內進行的 Azure Policy 分配的數量，以避免通過繼承範圍內的排除項進行管理。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並且對伺服器進行身份驗證。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
- "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
- "service": "Policy",
- "severity": "中等",
- "text": "如果存在任何數據主權要求，則應部署 Azure 策略來強制實施這些要求。",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "強制執行 HTTPS（禁用 HTTP）時，請檢查是否不要對儲存帳戶使用自定義域 （CNAME）。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
- "service": "Policy",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於最大程度地降低憑據丟失的風險。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "對於 Sovereign Landing Zone，請部署主權策略基線並在正確的管理組級別進行分配。",
+ "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
- "service": "Policy",
- "severity": "中等",
- "text": "對於 Sovereign Landing Zone，將 Sovereign Control 目標記錄到策略映射。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ".強制執行最新的 TLS 版本將拒絕來自使用舊版本的用戶端的請求。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "強制實施存儲帳戶的最新 TLS 版本",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Authorization/policyDefinitions",
- "checklist": "Azure Landing Zone Review",
- "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
- "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
- "service": "Policy",
- "severity": "中等",
- "text": "對於 Sovereign Landing Zone，請確保已制定管理“主權控制目標到策略映射”的流程。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在可能的情況下，應優先使用 Microsoft Entra ID 令牌，而不是共用訪問簽名",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "使用 Microsoft Entra ID 令牌進行 blob 訪問",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#azure-regions",
- "service": "Monitor",
- "severity": "中等",
- "text": "使用單個監視器日誌工作區集中管理平臺，除非 Azure 基於角色的訪問控制 （Azure RBAC）、數據主權要求或數據保留策略要求單獨的工作區。",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "操作"
- },
- {
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "7418ada9-4199-4c28-8286-d15e9433e8f3",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "為使用者、組或應用程式分配角色時，請僅授予該安全主體執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "決定是對所有區域使用單個 Azure Monitor 日誌工作區，還是創建多個工作區以涵蓋不同的地理區域。每種方法都有優點和缺點，包括潛在的跨區域網路費用",
- "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "waf": "可靠性"
+ "text": "IaM 許可權中的最小特權",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但與服務 SAS 相比，它提供了安全優勢。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
"severity": "高",
- "text": "如果您的日誌保留要求超過 12 年，請將日誌匯出到 Azure 存儲。將不可變存儲與一次寫入、多次讀取策略結合使用，使數據在使用者指定的時間間隔內不可擦除且不可修改。",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "操作"
- },
- {
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
- "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
- "service": "VM",
- "severity": "中等",
- "text": "使用 Azure Policy 監視 OS 等級的虛擬機 （VM） 配置偏移。通過策略啟用 Azure Automanage 計算機配置審核功能可幫助應用程式團隊工作負載輕鬆立即使用功能。",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "操作"
+ "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
- "service": "VM",
- "severity": "中等",
- "text": "使用 Azure 更新管理員作為 Azure 中 Windows 和 Linux VM 的修補機制。",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取了密鑰的副本，但一旦密鑰掌握在多人手中，就不可能將使用方式歸因於特定使用者。僅依賴 Entra ID 身份驗證可以更輕鬆地將存儲訪問許可權與用戶綁定。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 Microsoft Entra ID 訪問（和使用者委派 SAS）。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
- "service": "VM",
- "severity": "中等",
- "text": "使用 Azure Update Manager 作為使用 Azure Arc 的 Azure 外部 Windows 和 Linux VM 的修補機制。",
- "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用活動日誌數據來確定查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/networkWatchers",
- "checklist": "Azure Landing Zone Review",
- "guid": "90483845-c986-4cb2-a131-56a12476e49f",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Network Watcher",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果已過指定的時間間隔且尚未旋轉鍵，則會顯示提醒。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用網路觀察程序主動監控流量。",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "操作"
+ "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 過期策略指定了 SAS 的有效時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們將看到警告。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用 Azure Monitor 紀錄獲取見解和報告。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
- "waf": "操作"
+ "text": "考慮配置 SAS 過期策略",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過存儲訪問策略，可以選擇撤銷服務 SAS 的許可權，而無需重新生成存儲帳戶密鑰。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用 Azure Monitor 警報生成操作警報。",
- "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
- "waf": "操作"
+ "text": "考慮將 SAS 連結到儲存存取策略",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "Monitor",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "通過 Azure 自動化帳戶使用更改和清單跟蹤時，請確保已選擇受支持的區域，以便將 Log Analytics 工作區和自動化帳戶連結在一起。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
- "waf": "操作"
+ "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Backup",
- "severity": "低",
- "text": "使用Azure備份時，請使用正確的備份類型（GRS，ZRS和LRS）進行備份，因為預設設置是GRS。",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "可靠性"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中擁有存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮在 Azure KeyVault 中儲存連接字串（在無法使用託管標識的情況下）",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "VM",
- "severity": "中等",
- "text": "使用 Azure 來賓策略通過 VM 擴展自動部署軟體配置，並強制實施合規的基線 VM 配置。",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只會在短時間內有效。如果無法引用存儲訪問策略，則這種做法尤為重要。近期過期時間還通過限制可用於上傳到 blob 的時間來限制可以寫入 blob 的數據量。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "爭取縮短臨時 SAS 的有效期",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "description": "使用 Azure Policy 的來賓配置功能來審核和修正電腦設置（例如，操作系統、應用程式、環境），以確保資源與預期配置保持一致，並且更新管理可以對 VM 強制實施修補程式管理。",
- "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "VM",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "創建 SAS 時，請盡可能具體且具有限制性。首選單一資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "通過 Azure Policy 監視 VM 安全配置偏移。",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "對SAS應用窄範圍",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "將 Azure Site Recovery 用於 Azure 到 Azure 虛擬機的災難恢復方案。這使您能夠跨區域複製工作負載。",
- "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
- "waf": "操作"
+ "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "Backup",
- "severity": "中等",
- "text": "使用 Azure 原生備份功能或與 Azure 相容的第三方備份解決方案。",
- "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
- "waf": "操作"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能很有意義。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低",
+ "text": "在用戶端使用SAS上傳檔后，請考慮檢查上傳的數據。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "WAF",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用「本地使用者帳戶」通過 SFTP 訪問 blob 儲存時，“通常”的 RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更具限制性。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點目前支援的唯一身份管理形式",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
"severity": "高",
- "text": "添加診斷設置以保存來自應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）的 WAF 日誌。定期查看日誌以檢查是否存在攻擊和誤報檢測。",
- "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
- "waf": "操作"
+ "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核隨著時間的推移是否需要訪問。",
+ "waf": "安全"
},
{
- "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
- "checklist": "Azure Landing Zone Review",
- "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "WAF",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "將 WAF 日誌從應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）發送到 Microsoft Sentinel。檢測攻擊並將 WAF 遙測集成到整個 Azure 環境中。",
- "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
- "waf": "操作"
+ "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "5017f154-e3ab-4369-9829-e7e316183687",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "存儲支援 CORS（跨源資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放鬆同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"severity": "高",
- "text": "使用 Azure Key Vault 儲存機密和憑據。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "text": "避免過於寬泛的 CORS 策略",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
- "guid": "a0477a20-9945-4bda-9333-4f2491163418",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
- "service": "Key Vault",
- "severity": "中等",
- "text": "對不同的應用程式和區域使用不同的 Azure Key Vault，以避免事務規模限制並限制對機密的訪問。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "確定應如何加密靜態數據。了解數據的線程模型。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "預配 Azure Key Vault 並啟用軟刪除和清除策略，以允許對已刪除的物件進行保留保護。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "text": "確定應使用哪種/是否應使用平臺加密。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "通過將永久刪除密鑰、機密和證書的授權限制為專門的自定義 Microsoft Entra ID 角色，遵循最低許可權模型。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "text": "確定應使用哪種/是否應使用用戶端加密。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "中等",
- "text": "與公共證書頒發機構一起自動執行證書管理和續訂流程，以簡化管理。",
- "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "利用 Resource Graph 資源管理器 （resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true） 查找允許匿名 blob 訪問的存儲帳戶。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮是否需要公共 blob 匿名訪問，或者是否可以對某些存儲帳戶禁用公共 blob 匿名訪問。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "913156a1-2476-4e49-b541-acdce979377b",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
- "severity": "中等",
- "text": "建立金鑰和證書輪換的自動化流程。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "安全"
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "利用 storagev2 帳戶類型獲得更好的性能和可靠性",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "利用 GRS、ZRS 或 GZRS 儲存實現最高可用性",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "在保管庫上啟用防火牆和虛擬網路服務終結點或專用終結點，以控制對密鑰保管庫的訪問。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
- "waf": "安全"
+ "text": "對於故障轉移后的寫入操作，請使用客戶管理的故障轉移",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "使用平臺中心的 Azure Monitor Log Analytics 工作區來審核 Key Vault 的每個實例中的密鑰、證書和機密使用方式。",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "安全"
+ "text": "瞭解 Microsoft 託管的故障轉移詳細資訊",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"severity": "中等",
- "text": "委託 Key Vault 實例化和特權訪問，並使用 Azure Policy 強制實施一致的合規配置。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
- "waf": "安全"
+ "text": "啟用軟刪除",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"severity": "中等",
- "text": "每個區域每個環境的每個應用程式使用 Azure Key Vault。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
- "waf": "安全"
+ "text": "Azure SAP 解決方案 中心 （ACSS） 是一種 Azure 產品/服務，它使 SAP 成為 Azure 上的頂級工作負載。ACSS 是一種端到端解決方案，使你能夠在 Azure 上將 SAP 系統作為統一工作負載創建和運行，併為創新提供更無縫的基礎。您可以利用新的和現有的基於 Azure 的 SAP 系統的管理功能。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"severity": "中等",
- "text": "如果您想使用自己的金鑰，則可能並非所有考慮的服務都支援此功能。實施相關的緩解措施，以便不一致不會妨礙預期的結果。選擇適當的區域對和災難恢復區域，以最大限度地減少延遲。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "安全"
+ "text": "Azure 支援在Linux和 Windows 中自動執行 SAP 部署。SAP Deployment Automation Framework 是一種開源編排工具，可以部署、安裝和維護 SAP 環境。",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
- "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"severity": "中等",
- "text": "對於主權登陸區域，請使用 Azure Key Vault 託管 HSM 來儲存機密和憑據。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
- "waf": "安全"
+ "text": "在滿足 RTO 的任何時間和時間範圍內對生產資料庫執行時間點恢復;時間點恢復通常包括操作員錯誤地刪除 DBMS 層或透過 SAP 刪除數據",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
- "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"severity": "中等",
- "text": "使用 Microsoft Entra ID 報告功能生成訪問控制審核報告。",
- "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
- "waf": "安全"
+ "text": "測試備份和恢復時間，以驗證它們是否滿足在災難發生后同時還原所有系統的 RTO 要求。",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "09945bda-4333-44f2-9911-634182ba5275",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
- "service": "Defender",
+ "checklist": "SAP Checklist",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"severity": "高",
- "text": "為所有訂閱啟用Defender Cloud安全態勢管理。",
- "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
- "waf": "安全"
+ "text": "您可以在配對區域之間複製標準存儲，但不能使用標準存儲來存儲資料庫或虛擬硬碟。您只能在您使用的配對區域之間複製備份。對於所有其他數據，請使用 SQL Server Always On 或 SAP HANA 系統複製等本機 DBMS 功能運行複製。將 Site Recovery、rsync 或 robocopy 以及其他第三方軟體組合用於 SAP 應用程式層。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
- "service": "Defender",
- "severity": "高",
- "text": "為所有訂閱上的伺服器啟用Defender雲工作負載保護計劃。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
+ "severity": "中等",
+ "text": "使用 Azure 可用性區域實現高可用性時，必須考慮 SAP 應用程式伺服器和資料庫伺服器之間的延遲。對於具有高延遲的區域，需要制定操作過程，以確保 SAP 應用程式伺服器和資料庫伺服器始終在同一區域中運行。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
- "service": "Defender",
+ "checklist": "SAP Checklist",
+ "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"severity": "高",
- "text": "在所有訂閱上為 Azure 資源啟用 Defender Cloud 工作負載保護計劃。",
- "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
- "waf": "安全"
+ "text": "設置從本地到主要和輔助 Azure 災難恢復區域的 ExpressRoute 連接。此外，作為使用 ExpressRoute 的替代方法，請考慮設置從本地到主要和輔助 Azure 災難恢復區域的 VPN 連接。",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
- "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
- "service": "VM",
- "severity": "高",
- "text": "在 IaaS 伺服器上啟用 Endpoint Protection。",
- "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
+ "severity": "低",
+ "text": "跨區域複製金鑰保管庫內容（如證書、機密或金鑰），以便可以在DR區域中解密資料。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
- "checklist": "Azure Landing Zone Review",
- "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
- "link": "https://learn.microsoft.com/azure/security-center/",
- "service": "VM",
+ "checklist": "SAP Checklist",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"severity": "中等",
- "text": "通過 Azure Monitor 紀錄和 Defender for Cloud 監視基本作業系統修補偏差。",
- "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
- "waf": "安全"
+ "text": "將主虛擬網路和災難恢復虛擬網路對等互連。例如，對於 HANA 系統複製，SAP HANA DB 虛擬網路需要與災難恢復網站的 SAP HANA DB 虛擬網路對等互連。",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Insights/components",
- "checklist": "Azure Landing Zone Review",
- "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Monitor",
- "severity": "中等",
- "text": "將預設資源配置連接到集中式 Azure Monitor Log Analytics 工作區。",
- "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
+ "severity": "低",
+ "text": "如果將 Azure NetApp Files 儲存用於 SAP 部署，則至少在兩個區域中的高級層中創建兩個 Azure NetApp Files 帳戶。",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)",
- "guid": "a56888b2-7e83-4404-bd31-b886528502d1",
- "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs",
- "service": "Entra",
+ "checklist": "SAP Checklist",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "高",
- "text": "使用關聯日誌進行集中威脅檢測 - 將安全數據整合到一個中心位置，以便通過SIEM（安全資訊和事件管理）在各種服務之間關聯數據",
- "waf": "安全"
+ "text": "應使用本機資料庫複製技術來同步HA對中的資料庫。",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
- "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
- "service": "Entra",
- "severity": "中等",
- "text": "對於 Sovereign Landing Zone，請在 Entra ID 租戶上啟用透明度日誌。",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
+ "severity": "高",
+ "text": "主虛擬網路 （VNet） 的 CIDR 不應與DR網站的 VNet 的 CIDR 衝突或重疊",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "可靠性"
},
{
- "checklist": "Azure Landing Zone Review",
- "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
- "service": "Entra",
- "severity": "中等",
- "text": "對於 Sovereign Landing Zone，請在 Entra ID 租戶上啟用客戶密碼箱。",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
+ "severity": "高",
+ "text": "使用 Site Recovery 將應用程式伺服器複製到 DR 網站。Site Recovery 還可以説明將中心服務群集 VM 複製到DR網站。調用DR時，您需要在DR網站上重新配置Linux Pacemaker集群（例如，替換VIP或SBD、運行 corosync.conf 等）。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Storage",
+ "checklist": "SAP Checklist",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "高",
- "text": "啟用到存儲帳戶的安全傳輸。",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
- "waf": "安全"
+ "text": "考慮 SAP 軟體的可用性，防止單點故障。這包括應用程式中的單點故障，例如 SAP NetWeaver 和 SAP S/4HANA 架構中使用的 DBMS、SAP ABAP 和 ASCS + SCS。此外，還可以使用其他工具，例如 SAP Web Dispatcher。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Landing Zone Review",
- "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
- "service": "Storage",
+ "checklist": "SAP Checklist",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"severity": "高",
- "text": "為存儲帳戶啟用容器軟刪除，以恢復已刪除的容器及其內容。",
- "waf": "安全"
+ "text": "對於 SAP 和 SAP 資料庫，請考慮實現自動故障轉移群集。在 Windows 中，Windows Server 故障轉移群集支援故障轉移。在Linux中，Linux Pacemaker或SIOS Protection Suite 和 Veritas InfoScale 等第三方工具支援故障轉移。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
- "checklist": "Azure Landing Zone Review",
- "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
- "service": "Key Vault",
+ "checklist": "SAP Checklist",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"severity": "高",
- "text": "使用 Key Vault 機密來避免對敏感資訊進行硬編碼，例如憑據（虛擬機用戶密碼）、證書或密鑰。",
- "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
- "waf": "操作"
+ "text": "Azure 不支援主 VM 和輔助 VM 共用 DBMS 數據存儲的體系結構。對於 DBMS 層，常見的架構模式是同時複製資料庫，並且使用與主 VM 和輔助 VM 使用的儲存堆疊不同的儲存堆疊。",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure 事件中心提供靜態數據加密。如果使用自己的金鑰，則仍使用 Microsoft 管理的金鑰對數據進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
- "severity": "低",
- "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
+ "severity": "高",
+ "text": "DBMS 數據和事務/重做日誌檔存儲在 Azure 支援的塊存儲或 Azure NetApp 檔中。不支援將 Azure 檔案儲存或 Azure 高級檔儲存作為 SAP 工作負載的 DBMS 資料和/或重做日誌檔的存儲。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure 事件中心命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將事件中心命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。如果事件中心命名空間需要最低版本的 TLS，則使用舊版本發出的任何請求都將失敗。",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "對請求強制實施傳輸層安全性 （TLS） 的最低要求版本",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
+ "severity": "高",
+ "text": "您可以在 Windows 中使用 Azure 共用磁碟，以實現 ASCS + SCS 元件和特定的高可用性方案。分別為 SAP 應用程式層元件和 DBMS 層設置故障轉移集群。Azure 目前不支援將 SAP 應用程式層元件和 DBMS 層合併到一個故障轉移群集中的高可用性體系結構。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "創建事件中心命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的策略規則。此策略具有整個命名空間的管理許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。建議將 AAD 用作 RBAC 的身份驗證提供程式。",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "避免在不必要的情況下使用root帳戶",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
+ "severity": "高",
+ "text": "SAP 應用程式層元件 （ASCS） 和 DBMS 層的大多數故障轉移群集都需要故障轉移群集的虛擬 IP 位址。 Azure 負載均衡器應處理所有其他情況下的虛擬IP位址。一種設計原則是每個集群配置使用一個負載均衡器。我們建議您使用標準版本的負載均衡器 （Standard Load Balancer SKU）。",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure 資源的託管標識可以使用 Azure AD 憑據從 Azure 虛擬機 （VM）、函數應用、虛擬機規模集和其他服務中運行的應用程式授權訪問事件中心資源。通過將 Azure 資源的託管標識與 Azure AD 身份驗證結合使用，可以避免將憑據存儲在雲中運行的應用程式中。",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "如果可能，應用程式應使用託管標識向 Azure 事件中心進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中擁有存儲憑據（SAS、服務主體憑據）",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
+ "severity": "高",
+ "text": "確保在負載均衡器上啟用了浮動IP",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "創建許可權時，請對用戶端對 Azure 事件中心的訪問提供精細控制。Azure 事件中心中的許可權可以而且應該限定為單個資源級別，例如消費者組、事件中心實體、事件中心命名空間等。",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"severity": "高",
- "text": "使用最低特權數據平面 RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "安全"
+ "text": "在部署高可用性基礎結構之前，根據您選擇的區域，確定是使用 Azure 可用性集還是可用性區域進行部署。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "Azure 事件中心資源日誌包括操作日誌、虛擬網路和 Kafka 日誌。運行時審核日誌捕獲事件中心中所有數據平面訪問操作（例如發送或接收事件）的聚合診斷資訊。",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "啟用記錄以進行安全調查。使用 Azure Monitor 捕獲指標和日誌，例如資源日誌、運行時審核日誌和 Kafka 紀錄",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
+ "severity": "高",
+ "text": "如果要滿足 SAP 元件（中央服務、應用程式伺服器和資料庫）的應用程式的基礎設施 SLA，則必須為所有元件選擇相同的高可用性選項（VM、可用性集、可用區）。",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "默認情況下，Azure 事件中心具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路和 Azure 事件中心之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公共終結點，則應禁用這些終結點。",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "請考慮使用專用終結點訪問 Azure 事件中心，並在適用時禁用公用網路訪問。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
+ "checklist": "SAP Checklist",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "高",
+ "text": "不要在同一可用性集中混合使用不同角色的伺服器。將中心服務 VM、資料庫 VM、應用程式 VM 保留在其自己的可用性集中",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "使用IP防火牆，可以將公共終結點進一步限製為僅一組IPv4位址或 CIDR（無類別域間路由）表示法的IPv4位址範圍。",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"severity": "中等",
- "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 事件中心命名空間",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "text": "除非使用鄰近放置組，否則無法在 Azure 可用性區域中部署 Azure 可用性集。",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "利用 FTA 彈性手冊",
+ "checklist": "SAP Checklist",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
+ "severity": "高",
+ "text": "創建可用性集時，請使用可用的容錯域和更新域的最大數量。例如，如果您在一個可用性集中部署兩個以上的 VM，除了 Azure 計劃內維護之外，還請使用最大數量的容錯域 （三個） 和足夠的更新域，以限制潛在物理硬體故障、網路中斷或電源中斷的影響。容錯域的預設數量為 2，以後無法在線更改。",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "對於從門戶創建的新 EH 命名空間，在啟用區域的區域中具有高級、專用或標準 SKU，將自動啟用此功能。EH 元數據和事件數據本身都是跨區域複製的",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"severity": "高",
- "text": "利用可用區（如果區域適用）",
+ "text": "在可用性集部署中使用 Azure 鄰近放置組時，所有三個 SAP 元件（中央服務、應用程式伺服器和資料庫）都應位於同一鄰近放置組中。",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
- "severity": "中等",
- "text": "使用高級或專用 SKU 實現可預測的性能",
+ "checklist": "SAP Checklist",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
+ "severity": "高",
+ "text": "每個 SAP SID 使用一個鄰近放置組。組不跨可用性區域或 Azure 區域",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "啟用內置異地災難恢復功能后，可確保命名空間的整個配置（事件中心、消費者組和設置）從主命名空間持續複製到輔助命名空間，並允許隨時從主命名空間向輔助命名空間進行一次故障轉移。主動/被動功能旨在更輕鬆地從失敗的 Azure 區域中恢復和放棄，而無需更改應用程式配置",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "高",
- "text": "使用主動被動配置規劃異地災難恢復",
+ "text": "使用以下服務之一運行 SAP Central Services 集群，具體取決於操作系統。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "description": "應用於無法容忍關閉區域中事件數據中斷或丟失的DR配置。對於這些情況，請遵循複製指南，不要使用內置的異地災難恢復功能（主動/被動）。使用「主動/主動」時，在不同區域和命名空間中維護多個事件中心，事件將在中心之間複製",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"severity": "中等",
- "text": "對於業務關鍵型應用程式，請使用 Active Active 配置",
+ "text": "Azure 目前不支援在同一個 Linux Pacemaker 群集中組合 ASCS 和 DB HA;將它們分成單獨的集群。但是，您最多可以將5個多個中央服務集群組合成一對VM。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
- "checklist": "Azure Event Hub Review",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "checklist": "SAP Checklist",
+ "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"severity": "中等",
- "text": "設計可復原的事件中心",
+ "text": "將高可用性對中的兩個 VM 部署在可用性集或可用性區域中。這些 VM 的大小應相同，並且具有相同的存儲配置。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones",
- "service": "IoT",
- "severity": "高",
- "text": "利用可用區（如果區域適用）（這是自動啟用的）",
+ "checklist": "SAP Checklist",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
+ "severity": "中等",
+ "text": "Azure 支援在 Red Hat Enterprise Linux （RHEL） 上運行的同一高可用性群集上安裝和配置 SAP HANA 以及 ASCS/SCS 和 ERS 實例。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
- "severity": "中等",
- "text": "請注意 Microsoft 發起的故障轉移。Microsoft 在極少數情況下會執行這些操作，以將所有IoT中心從受影響的區域故障轉移到相應的異地配對區域。",
+ "checklist": "SAP Checklist",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "severity": "高",
+ "text": "在高級託管 SSD 上運行所有生產系統，並使用 Azure NetApp Files 或超級磁碟存儲。至少OS磁碟應位於高級層上，以便您可以獲得更好的性能和最佳SLA。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"severity": "高",
- "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
+ "text": "應僅在 SAP 認證的存儲類型上運行 Azure 上的 SAP HANA。請注意，某些卷必須在某些磁碟配置上運行（如果適用）。這些配置包括啟用 Write Accelerator 和使用高級存儲。您還需要確保在儲存上運行的檔案系統與計算機上運行的 DBMS 相容。",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
"severity": "高",
- "text": "瞭解如何觸發手動故障轉移。",
+ "text": "考慮根據您用於 SAP 工作負載的儲存類型配置高可用性。Azure Site Recovery 不支援 Azure 中提供的某些存儲服務，因此高可用性配置可能會有所不同。",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.Devices/IotHubs",
- "checklist": "IoT Hub Review",
- "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22",
- "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback",
- "service": "IoT",
+ "checklist": "SAP Checklist",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"severity": "高",
- "text": "瞭解如何在故障轉移後進行故障回復。",
+ "text": "不同的本機 Azure 儲存服務（如 Azure 檔、Azure NetApp 檔、Azure 共用磁碟）可能並非在所有區域都可用。因此，要在故障轉移后在DR區域上進行類似的SAP設置，請確保在DR網站中提供相應的存儲服務。",
"waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
"service": "SAP",
"severity": "中等",
- "text": "Azure SAP 解決方案 中心 （ACSS） 是一種 Azure 產品/服務，它使 SAP 成為 Azure 上的頂級工作負載。ACSS 是一種端到端解決方案，使你能夠在 Azure 上將 SAP 系統作為統一工作負載創建和運行，併為創新提供更無縫的基礎。您可以利用新的和現有的基於 Azure 的 SAP 系統的管理功能。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
- "waf": "操作"
+ "text": "自動化 SAP System Start-Stop 以管理成本。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
"service": "SAP",
- "severity": "中等",
- "text": "Azure 支援在Linux和 Windows 中自動執行 SAP 部署。SAP Deployment Automation Framework 是一種開源編排工具，可以部署、安裝和維護 SAP 環境。",
- "training": "https://github.com/Azure/sap-automation",
- "waf": "操作"
+ "severity": "低",
+ "text": "如果將 Azure 高級存儲與 SAP HANA 配合使用，則可以使用 Azure 標準 SSD 儲存來選擇注重成本的儲存解決方案。但是，請注意，選擇標準 SSD 或標準 HDD Azure 儲存將影響單個 VM 的 SLA。此外，對於 I/O 輸送量較低且延遲較低的系統（如非生產環境），可以使用較低系列的 VM。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
"service": "SAP",
- "severity": "中等",
- "text": "在滿足 RTO 的任何時間和時間範圍內對生產資料庫執行時間點恢復;時間點恢復通常包括操作員錯誤地刪除 DBMS 層或透過 SAP 刪除數據",
- "waf": "可靠性"
+ "severity": "低",
+ "text": "作為成本較低的替代配置（多用途），您可以為非生產 HANA 資料庫伺服器 VM 選擇低性能 SKU。但是，請務必注意，某些 VM 類型（如 E 系列）未經過 HANA 認證（SAP HANA 硬體目錄），或者無法實現小於 1 毫秒的存儲延遲。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
+ "severity": "高",
+ "text": "對管理組、訂閱、資源組和資源強制實施 RBAC 模型",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "安全"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
"service": "SAP",
"severity": "中等",
- "text": "測試備份和恢復時間，以驗證它們是否滿足在災難發生后同時還原所有系統的 RTO 要求。",
- "waf": "可靠性"
+ "text": "強制實施主體傳播，以便透過雲連接器將身份從 SAP 雲應用程式轉發到 SAP 本地（包括 IaaS）",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
"service": "SAP",
- "severity": "高",
- "text": "您可以在配對區域之間複製標準存儲，但不能使用標準存儲來存儲資料庫或虛擬硬碟。您只能在您使用的配對區域之間複製備份。對於所有其他數據，請使用 SQL Server Always On 或 SAP HANA 系統複製等本機 DBMS 功能運行複製。將 Site Recovery、rsync 或 robocopy 以及其他第三方軟體組合用於 SAP 應用程式層。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "使用 SAML 通過 Azure AD 實現對 SAP SaaS 應用程式（如 SAP Analytics Cloud、SAP Cloud Platform、Business by design、SAP Qualtrics 和 SAP C4C）的 SSO。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
"service": "SAP",
"severity": "中等",
- "text": "使用 Azure 可用性區域實現高可用性時，必須考慮 SAP 應用程式伺服器和資料庫伺服器之間的延遲。對於具有高延遲的區域，需要制定操作過程，以確保 SAP 應用程式伺服器和資料庫伺服器始終在同一區域中運行。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "可靠性"
+ "text": "使用 SAML 對基於 SAP NetWeaver 的 Web 應用程式（如 SAP Fiori 和 SAP Web GUI）實施 SSO。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType =~ 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
"service": "SAP",
- "severity": "高",
- "text": "設置從本地到主要和輔助 Azure 災難恢復區域的 ExpressRoute 連接。此外，作為使用 ExpressRoute 的替代方法，請考慮設置從本地到主要和輔助 Azure 災難恢復區域的 VPN 連接。",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "使用 SAML 對基於 SAP NetWeaver 的 Web 應用程式（如 SAP Fiori 和 SAP Web GUI）實施 SSO。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
"service": "SAP",
- "severity": "低",
- "text": "跨區域複製金鑰保管庫內容（如證書、機密或金鑰），以便可以在DR區域中解密資料。",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "您可以使用 SAP NetWeaver SSO 或合作夥伴解決方案實現對 SAP GUI 的 SSO。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
"service": "SAP",
"severity": "中等",
- "text": "將主虛擬網路和災難恢復虛擬網路對等互連。例如，對於 HANA 系統複製，SAP HANA DB 虛擬網路需要與災難恢復網站的 SAP HANA DB 虛擬網路對等互連。",
- "waf": "可靠性"
+ "text": "對於 SAP GUI 和 Web 瀏覽器訪問的 SSO，實施 SNC / Kerberos/SPNEGO（簡單且受保護的 GSSAPI 協商機制），因為它易於配置和維護。對於使用 X.509 用戶端證書的 SSO，請考慮使用 SAP Secure Login Server，它是 SAP SSO 解決方案的一個元件。",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
"service": "SAP",
- "severity": "低",
- "text": "如果將 Azure NetApp Files 儲存用於 SAP 部署，則至少在兩個區域中的高級層中創建兩個 Azure NetApp Files 帳戶。",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "對於 SAP GUI 和 Web 瀏覽器訪問的 SSO，實施 SNC / Kerberos/SPNEGO（簡單且受保護的 GSSAPI 協商機制），因為它易於配置和維護。對於使用 X.509 用戶端證書的 SSO，請考慮使用 SAP Secure Login Server，它是 SAP SSO 解決方案的一個元件。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
"service": "SAP",
- "severity": "高",
- "text": "應使用本機資料庫複製技術來同步HA對中的資料庫。",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "通過使用 SAP NetWeaver 的 OAuth 實施 SSO，以允許第三方或自定義應用程式訪問 SAP NetWeaver OData 服務。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
"service": "SAP",
- "severity": "高",
- "text": "主虛擬網路 （VNet） 的 CIDR 不應與DR網站的 VNet 的 CIDR 衝突或重疊",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "實施SAP HANA的 SSO",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
"service": "SAP",
- "severity": "高",
- "text": "使用 Site Recovery 將應用程式伺服器複製到 DR 網站。Site Recovery 還可以説明將中心服務群集 VM 複製到DR網站。調用DR時，您需要在DR網站上重新配置Linux Pacemaker集群（例如，替換VIP或SBD、運行 corosync.conf 等）。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "將 Azure AD 視為 RISE 上託管的 SAP 系統的標識提供者。有關詳細資訊，請參閱將服務與 Azure AD 集成。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
"service": "SAP",
- "severity": "高",
- "text": "考慮 SAP 軟體的可用性，防止單點故障。這包括應用程式中的單點故障，例如 SAP NetWeaver 和 SAP S/4HANA 架構中使用的 DBMS、SAP ABAP 和 ASCS + SCS。此外，還可以使用其他工具，例如 SAP Web Dispatcher。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "對於訪問 SAP 的應用程式，您可能希望使用主體傳播來建立 SSO。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
"service": "SAP",
- "severity": "高",
- "text": "對於 SAP 和 SAP 資料庫，請考慮實現自動故障轉移群集。在 Windows 中，Windows Server 故障轉移群集支援故障轉移。在Linux中，Linux Pacemaker或SIOS Protection Suite 和 Veritas InfoScale 等第三方工具支援故障轉移。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "如果使用需要 SAP 身份驗證服務 （IAS） 的 SAP BTP 服務或 SaaS 解決方案，請考慮在 SAP Cloud Identity Authentication 服務和 Azure AD 之間實現 SSO 以存取這些 SAP 服務。此集成允許 SAP IAS 充當代理標識提供者，並將身份驗證請求轉發到作為中央使用者存儲和標識提供者的 Azure AD。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
"service": "SAP",
- "severity": "高",
- "text": "Azure 不支援主 VM 和輔助 VM 共用 DBMS 數據存儲的體系結構。對於 DBMS 層，常見的架構模式是同時複製資料庫，並且使用與主 VM 和輔助 VM 使用的儲存堆疊不同的儲存堆疊。",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "實施 SSO 到 SAP BTP",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
"service": "SAP",
- "severity": "高",
- "text": "DBMS 數據和事務/重做日誌檔存儲在 Azure 支援的塊存儲或 Azure NetApp 檔中。不支援將 Azure 檔案儲存或 Azure 高級檔儲存作為 SAP 工作負載的 DBMS 資料和/或重做日誌檔的存儲。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "如果使用的是 SAP SuccessFactors，請考慮使用 Azure AD 自動使用者預配。通過此整合，當您將新員工添加到 SAP SuccessFactors 時，您可以在 Azure AD 中自動建立其用戶帳戶。（可選）您可以在 Microsoft 365 或 Azure AD 支援的其他 SaaS 應用程式中創建用戶帳戶。",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "description": "保持管理組層次結構合理平坦，不超過 4 個。",
+ "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
+ "severity": "中等",
+ "text": "對 SAP 訂閱實施現有管理組策略",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "操作"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "graph": "Resources | summarize count()",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"severity": "高",
- "text": "您可以在 Windows 中使用 Azure 共用磁碟，以實現 ASCS + SCS 元件和特定的高可用性方案。分別為 SAP 應用程式層元件和 DBMS 層設置故障轉移集群。Azure 目前不支援將 SAP 應用程式層元件和 DBMS 層合併到一個故障轉移群集中的高可用性體系結構。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "可靠性"
+ "text": "將緊密耦合的應用程式集成到同一 SAP 訂閱中，以避免額外的路由和管理複雜性",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'Microsoft.Network/loadBalancers' | extend bep = properties.backendAddressPools | extend BackEndPools = array_length(bep) | where BackEndPools =~ 0 | project name, id, Param1='backendPools', Param2=toint(0), tags | union (resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Standard' | extend bep = properties.backendAddressPools | extend BackEndPools = toint(array_length(bep)) | mv-expand bip = properties.backendAddressPools | extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) | where toint(BackendAddresses) <= 1 | project name, id, tags, Param1='backendAddresses', Param2=toint(BackendAddresses)) | union ( resources | where type =~ 'Microsoft.Network/loadBalancers' | where sku.name =~ 'Basic' | mv-expand properties.backendAddressPools | extend backendPoolId = properties_backendAddressPools.id | project id, name, tags, tostring(backendPoolId), Param1='BackEndPools' | join kind = leftouter ( resources | where type =~ 'Microsoft.Network/networkInterfaces' | mv-expand properties.ipConfigurations | mv-expand properties_ipConfigurations.properties.loadBalancerBackendAddressPools | extend backendPoolId = tostring(properties_ipConfigurations_properties_loadBalancerBackendAddressPools.id) | summarize poolMembers = count() by backendPoolId | project tostring(backendPoolId), poolMembers ) on backendPoolId | where toint(poolMembers) <= 1 | extend BackendAddresses = poolMembers | project id, name, tags, Param1='backendAddresses', Param2=toint(BackendAddresses))",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"severity": "高",
- "text": "SAP 應用程式層元件 （ASCS） 和 DBMS 層的大多數故障轉移群集都需要故障轉移群集的虛擬 IP 位址。 Azure 負載均衡器應處理所有其他情況下的虛擬IP位址。一種設計原則是每個集群配置使用一個負載均衡器。我們建議您使用標準版本的負載均衡器 （Standard Load Balancer SKU）。",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "可靠性"
+ "text": "利用 Subscription 作為縮放單元並擴展我們的資源，考慮為每個環境部署 Subscription，例如。沙箱、非生產、生產",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
"service": "SAP",
"severity": "高",
- "text": "確保在負載均衡器上啟用了浮動IP",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "可靠性"
+ "text": "確保在訂閱預配過程中增加配額（例如，訂閱中的可用 VM 核心總數）",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
"service": "SAP",
- "severity": "高",
- "text": "在部署高可用性基礎結構之前，根據您選擇的區域，確定是使用 Azure 可用性集還是可用性區域進行部署。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "可靠性"
+ "severity": "低",
+ "text": "配額 API 是一個 REST API，可用於查看和管理 Azure 服務的配額。如有必要，請考慮使用它。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
"service": "SAP",
"severity": "高",
- "text": "如果要滿足 SAP 元件（中央服務、應用程式伺服器和資料庫）的應用程式的基礎設施 SLA，則必須為所有元件選擇相同的高可用性選項（VM、可用性集、可用區）。",
- "waf": "可靠性"
+ "text": "如果部署到可用區，請確保在配額獲得批准后，VM 的區域部署可用。提交支援請求，其中包含所需的訂閱、VM 系列、CPU 數量和可用區。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
"service": "SAP",
"severity": "高",
- "text": "不要在同一可用性集中混合使用不同角色的伺服器。將中心服務 VM、資料庫 VM、應用程式 VM 保留在其自己的可用性集中",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "可靠性"
+ "text": "確保所需的服務和功能在選定的部署區域內可用，例如。ANF 、 Zone 等",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
"service": "SAP",
"severity": "中等",
- "text": "除非使用鄰近放置組，否則無法在 Azure 可用性區域中部署 Azure 可用性集。",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "可靠性"
+ "text": "利用 Azure 資源標籤進行成本分類和資源組（：BillTo、部門（或營業單位）、環境（生產、階段、開發）、層（Web 層、應用程式層）、應用程式擁有者、ProjectName）",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
"service": "SAP",
"severity": "高",
- "text": "創建可用性集時，請使用可用的容錯域和更新域的最大數量。例如，如果您在一個可用性集中部署兩個以上的 VM，除了 Azure 計劃內維護之外，還請使用最大數量的容錯域 （三個） 和足夠的更新域，以限制潛在物理硬體故障、網路中斷或電源中斷的影響。容錯域的預設數量為 2，以後無法在線更改。",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "text": "使用 Azure 備份服務幫助保護 HANA 資料庫。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
"service": "SAP",
- "severity": "高",
- "text": "在可用性集部署中使用 Azure 鄰近放置組時，所有三個 SAP 元件（中央服務、應用程式伺服器和資料庫）都應位於同一鄰近放置組中。",
+ "severity": "中等",
+ "text": "如果您為 HANA、Oracle 或 DB2 資料庫部署 Azure NetApp 檔，請使用 Azure 應用程式一致性快照工具 （AzAcSnap） 拍攝應用程式一致性快照。AzAcSnap 還支援 Oracle 資料庫。考慮在中央 VM 上使用 AzAcSnap ，而不是在單個 VM 上使用。",
"waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
"service": "SAP",
"severity": "高",
- "text": "每個 SAP SID 使用一個鄰近放置組。組不跨可用性區域或 Azure 區域",
- "waf": "可靠性"
+ "text": "確保操作系統和 SAP 系統之間的時區匹配。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
"service": "SAP",
- "severity": "高",
- "text": "使用以下服務之一運行 SAP Central Services 集群，具體取決於操作系統。",
+ "severity": "中等",
+ "text": "不要將不同的應用程式服務分組到同一個集群中。例如，不要將DRBD和中央服務集群合併到同一個集群上。但是，您可以使用同一個 Pacemaker 集群來管理大約五個不同的中央服務（多 SID 集群）。",
"training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
"service": "SAP",
- "severity": "中等",
- "text": "Azure 目前不支援在同一個 Linux Pacemaker 群集中組合 ASCS 和 DB HA;將它們分成單獨的集群。但是，您最多可以將5個多個中央服務集群組合成一對VM。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "可靠性"
+ "severity": "低",
+ "text": "考慮在推遲模型中運行開發/測試系統，以節省和優化 Azure 運行成本。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where sku.name in~ ('Standard_LRS', 'Premium_LRS') | project name, id, tags, param1 = strcat('sku: ', sku.name)",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
"service": "SAP",
"severity": "中等",
- "text": "將高可用性對中的兩個 VM 部署在可用性集或可用性區域中。這些 VM 的大小應相同，並且具有相同的存儲配置。",
- "waf": "可靠性"
+ "text": "如果你通過管理客戶的 SAP 資產來與客戶合作，請考慮使用 Azure Lighthouse。Azure Lighthouse 允許託管服務提供者使用 Azure 原生標識服務對客戶的環境進行身份驗證。它將控制權交到客戶手中，因為他們可以隨時撤銷訪問許可權並審核服務提供者的行為。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
"service": "SAP",
"severity": "中等",
- "text": "Azure 支援在 Red Hat Enterprise Linux （RHEL） 上運行的同一高可用性群集上安裝和配置 SAP HANA 以及 ASCS/SCS 和 ERS 實例。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "可靠性"
+ "text": "使用 Azure Update Manager 檢查單個 VM 或多個 VM 的可用更新的狀態，並考慮計劃定期修補。",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
"service": "SAP",
- "severity": "高",
- "text": "在高級託管 SSD 上運行所有生產系統，並使用 Azure NetApp Files 或超級磁碟存儲。至少OS磁碟應位於高級層上，以便您可以獲得更好的性能和最佳SLA。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "可靠性"
+ "severity": "低",
+ "text": "使用 SAP Landscape Management （LaMa） 優化和管理 SAP Basis 運營。使用適用於 Azure 的 SAP LaMa 連接器來重新定位、複製、克隆和刷新 SAP 系統。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
"service": "SAP",
- "severity": "高",
- "text": "應僅在 SAP 認證的存儲類型上運行 Azure 上的 SAP HANA。請注意，某些卷必須在某些磁碟配置上運行（如果適用）。這些配置包括啟用 Write Accelerator 和使用高級存儲。您還需要確保在儲存上運行的檔案系統與計算機上運行的 DBMS 相容。",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "使用適用於 SAP 解決方案的 Azure Monitor 監視 Azure 上的 SAP 工作負載（SAP HANA、高可用性 SUSE 群集和 SQL 系統）。請考慮使用 SAP 解決方案管理器補充適用於 SAP 解決方案的 Azure Monitor。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
"service": "SAP",
"severity": "高",
- "text": "考慮根據您用於 SAP 工作負載的儲存類型配置高可用性。Azure Site Recovery 不支援 Azure 中提供的某些存儲服務，因此高可用性配置可能會有所不同。",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "可靠性"
+ "text": "運行 VM Extension for SAP 檢查。適用於 SAP 的 VM 擴展使用虛擬機 （VM） 的分配託管標識來訪問 VM 監視和配置數據。該檢查可確保 SAP 應用程式中的所有性能指標都來自適用於 SAP 的基礎 Azure 擴展。",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
"service": "SAP",
- "severity": "高",
- "text": "不同的本機 Azure 儲存服務（如 Azure 檔、Azure NetApp 檔、Azure 共用磁碟）可能並非在所有區域都可用。因此，要在故障轉移后在DR區域上進行類似的SAP設置，請確保在DR網站中提供相應的存儲服務。",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "使用 Azure Policy 進行訪問控制和合規性報告。Azure Policy 提供了強制實施組織範圍設置的功能，以確保一致的策略遵守和快速的違規檢測。",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
"service": "SAP",
"severity": "中等",
- "text": "自動化 SAP System Start-Stop 以管理成本。",
- "waf": "成本"
+ "text": "使用 Azure 網路觀察程式中的連接監視器來監視 SAP 資料庫和應用程式伺服器的延遲指標。或者使用 Azure Monitor 收集和顯示網路延遲測量值。",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
"service": "SAP",
- "severity": "低",
- "text": "如果將 Azure 高級存儲與 SAP HANA 配合使用，則可以使用 Azure 標準 SSD 儲存來選擇注重成本的儲存解決方案。但是，請注意，選擇標準 SSD 或標準 HDD Azure 儲存將影響單個 VM 的 SLA。此外，對於 I/O 輸送量較低且延遲較低的系統（如非生產環境），可以使用較低系列的 VM。",
- "waf": "成本"
+ "severity": "中等",
+ "text": "在預配的 Azure 基礎結構上對 SAP HANA 執行質量檢查，以驗證預配的 VM 是否符合 Azure 上的 SAP HANA 最佳做法。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
"service": "SAP",
- "severity": "低",
- "text": "作為成本較低的替代配置（多用途），您可以為非生產 HANA 資料庫伺服器 VM 選擇低性能 SKU。但是，請務必注意，某些 VM 類型（如 E 系列）未經過 HANA 認證（SAP HANA 硬體目錄），或者無法實現小於 1 毫秒的存儲延遲。",
- "waf": "成本"
+ "severity": "高",
+ "text": "對於每個 Azure 訂閱，在區域部署之前，請在 Azure 可用性區域上運行延遲測試，以選擇低延遲區域以在 Azure 上部署 SAP。",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | where type =~ 'microsoft.aad/domainservices' | extend replicaSets = properties.replicaSets | where array_length(replicaSets) < 2 | project name=name, id=id, tags=tags, param1=strcat('replicaSetLocation:', replicaSets[0].location)",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
"service": "SAP",
- "severity": "高",
- "text": "對管理組、訂閱、資源組和資源強制實施 RBAC 模型",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "安全"
+ "severity": "中等",
+ "text": "運行彈性報告，確保整個預配的 Azure 基礎結構（計算、資料庫、網路、存儲、Site Recovery）的配置符合 Cloud Adaption Framework for Azure 定義的配置。",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
+ "waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
"service": "SAP",
"severity": "中等",
- "text": "強制實施主體傳播，以便透過雲連接器將身份從 SAP 雲應用程式轉發到 SAP 本地（包括 IaaS）",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "使用適用於 SAP 的 Microsoft Sentinel 解決方案實現威脅防護。使用此解決方案可監控您的 SAP 系統並檢測整個業務邏輯和應用程式層的複雜威脅。",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
"service": "SAP",
"severity": "中等",
- "text": "使用 SAML 通過 Azure AD 實現對 SAP SaaS 應用程式（如 SAP Analytics Cloud、SAP Cloud Platform、Business by design、SAP Qualtrics 和 SAP C4C）的 SSO。",
- "waf": "安全"
+ "text": "可以利用 Azure 標記對資源進行邏輯分組和跟蹤、自動化部署，最重要的是，提供對所產生成本的可見性。",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "操作"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
+ "severity": "低",
+ "text": "對延遲敏感型應用程式使用虛擬機間延遲監控。",
+ "waf": "性能"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
+ "severity": "中等",
+ "text": "使用 Azure Site Recovery 監視來維護 SAP 應用程式伺服器的災難恢復服務的運行狀況。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
"service": "SAP",
"severity": "中等",
- "text": "使用 SAML 對基於 SAP NetWeaver 的 Web 應用程式（如 SAP Fiori 和 SAP Web GUI）實施 SSO。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "安全"
+ "text": "從防病毒掃描中排除所有資料庫檔系統和可執行程式。包含它們可能會導致性能問題。請與資料庫供應商聯繫，瞭解有關排除清單的規範性詳細資訊。例如，Oracle 建議從防病毒掃描中排除 /oracle//sapdata。",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
"service": "SAP",
- "severity": "中等",
- "text": "使用 SAML 對基於 SAP NetWeaver 的 Web 應用程式（如 SAP Fiori 和 SAP Web GUI）實施 SSO。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
- "waf": "安全"
+ "severity": "低",
+ "text": "考慮在遷移後收集非 HANA 資料庫的完整資料庫統計資訊。例如，實施SAP註釋 1020260 - Oracle 統計資訊的交付。",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
"service": "SAP",
"severity": "中等",
- "text": "您可以使用 SAP NetWeaver SSO 或合作夥伴解決方案實現對 SAP GUI 的 SSO。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
- "waf": "安全"
+ "text": "請考慮將 Oracle Automatic Storage Management （ASM） 用於使用 Azure 上的 SAP 的所有 Oracle 部署。",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
"service": "SAP",
"severity": "中等",
- "text": "對於 SAP GUI 和 Web 瀏覽器訪問的 SSO，實施 SNC / Kerberos/SPNEGO（簡單且受保護的 GSSAPI 協商機制），因為它易於配置和維護。對於使用 X.509 用戶端證書的 SSO，請考慮使用 SAP Secure Login Server，它是 SAP SSO 解決方案的一個元件。",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
- "waf": "安全"
+ "text": "對於運行 Oracle 的 Azure 上的 SAP，一組 SQL 腳本可以説明你診斷性能問題。 Automatic Workload Repository （AWR） 報告包含用於診斷 Oracle 系統中問題的寶貴資訊。我們建議您在多個工作階段期間運行 AWR 報告，並為其選擇高峰時間，以確保分析的廣泛覆蓋範圍。",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
"service": "SAP",
- "severity": "中等",
- "text": "對於 SAP GUI 和 Web 瀏覽器訪問的 SSO，實施 SNC / Kerberos/SPNEGO（簡單且受保護的 GSSAPI 協商機制），因為它易於配置和維護。對於使用 X.509 用戶端證書的 SSO，請考慮使用 SAP Secure Login Server，它是 SAP SSO 解決方案的一個元件。",
- "waf": "安全"
+ "severity": "高",
+ "text": "使用 Azure Site Recovery 監視來維護 SAP 應用程式伺服器的災難恢復服務的運行狀況。",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
"service": "SAP",
"severity": "中等",
- "text": "通過使用 SAP NetWeaver 的 OAuth 實施 SSO，以允許第三方或自定義應用程式訪問 SAP NetWeaver OData 服務。",
+ "text": "為了安全交付 HTTP/S 應用程式，請使用應用程式閘道 v2 並確保啟用 WAF 保護和策略。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
"service": "SAP",
"severity": "中等",
- "text": "實施SAP HANA的 SSO",
- "waf": "安全"
+ "text": "如果在遷移到 Azure 期間未更改虛擬機器的 DNS 或虛擬名稱，則後台 DNS 和虛擬名稱將連接 SAP 環境中的許多系統介面，並且客戶有時只會知道開發人員隨時間定義的介面。遷移后，當虛擬或 DNS 名稱發生變化時，各種系統之間會出現連接挑戰，建議保留 DNS 別名以防止出現這些類型的困難。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
"service": "SAP",
"severity": "中等",
- "text": "將 Azure AD 視為 RISE 上託管的 SAP 系統的標識提供者。有關詳細資訊，請參閱將服務與 Azure AD 集成。",
- "waf": "安全"
+ "text": "使用不同的 DNS 區域來區分每個環境（沙箱、開發、預生產和生產）。具有自己的 VNet 的 SAP 部署除外;在這裡，私有 DNS 區域可能不是必需的。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "description": "配置 VNet 對等互連時，請使用允許流量流向遠端虛擬網路設置。",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
"service": "SAP",
"severity": "中等",
- "text": "對於訪問 SAP 的應用程式，您可能希望使用主體傳播來建立 SSO。",
- "waf": "安全"
+ "text": "本地和全域 VNet 對等互連提供連接，是確保跨多個 Azure 區域進行 SAP 部署的登陸區域之間建立連接的首選方法",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "可靠性"
},
{
"checklist": "SAP Checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
"service": "SAP",
- "severity": "中等",
- "text": "如果使用需要 SAP 身份驗證服務 （IAS） 的 SAP BTP 服務或 SaaS 解決方案，請考慮在 SAP Cloud Identity Authentication 服務和 Azure AD 之間實現 SSO 以存取這些 SAP 服務。此集成允許 SAP IAS 充當代理標識提供者，並將身份驗證請求轉發到作為中央使用者存儲和標識提供者的 Azure AD。",
- "waf": "安全"
+ "severity": "高",
+ "text": "不支援在 SAP 應用程式和 SAP 資料庫伺服器之間部署任何 NVA",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
"service": "SAP",
"severity": "中等",
- "text": "實施 SSO 到 SAP BTP",
- "waf": "安全"
+ "text": "在需要跨 Azure 區域和本地位置建立全球傳輸連接的新網路、大型網路或全球網路中，使用虛擬 WAN 進行 Azure 部署。使用此方法，無需手動為 Azure 網路設置可傳遞路由，並且可以遵循 Azure 上的 SAP 部署標準。",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
"service": "SAP",
"severity": "中等",
- "text": "如果使用的是 SAP SuccessFactors，請考慮使用 Azure AD 自動使用者預配。通過此整合，當您將新員工添加到 SAP SuccessFactors 時，您可以在 Azure AD 中自動建立其用戶帳戶。（可選）您可以在 Microsoft 365 或 Azure AD 支援的其他 SaaS 應用程式中創建用戶帳戶。",
- "waf": "安全"
+ "text": "僅當使用合作夥伴 NVA 時，才考慮在區域之間部署網路虛擬設備 （NVA）。如果存在本機 NVA，則不需要區域或 VNet 之間的 NVA。部署合作夥伴網路技術和 NVA 時，請按照供應商的指南驗證與 Azure 網路的衝突配置。",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "description": "保持管理組層次結構合理平坦，不超過 4 個。",
- "graph": "resourcecontainers| where type =~ 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
"service": "SAP",
"severity": "中等",
- "text": "對 SAP 訂閱實施現有管理組策略",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "text": "虛擬 WAN 管理基於虛擬 WAN 的拓撲的分支 VNet 之間的連接（無需設置使用者定義的路由 [UDR] 或 NVA），同一虛擬中心中 VNet 到 VNet 流量的最大網路輸送量為每秒 50 Gb。如有必要，SAP 登陸區域可以使用 VNet 對等互連連接到其他登陸區域並克服此頻寬限制。",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
"waf": "操作"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | summarize count()",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"service": "SAP",
"severity": "高",
- "text": "將緊密耦合的應用程式集成到同一 SAP 訂閱中，以避免額外的路由和管理複雜性",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "操作"
+ "text": "不建議將公共IP分配給運行SAP工作負載的 VM。",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
"graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
"service": "SAP",
"severity": "高",
- "text": "利用 Subscription 作為縮放單元並擴展我們的資源，考慮為每個環境部署 Subscription，例如。沙箱、非生產、生產",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "text": "配置 ASR 時，請考慮在 DR 端保留 IP 位址",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
"waf": "操作"
},
{
"checklist": "SAP Checklist",
- "graph": "QuotaResources | where type =~ 'microsoft.compute/locations/usages' | where subscriptionId in~ ('','') | mv-expand json = properties.value limit 400 | extend usagevCPUs = json.currentValue, QuotaLimit = json['limit'], quotaName = tostring(json['name'].localizedValue) | extend usagePercent = toint(usagevCPUs)*100 / toint(QuotaLimit) |where quotaName =~ 'Total Regional vCPUs' or quotaName =~ 'Total Regional Low-priority vCPUs' |project subscriptionId,quotaName,usagevCPUs,QuotaLimit,usagePercent,location,['json'] | order by ['usagePercent'] desc",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"service": "SAP",
"severity": "高",
- "text": "確保在訂閱預配過程中增加配額（例如，訂閱中的可用 VM 核心總數）",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "text": "避免對生產和DR網站使用重疊的IP位址範圍。",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
"service": "SAP",
- "severity": "低",
- "text": "配額 API 是一個 REST API，可用於查看和管理 Azure 服務的配額。如有必要，請考慮使用它。",
+ "severity": "中等",
+ "text": "雖然 Azure 確實可以説明您在 VNet 中創建多個委託子網，但 Azure NetApp 檔的 VNet 中只能存在一個委託子網。如果為 Azure NetApp Files 使用多個委託子網，則嘗試創建新卷將失敗。",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
"waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
"service": "SAP",
- "severity": "高",
- "text": "如果部署到可用區，請確保在配額獲得批准后，VM 的區域部署可用。提交支援請求，其中包含所需的訂閱、VM 系列、CPU 數量和可用區。",
- "waf": "操作"
+ "severity": "中等",
+ "text": "使用 Azure 防火牆來管理到 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
"service": "SAP",
- "severity": "高",
- "text": "確保所需的服務和功能在選定的部署區域內可用，例如。ANF 、 Zone 等",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
- "waf": "操作"
+ "severity": "中等",
+ "text": "當應用程式閘道充當 SAP Web 應用的反向代理時，應用程式閘道和 Web 應用程式防火牆存在限制，如應用程式閘道、SAP Web 調度程式和其他第三方服務之間的比較所示。",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
"service": "SAP",
"severity": "中等",
- "text": "利用 Azure 資源標籤進行成本分類和資源組（：BillTo、部門（或營業單位）、環境（生產、階段、開發）、層（Web 層、應用程式層）、應用程式擁有者、ProjectName）",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "操作"
+ "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為到登陸區域的入站 HTTP/S 連接提供全域保護。",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
"service": "SAP",
- "severity": "高",
- "text": "使用 Azure 備份服務幫助保護 HANA 資料庫。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "可靠性"
+ "severity": "中等",
+ "text": "使用 Azure Front Door 和應用程式閘道保護 HTTP/S 應用程式時，請利用 Azure Front Door 中的 Web 應用程式防火牆策略。鎖定應用程式閘道以僅接收來自 Azure Front Door 的流量。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
"service": "SAP",
"severity": "中等",
- "text": "如果您為 HANA、Oracle 或 DB2 資料庫部署 Azure NetApp 檔，請使用 Azure 應用程式一致性快照工具 （AzAcSnap） 拍攝應用程式一致性快照。AzAcSnap 還支援 Oracle 資料庫。考慮在中央 VM 上使用 AzAcSnap ，而不是在單個 VM 上使用。",
- "waf": "可靠性"
+ "text": "使用 Web 應用程式防火牆在流量暴露於 Internet 時對其進行掃描。另一種選擇是將它與負載均衡器或具有內置防火牆功能的資源（如應用程式閘道或第三方解決方案）一起使用。",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
"service": "SAP",
- "severity": "高",
- "text": "確保操作系統和 SAP 系統之間的時區匹配。",
- "waf": "操作"
+ "severity": "中等",
+ "text": "在需要跨 Azure 區域和本地位置建立全球傳輸連接的新網路、大型網路或全球網路中，使用虛擬 WAN 進行 Azure 部署。使用此方法，無需手動為 Azure 網路設置可傳遞路由，並且可以遵循 Azure 上的 SAP 部署標準。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
"service": "SAP",
"severity": "中等",
- "text": "不要將不同的應用程式服務分組到同一個集群中。例如，不要將DRBD和中央服務集群合併到同一個集群上。但是，您可以使用同一個 Pacemaker 集群來管理大約五個不同的中央服務（多 SID 集群）。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "可靠性"
+ "text": "為了防止數據洩露，請使用 Azure 專用連結安全地訪問平臺即服務資源，例如 Azure Blob 存儲、Azure 檔存儲、Azure Data Lake Storage Gen2、Azure 數據工廠等。Azure 專用終結點還可以幫助保護 VNet 與 Azure 存儲、Azure 備份等服務之間的流量。VNet 與啟用了專用終結點的服務之間的流量通過 Microsoft 全球網路傳輸，從而防止其暴露在公共 Internet 上。",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
"service": "SAP",
- "severity": "低",
- "text": "考慮在推遲模型中運行開發/測試系統，以節省和優化 Azure 運行成本。",
- "waf": "成本"
+ "severity": "高",
+ "text": "確保在 SAP 應用程式和 DBMS 層中使用的 VM 上啟用了 Azure 加速網路。",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
"service": "SAP",
"severity": "中等",
- "text": "如果你通過管理客戶的 SAP 資產來與客戶合作，請考慮使用 Azure Lighthouse。Azure Lighthouse 允許託管服務提供者使用 Azure 原生標識服務對客戶的環境進行身份驗證。它將控制權交到客戶手中，因為他們可以隨時撤銷訪問許可權並審核服務提供者的行為。",
- "waf": "操作"
+ "text": "確保將 Azure 負載均衡器的內部部署設置為使用直接伺服器返回 （DSR）。當內部負載均衡器配置用於 DBMS 層上的高可用性配置時，此設置 （Enabling Floating IP） 將減少延遲。",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
"service": "SAP",
"severity": "中等",
- "text": "使用 Azure Update Manager 檢查單個 VM 或多個 VM 的可用更新的狀態，並考慮計劃定期修補。",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
- "waf": "操作"
+ "text": "您可以使用應用程式安全組 （ASG） 和 NSG 規則來定義 SAP 應用程式和 DBMS 層之間的網路安全存取控制清單。ASG 對虛擬機進行分組以説明管理其安全性。",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
"service": "SAP",
- "severity": "低",
- "text": "使用 SAP Landscape Management （LaMa） 優化和管理 SAP Basis 運營。使用適用於 Azure 的 SAP LaMa 連接器來重新定位、複製、克隆和刷新 SAP 系統。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
- "waf": "操作"
+ "severity": "高",
+ "text": "不支援將 SAP 應用程式層和 SAP DBMS 放置在未對等互連的不同 Azure VNet 中。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
"service": "SAP",
"severity": "中等",
- "text": "使用適用於 SAP 解決方案的 Azure Monitor 監視 Azure 上的 SAP 工作負載（SAP HANA、高可用性 SUSE 群集和 SQL 系統）。請考慮使用 SAP 解決方案管理器補充適用於 SAP 解決方案的 Azure Monitor。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "操作"
+ "text": "為了實現 SAP 應用程式的最佳網路延遲，請考慮使用 Azure 鄰近放置組。",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
"service": "SAP",
"severity": "高",
- "text": "運行 VM Extension for SAP 檢查。適用於 SAP 的 VM 擴展使用虛擬機 （VM） 的分配託管標識來訪問 VM 監視和配置數據。該檢查可確保 SAP 應用程式中的所有性能指標都來自適用於 SAP 的基礎 Azure 擴展。",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "操作"
+ "text": "根本不支援在本地和 Azure 之間運行 SAP Application Server 層和 DBMS 層。這兩個層都需要完全駐留在本地或 Azure 中。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
"service": "SAP",
- "severity": "中等",
- "text": "使用 Azure Policy 進行訪問控制和合規性報告。Azure Policy 提供了強制實施組織範圍設置的功能，以確保一致的策略遵守和快速的違規檢測。",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "操作"
+ "severity": "高",
+ "text": "建議不要將 SAP 系統的資料庫管理系統 （DBMS） 和應用程式層託管在不同的 VNet 中，並將它們與 VNet 對等互連連接，因為層之間過多的網路流量可能會產生大量成本。建議使用 Azure 虛擬網路中的子網來分隔 SAP 應用程式層和 DBMS 層。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
"service": "SAP",
- "severity": "中等",
- "text": "使用 Azure 網路觀察程式中的連接監視器來監視 SAP 資料庫和應用程式伺服器的延遲指標。或者使用 Azure Monitor 收集和顯示網路延遲測量值。",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
- "waf": "操作"
+ "severity": "高",
+ "text": "如果將負載均衡器與 Linux 客戶機作業系統一起使用，請檢查 Linux 網路參數 net.ipv4.tcp_timestamps 是否設置為 0。",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
"service": "SAP",
"severity": "中等",
- "text": "在預配的 Azure 基礎結構上對 SAP HANA 執行質量檢查，以驗證預配的 VM 是否符合 Azure 上的 SAP HANA 最佳做法。",
- "waf": "操作"
+ "text": "對於 SAP RISE/ECS 部署，虛擬對等互連是與客戶的現有 Azure 環境建立連接的首選方式。SAP VNet 和客戶 VNet 都受到網路安全組 （NSG） 的保護，從而通過 VNet 對等互連在 SAP 和資料庫埠上進行通信",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
"service": "SAP",
"severity": "高",
- "text": "對於每個 Azure 訂閱，在區域部署之前，請在 Azure 可用性區域上運行延遲測試，以選擇低延遲區域以在 Azure 上部署 SAP。",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "性能"
+ "text": "查看 Azure VM 的 SAP HANA 資料庫備份。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
"service": "SAP",
"severity": "中等",
- "text": "運行彈性報告，確保整個預配的 Azure 基礎結構（計算、資料庫、網路、存儲、Site Recovery）的配置符合 Cloud Adaption Framework for Azure 定義的配置。",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "可靠性"
+ "text": "查看用於 SAP 的 Site Recovery 內置監視。",
+ "waf": "成本"
},
{
"checklist": "SAP Checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
"service": "SAP",
- "severity": "中等",
- "text": "使用適用於 SAP 的 Microsoft Sentinel 解決方案實現威脅防護。使用此解決方案可監控您的 SAP 系統並檢測整個業務邏輯和應用程式層的複雜威脅。",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
- "waf": "安全"
+ "severity": "高",
+ "text": "查看監控 SAP HANA 系統環境指南。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
"service": "SAP",
"severity": "中等",
- "text": "可以利用 Azure 標記對資源進行邏輯分組和跟蹤、自動化部署，最重要的是，提供對所產生成本的可見性。",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "text": "查看 Azure Linux VM 中的 Oracle Database 備份策略。",
"waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
- "severity": "低",
- "text": "對延遲敏感型應用程式使用虛擬機間延遲監控。",
- "waf": "性能"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
"service": "SAP",
"severity": "中等",
- "text": "使用 Azure Site Recovery 監視來維護 SAP 應用程式伺服器的災難恢復服務的運行狀況。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "可靠性"
+ "text": "查看 Azure Blob Storage 與 SQL Server 2016 的使用方式。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
"service": "SAP",
"severity": "中等",
- "text": "從防病毒掃描中排除所有資料庫檔系統和可執行程式。包含它們可能會導致性能問題。請與資料庫供應商聯繫，瞭解有關排除清單的規範性詳細資訊。例如，Oracle 建議從防病毒掃描中排除 /oracle//sapdata。",
- "waf": "性能"
+ "text": "查看 Azure VM 的自動備份 v2 的使用方式。",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
"service": "SAP",
- "severity": "低",
- "text": "考慮在遷移後收集非 HANA 資料庫的完整資料庫統計資訊。例如，實施SAP註釋 1020260 - Oracle 統計資訊的交付。",
- "waf": "性能"
+ "severity": "高",
+ "text": "使用進階磁碟時為 M 系列開啟寫入加速器 （V1）",
+ "waf": "操作"
},
{
"checklist": "SAP Checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
"service": "SAP",
"severity": "中等",
- "text": "請考慮將 Oracle Automatic Storage Management （ASM） 用於使用 Azure 上的 SAP 的所有 Oracle 部署。",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "text": "測試可用區延遲。",
"waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
"service": "SAP",
"severity": "中等",
- "text": "對於運行 Oracle 的 Azure 上的 SAP，一組 SQL 腳本可以説明你診斷性能問題。 Automatic Workload Repository （AWR） 報告包含用於診斷 Oracle 系統中問題的寶貴資訊。我們建議您在多個工作階段期間運行 AWR 報告，並為其選擇高峰時間，以確保分析的廣泛覆蓋範圍。",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "text": "為所有 SAP 元件啟動 SAP EarlyWatch Alert。",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
"waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "severity": "高",
- "text": "使用 Azure Site Recovery 監視來維護 SAP 應用程式伺服器的災難恢復服務的運行狀況。",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "waf": "操作"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
"service": "SAP",
"severity": "中等",
- "text": "為了安全交付 HTTP/S 應用程式，請使用應用程式閘道 v2 並確保啟用 WAF 保護和策略。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
- "waf": "安全"
+ "text": "使用 SAP ABAPMeter 報告 /SSA/CAT 查看 SAP 應用程式伺服器到資料庫伺服器的延遲。",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
"service": "SAP",
"severity": "中等",
- "text": "如果在遷移到 Azure 期間未更改虛擬機器的 DNS 或虛擬名稱，則後台 DNS 和虛擬名稱將連接 SAP 環境中的許多系統介面，並且客戶有時只會知道開發人員隨時間定義的介面。遷移后，當虛擬或 DNS 名稱發生變化時，各種系統之間會出現連接挑戰，建議保留 DNS 別名以防止出現這些類型的困難。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "操作"
+ "text": "查看使用 CCMS 的 SQL Server 性能監控。",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
"service": "SAP",
"severity": "中等",
- "text": "使用不同的 DNS 區域來區分每個環境（沙箱、開發、預生產和生產）。具有自己的 VNet 的 SAP 部署除外;在這裡，私有 DNS 區域可能不是必需的。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "操作"
+ "text": "測試 SAP 應用層 VM 和 DBMS VM 之間的網路延遲 （NIPING）。",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "description": "配置 VNet 對等互連時，請使用允許流量流向遠端虛擬網路設置。",
- "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess =~ True)",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
"service": "SAP",
"severity": "中等",
- "text": "本地和全域 VNet 對等互連提供連接，是確保跨多個 Azure 區域進行 SAP 部署的登陸區域之間建立連接的首選方法",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
- "waf": "可靠性"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
- "severity": "高",
- "text": "不支援在 SAP 應用程式和 SAP 資料庫伺服器之間部署任何 NVA",
- "training": "https://me.sap.com/notes/2731110",
+ "text": "查看 SAP HANA Studio 警報。",
"waf": "性能"
},
{
"checklist": "SAP Checklist",
- "graph": "resources| where type =~ 'microsoft.network/virtualwans' | extend compliant= (properties.allowBranchToBranchTraffic =~ 'true') | distinct id,compliant",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
"service": "SAP",
"severity": "中等",
- "text": "在需要跨 Azure 區域和本地位置建立全球傳輸連接的新網路、大型網路或全球網路中，使用虛擬 WAN 進行 Azure 部署。使用此方法，無需手動為 Azure 網路設置可傳遞路由，並且可以遵循 Azure 上的 SAP 部署標準。",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "操作"
+ "text": "使用 HANA_Configuration_Minichecks 執行 SAP HANA 執行狀況檢查。",
+ "waf": "性能"
},
{
"checklist": "SAP Checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
"service": "SAP",
"severity": "中等",
- "text": "僅當使用合作夥伴 NVA 時，才考慮在區域之間部署網路虛擬設備 （NVA）。如果存在本機 NVA，則不需要區域或 VNet 之間的 NVA。部署合作夥伴網路技術和 NVA 時，請按照供應商的指南驗證與 Azure 網路的衝突配置。",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "操作"
+ "text": "如果您在 Azure、本地或其他雲環境中運行 Windows 和 Linux VM，則可以使用 Azure 自動化中的更新管理中心來管理操作系統更新，包括安全補丁。",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
"service": "SAP",
"severity": "中等",
- "text": "虛擬 WAN 管理基於虛擬 WAN 的拓撲的分支 VNet 之間的連接（無需設置使用者定義的路由 [UDR] 或 NVA），同一虛擬中心中 VNet 到 VNet 流量的最大網路輸送量為每秒 50 Gb。如有必要，SAP 登陸區域可以使用 VNet 對等互連連接到其他登陸區域並克服此頻寬限制。",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "操作"
+ "text": "定期查看 SAP 安全 OSS 說明，因為 SAP 發佈了高度關鍵的安全補丁或熱修復程式，需要立即採取措施保護您的 SAP 系統。",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/publicIPAddresses' and sku.tier =~ 'Regional' | where isempty(zones) or array_length(zones) <= 1 | extend az = case(isempty(zones), 'Non-zonal', array_length(zones) <= 1, strcat('Zonal (', strcat_array(zones, ','), ')'), zones) | project name, id, tags, param1 = strcat('sku: ', sku.name), param2 = strcat('availabilityZone: ', az)",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"service": "SAP",
- "severity": "高",
- "text": "不建議將公共IP分配給運行SAP工作負載的 VM。",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "severity": "低",
+ "text": "對於 SQL Server 上的 SAP，您可以禁用 SQL Server 系統管理員帳戶，因為 SQL Server 上的 SAP 系統不使用該帳戶。在禁用原始系統管理員帳戶之前，請確保具有系統管理員許可權的其他使用者可以訪問伺服器。",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"service": "SAP",
"severity": "高",
- "text": "配置 ASR 時，請考慮在 DR 端保留 IP 位址",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "操作"
+ "text": "禁用 xp_cmdshell。SQL Server 功能xp_cmdshell啟用 SQL Server 內部作業系統命令 shell。這是安全審計中的潛在風險。",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
"severity": "高",
- "text": "避免對生產和DR網站使用重疊的IP位址範圍。",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "操作"
+ "text": "在 Azure 上加密 SAP HANA 資料庫伺服器使用 SAP HANA 本機加密技術。此外，如果使用 Azure 上的 SQL Server，請使用透明數據加密 （TDE） 來保護數據和日誌檔，並確保備份也已加密。",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
"service": "SAP",
"severity": "中等",
- "text": "雖然 Azure 確實可以説明您在 VNet 中創建多個委託子網，但 Azure NetApp 檔的 VNet 中只能存在一個委託子網。如果為 Azure NetApp Files 使用多個委託子網，則嘗試創建新卷將失敗。",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
- "waf": "操作"
+ "text": "Azure 儲存加密已為所有 Azure Resource Manager 和經典存儲帳戶啟用，並且無法禁用。由於數據預設加密，因此無需修改代碼或應用程式即可使用 Azure 儲存加密。",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "resources | where type=~'microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
"service": "SAP",
- "severity": "中等",
- "text": "使用 Azure 防火牆來管理到 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "severity": "高",
+ "text": "使用 Azure Key Vault 儲存機密和憑據",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
"service": "SAP",
"severity": "中等",
- "text": "當應用程式閘道充當 SAP Web 應用的反向代理時，應用程式閘道和 Web 應用程式防火牆存在限制，如應用程式閘道、SAP Web 調度程式和其他第三方服務之間的比較所示。",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
+ "text": "建議在成功部署后鎖定 Azure 資源，以防止未經授權的更改。您還可以使用自定義的 Azure 策略（自定義角色）按訂閱強制實施 LOCK 約束和規則。",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
"service": "SAP",
"severity": "中等",
- "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為到登陸區域的入站 HTTP/S 連接提供全域保護。",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
+ "text": "預配 Azure Key Vault 並啟用軟刪除和清除策略，以允許對已刪除的物件進行保留保護。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
"service": "SAP",
- "severity": "中等",
- "text": "使用 Azure Front Door 和應用程式閘道保護 HTTP/S 應用程式時，請利用 Azure Front Door 中的 Web 應用程式防火牆策略。鎖定應用程式閘道以僅接收來自 Azure Front Door 的流量。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "severity": "高",
+ "text": "根據現有要求、法規和合規性控制（內部/外部）- 確定需要哪些 Azure 策略和 Azure RBAC 角色",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
- "severity": "中等",
- "text": "使用 Web 應用程式防火牆在流量暴露於 Internet 時對其進行掃描。另一種選擇是將它與負載均衡器或具有內置防火牆功能的資源（如應用程式閘道或第三方解決方案）一起使用。",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
+ "severity": "高",
+ "text": "在 SAP 環境中啟用 Microsoft Defender for Endpoint 時，建議排除 DBMS 伺服器上的數據和日誌檔，而不是以所有伺服器為目標。排除目標檔時，請遵循 DBMS 供應商的建議。",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
"service": "SAP",
- "severity": "中等",
- "text": "在需要跨 Azure 區域和本地位置建立全球傳輸連接的新網路、大型網路或全球網路中，使用虛擬 WAN 進行 Azure 部署。使用此方法，無需手動為 Azure 網路設置可傳遞路由，並且可以遵循 Azure 上的 SAP 部署標準。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "性能"
+ "severity": "高",
+ "text": "委派 SAP 管理員自定義角色，使其具有 Microsoft Defender for Cloud 的即時訪問許可權。",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
+ "severity": "低",
+ "text": "通過將第三方安全產品與適用於 DIAG （SAP GUI）、RFC 和 SPNEGO for HTTPS 的安全網路通信 （SNC） 集成，對傳輸中的數據進行加密",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "waf": "安全"
+ },
+ {
+ "checklist": "SAP Checklist",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
"service": "SAP",
"severity": "中等",
- "text": "為了防止數據洩露，請使用 Azure 專用連結安全地訪問平臺即服務資源，例如 Azure Blob 存儲、Azure 檔存儲、Azure Data Lake Storage Gen2、Azure 數據工廠等。Azure 專用終結點還可以幫助保護 VNet 與 Azure 存儲、Azure 備份等服務之間的流量。VNet 與啟用了專用終結點的服務之間的流量通過 Microsoft 全球網路傳輸，從而防止其暴露在公共 Internet 上。",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "text": "預設使用 Microsoft 管理的金鑰來實現主體加密功能，並在需要時使用客戶管理的金鑰。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'Microsoft.Network/NetworkInterfaces' | where properties.enableAcceleratedNetworking =~ 'false' | project name, subscriptionId, properties.enableAcceleratedNetworking",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
"service": "SAP",
"severity": "高",
- "text": "確保在 SAP 應用程式和 DBMS 層中使用的 VM 上啟用了 Azure 加速網路。",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "性能"
+ "text": "每個區域每個環境的每個應用程式使用 Azure Key Vault。",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
"service": "SAP",
- "severity": "中等",
- "text": "確保將 Azure 負載均衡器的內部部署設置為使用直接伺服器返回 （DSR）。當內部負載均衡器配置用於 DBMS 層上的高可用性配置時，此設置 （Enabling Floating IP） 將減少延遲。",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "severity": "高",
+ "text": "要控制和管理非 HANA Windows 和非 Windows 作業系統的磁碟加密密鑰和機密，請使用 Azure Key Vault。Azure Key Vault 不支援 SAP HANA，因此必須使用 SAP ABAP 或 SSH 密鑰等替代方法。",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "graph": "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
"service": "SAP",
- "severity": "中等",
- "text": "您可以使用應用程式安全組 （ASG） 和 NSG 規則來定義 SAP 應用程式和 DBMS 層之間的網路安全存取控制清單。ASG 對虛擬機進行分組以説明管理其安全性。",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "severity": "高",
+ "text": "為 Azure 上的 SAP 分支訂閱自定義基於角色的訪問控制 （RBAC） 角色，以避免意外的與網路相關的更改",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
"waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
"service": "SAP",
"severity": "高",
- "text": "不支援將 SAP 應用程式層和 SAP DBMS 放置在未對等互連的不同 Azure VNet 中。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "性能"
+ "text": "將 DMZ 和 NVA 與 SAP 資產的其餘部分隔離開來，配置 Azure 專用連結，並安全地管理和控制 Azure 上的 SAP 資源",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"service": "SAP",
- "severity": "中等",
- "text": "為了實現 SAP 應用程式的最佳網路延遲，請考慮使用 Azure 鄰近放置組。",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
- "waf": "性能"
+ "severity": "低",
+ "text": "考慮在 Azure 上使用 Microsoft 反惡意軟體來保護虛擬機免受惡意文件、廣告軟體和其他威脅的侵害。",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
"service": "SAP",
- "severity": "高",
- "text": "根本不支援在本地和 Azure 之間運行 SAP Application Server 層和 DBMS 層。這兩個層都需要完全駐留在本地或 Azure 中。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "性能"
+ "severity": "低",
+ "text": "要獲得更強大的保護，請考慮使用 Microsoft Defender for Endpoint。",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"severity": "高",
- "text": "建議不要將 SAP 系統的資料庫管理系統 （DBMS） 和應用程式層託管在不同的 VNet 中，並將它們與 VNet 對等互連連接，因為層之間過多的網路流量可能會產生大量成本。建議使用 Azure 虛擬網路中的子網來分隔 SAP 應用程式層和 DBMS 層。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "成本"
+ "text": "通過中心虛擬網路傳遞所有流量，將 SAP 應用程式和資料庫伺服器與 Internet 或本地網路隔離開來，該虛擬網路通過虛擬網路對等互連連接到輻射網路。對等互連的虛擬網路保證 Azure 上的 SAP 解決方案與公共 Internet 隔離。",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
- "severity": "高",
- "text": "如果將負載均衡器與 Linux 客戶機作業系統一起使用，請檢查 Linux 網路參數 net.ipv4.tcp_timestamps 是否設置為 0。",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "性能"
+ "severity": "低",
+ "text": "對於面向 Internet 的應用程式（如 SAP Fiori），請確保根據應用程式要求分配負載，同時保持安全級別。對於第 7 層安全性，您可以使用 Azure Marketplace 中提供的第三方 Web 應用程式防火牆 （WAF）。",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "waf": "安全"
},
{
"checklist": "SAP Checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
"service": "SAP",
"severity": "中等",
- "text": "對於 SAP RISE/ECS 部署，虛擬對等互連是與客戶的現有 Azure 環境建立連接的首選方式。SAP VNet 和客戶 VNet 都受到網路安全組 （NSG） 的保護，從而通過 VNet 對等互連在 SAP 和資料庫埠上進行通信",
+ "text": "若要在適用於 SAP 解決方案的 Azure Monitor 中啟用安全通信，可以選擇使用根證書或伺服器證書。我們強烈建議您使用根證書。",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "查看 Azure VM 的 SAP HANA 資料庫備份。",
- "waf": "成本"
+ "text": "遵循 Metaprompting 護欄，實現 realible AI",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
- "severity": "中等",
- "text": "查看用於 SAP 的 Site Recovery 內置監視。",
- "waf": "成本"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "考慮使用APIM或 AI central 等解決方案的閘道模式，以實現更好的速率限制、負載均衡、身份驗證和日誌記錄",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "為您的 AOAI 實例啟用監控",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "建立警報以通知團隊有關事件的通知，例如由對資源執行的操作（例如重新生成其訂閱金閜）創建的活動日誌中的條目或指標閾值（例如一小時內超過 10 的錯誤數）",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "查看監控 SAP HANA 系統環境指南。",
- "waf": "操作"
+ "text": "監控令牌使用方式，防止由於容量導致服務中斷",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "查看 Azure Linux VM 中的 Oracle Database 備份策略。",
- "waf": "操作"
+ "text": "觀察已處理的推理令牌、生成的完成令牌等指標，監視速率限制",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
- "severity": "中等",
- "text": "查看 Azure Blob Storage 與 SQL Server 2016 的使用方式。",
- "waf": "操作"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
+ "severity": "低",
+ "text": "如果診斷對你來說還不夠，請考慮在 Azure OpenAI 前面使用閘道（例如 Azure API 管理）來記錄傳入提示和傳出回應（如果允許）",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
- "severity": "中等",
- "text": "查看 Azure VM 的自動備份 v2 的使用方式。",
- "waf": "操作"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "使用基礎結構即代碼部署 Azure OpenAI 服務、模型部署和所有相關資源",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "使用進階磁碟時為 M 系列開啟寫入加速器 （V1）",
- "waf": "操作"
+ "text": "將 Microsoft Entra 身份驗證與託管標識（而不是 API 金鑰）配合使用",
+ "waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
- "severity": "中等",
- "text": "測試可用區延遲。",
- "waf": "性能"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "使用已知的黃金數據集評估系統的性能/準確性，該數據集具有輸入和正確答案。利用 PromptFlow 中的功能進行評估。",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
- "severity": "中等",
- "text": "為所有 SAP 元件啟動 SAP EarlyWatch Alert。",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "評估預配輸送量模型的使用方式",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
- "severity": "中等",
- "text": "使用 SAP ABAPMeter 報告 /SSA/CAT 查看 SAP 應用程式伺服器到資料庫伺服器的延遲。",
- "training": "https://me.sap.com/notes/0002879613",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "查看和實施 Azure AI 內容安全性",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "根據令牌數和每分鐘的回應來定義和評估系統的輸送量，並符合要求",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "查看使用 CCMS 的 SQL Server 性能監控。",
+ "text": "通過限制令牌大小、流式處理選項來改善系統的延遲",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "測試 SAP 應用層 VM 和 DBMS VM 之間的網路延遲 （NIPING）。",
- "training": "https://me.sap.com/notes/1100926/E",
+ "text": "估計彈性需求，以根據優先順序確定同步和批量請求分離。對於高優先順序，使用同步方法，對於低優先順序，首選使用佇列的異步批處理",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
- "severity": "中等",
- "text": "查看 SAP HANA Studio 警報。",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "根據消費者的估計需求對代幣消費要求進行基準測試。如果使用的是預設輸送量單元部署，請考慮使用 Azure OpenAI 基準測試工具來幫助驗證輸送量",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "使用 HANA_Configuration_Minichecks 執行 SAP HANA 執行狀況檢查。",
+ "text": "如果您使用的是預設輸送量單位 （PTU），請考慮為溢出請求部署每分鐘令牌 （TPM） 部署。當達到 PTU 限制時，使用閘道將請求路由到 TPM 部署。",
"waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
- "severity": "中等",
- "text": "如果您在 Azure、本地或其他雲環境中運行 Windows 和 Linux VM，則可以使用 Azure 自動化中的更新管理中心來管理操作系統更新，包括安全補丁。",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "為正確的任務選擇正確的模型。選擇在速度、回應質量和輸出複雜性之間做出正確權衡的模型",
+ "waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "定期查看 SAP 安全 OSS 說明，因為 SAP 發佈了高度關鍵的安全補丁或熱修復程式，需要立即採取措施保護您的 SAP 系統。",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
- "waf": "安全"
+ "text": "有一個性能基線，而不進行微調，以瞭解微調是否提高了模型性能",
+ "waf": "性能"
},
{
- "checklist": "SAP Checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"severity": "低",
- "text": "對於 SQL Server 上的 SAP，您可以禁用 SQL Server 系統管理員帳戶，因為 SQL Server 上的 SAP 系統不使用該帳戶。在禁用原始系統管理員帳戶之前，請確保具有系統管理員許可權的其他使用者可以訪問伺服器。",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
- "severity": "高",
- "text": "禁用 xp_cmdshell。SQL Server 功能xp_cmdshell啟用 SQL Server 內部作業系統命令 shell。這是安全審計中的潛在風險。",
- "training": "https://me.sap.com/notes/3019299/E",
- "waf": "安全"
+ "text": "跨區域部署多個 OAI 實例",
+ "waf": "可靠性"
},
{
- "checklist": "SAP Checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "在 Azure 上加密 SAP HANA 資料庫伺服器使用 SAP HANA 本機加密技術。此外，如果使用 Azure 上的 SQL Server，請使用透明數據加密 （TDE） 來保護數據和日誌檔，並確保備份也已加密。",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "waf": "安全"
+ "text": "使用閘道模式（如 APIM）實現重試和運行狀況檢查",
+ "waf": "可靠性"
},
{
- "checklist": "SAP Checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "Azure 儲存加密已為所有 Azure Resource Manager 和經典存儲帳戶啟用，並且無法禁用。由於數據預設加密，因此無需修改代碼或應用程式即可使用 Azure 儲存加密。",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
- "waf": "安全"
+ "text": "確保為工作負載提供足夠的 TPM 和 RPM 配額",
+ "waf": "可靠性"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
- "severity": "高",
- "text": "使用 Azure Key Vault 儲存機密和憑據",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "查看 HAI 工具包指南中的注意事項，並將這些交互實踐應用於 slution",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "建議在成功部署后鎖定 Azure 資源，以防止未經授權的更改。您還可以使用自定義的 Azure 策略（自定義角色）按訂閱強制實施 LOCK 約束和規則。",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
- "waf": "安全"
+ "text": "如果採用微調，則跨區域部署單獨的微調模型",
+ "waf": "可靠性"
},
{
- "checklist": "SAP Checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "預配 Azure Key Vault 並啟用軟刪除和清除策略，以允許對已刪除的物件進行保留保護。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
- "waf": "安全"
+ "text": "定期備份和複製關鍵數據，以確保數據丟失或系統故障時的數據可用性和可恢復性。利用 Azure 的備份和災難恢復服務來保護數據。",
+ "waf": "可靠性"
},
{
- "checklist": "SAP Checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "根據現有要求、法規和合規性控制（內部/外部）- 確定需要哪些 Azure 策略和 Azure RBAC 角色",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "text": "應選擇 Azure AI 搜索服務層級以具有 SLA",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
+ "severity": "低",
+ "text": "對數據和敏感度進行分類，在生成嵌入之前使用 Microsoft Purview 進行標記，並確保以相同的敏感度和分類處理生成的嵌入",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "在 SAP 環境中啟用 Microsoft Defender for Endpoint 時，建議排除 DBMS 伺服器上的數據和日誌檔，而不是以所有伺服器為目標。排除目標檔時，請遵循 DBMS 供應商的建議。",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "text": "使用 SSE/磁碟加密和可選的 BYOK 加密來加密用於 RAG 的數據",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "委派 SAP 管理員自定義角色，使其具有 Microsoft Defender for Cloud 的即時訪問許可權。",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "text": "確保對跨數據源傳輸的數據實施 TLS，用於檢索增強生成 （RAG） 和 LLM 通信的 AI 搜索",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "低",
- "text": "通過將第三方安全產品與適用於 DIAG （SAP GUI）、RFC 和 SPNEGO for HTTPS 的安全網路通信 （SNC） 集成，對傳輸中的數據進行加密",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "使用 RBAC 管理對 Azure OpenAI 服務的訪問。為使用者分配適當的許可權，並根據其角色和職責限制訪問許可權",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "預設使用 Microsoft 管理的金鑰來實現主體加密功能，並在需要時使用客戶管理的金鑰。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "實施數據加密、遮罩或編輯技術，以在非生產環境中或出於測試或故障排除目的共用數據時隱藏敏感數據或將其替換為混淆值",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "graph": "Resources | join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId | where type =~ 'microsoft.keyvault/vaults' | project type, name, SubName",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "每個區域每個環境的每個應用程式使用 Azure Key Vault。",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "利用 Azure Defender 來檢測和回應安全威脅，並設置監視和警報機制來識別可疑活動或違規行為。利用 Azure Sentinel 進行高級威脅檢測和回應",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
- "severity": "高",
- "text": "要控制和管理非 HANA Windows 和非 Windows 作業系統的磁碟加密密鑰和機密，請使用 Azure Key Vault。Azure Key Vault 不支援 SAP HANA，因此必須使用 SAP ABAP 或 SSH 密鑰等替代方法。",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "制定數據保留和處置策略，以遵守合規性法規。對不再需要的數據實施安全刪除方法，並維護數據保留和處置活動的審計跟蹤",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "為 Azure 上的 SAP 分支訂閱自定義基於角色的訪問控制 （RBAC） 角色，以避免意外的與網路相關的更改",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
- "waf": "安全"
+ "text": "使用 Content Safety 實施 Prompt shields 和接地檢測",
+ "waf": "卓越運營"
},
{
- "checklist": "SAP Checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "將 DMZ 和 NVA 與 SAP 資產的其餘部分隔離開來，配置 Azure 專用連結，並安全地管理和控制 Azure 上的 SAP 資源",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "安全"
- },
- {
- "checklist": "SAP Checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
- "severity": "低",
- "text": "考慮在 Azure 上使用 Microsoft 反惡意軟體來保護虛擬機免受惡意文件、廣告軟體和其他威脅的侵害。",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "text": "通過實施隱私控制並獲得數據處理活動所需的同意或許可，確保遵守相關的數據保護法規，例如GDPR或HIPAA。",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
- "severity": "低",
- "text": "要獲得更強大的保護，請考慮使用 Microsoft Defender for Endpoint。",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "對員工進行有關數據安全最佳實踐、安全處理數據的重要性以及與數據洩露相關的潛在風險的教育。鼓勵他們勤奮地遵循數據安全協定。",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "通過中心虛擬網路傳遞所有流量，將 SAP 應用程式和資料庫伺服器與 Internet 或本地網路隔離開來，該虛擬網路通過虛擬網路對等互連連接到輻射網路。對等互連的虛擬網路保證 Azure 上的 SAP 解決方案與公共 Internet 隔離。",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "text": "將生產數據與開發和測試數據分開。僅在生產中使用真實的敏感數據，並在開發和測試環境中使用匿名或合成數據。",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
- "severity": "低",
- "text": "對於面向 Internet 的應用程式（如 SAP Fiori），請確保根據應用程式要求分配負載，同時保持安全級別。對於第 7 層安全性，您可以使用 Azure Marketplace 中提供的第三方 Web 應用程式防火牆 （WAF）。",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "如果您具有不同級別的數據敏感度，請考慮為每個級別創建單獨的索引。例如，您可以有一個用於常規數據的索引，另一個用於敏感數據的索引，每個索引都由不同的訪問協定管理",
"waf": "安全"
},
{
- "checklist": "SAP Checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "若要在適用於 SAP 解決方案的 Azure Monitor 中啟用安全通信，可以選擇使用根證書或伺服器證書。我們強烈建議您使用根證書。",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "通過將敏感數據集放置在服務的不同實例中，進一步實現隔離。每個實例都可以使用其自己的特定 RBAC 策略集進行控制",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃",
- "waf": "可靠性"
+ "text": "認識到從敏感資訊生成的嵌入和向量本身就是敏感的。這些數據應得到與源材料相同的保護措施",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響",
- "waf": "可靠性"
+ "text": "將 RBAC 應用於具有嵌入和向量的數據存儲，並根據角色的訪問要求確定存取範圍",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "考慮為關鍵工作負載制定跨區域災難恢復策略",
- "waf": "可靠性"
+ "text": "為 AI 服務配置專用終結點，以限制網路內的服務訪問",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3",
- "waf": "可靠性"
+ "text": "使用 Azure 防火牆和 UDR 強制實施嚴格的入站和出站流量控制，並限制外部集成點",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Web/sites",
- "checklist": "Logic Apps checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
- "severity": "中等",
- "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼",
- "waf": "操作"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "實施網路分段和訪問控制，將 LLM 應用程式的存取限製為僅授權使用者和系統，並防止橫向行動",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "請考慮「存儲的 Azure 安全基線”",
- "waf": "安全"
+ "text": "使用提示壓縮工具，如 LLMLingua 或 gprtrim",
+ "waf": "成本優化"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "考慮將專用終結點用於 Azure 存儲",
+ "text": "確保 LLM 應用程式使用的 API 和端點使用身份驗證和授權機制（例如託管標識、API 金鑰或 OAuth）得到適當保護，以防止未經授權的訪問。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
+ "text": "實施強大的最終使用者身份驗證機制，例如多因素身份驗證，以防止對 LLM 應用程式和相關網路資源的未經授權的訪問",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
- "severity": "高",
- "text": "為所有存儲帳戶啟用 Microsoft Defender",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "實施網路監控工具，以檢測和分析網路流量中的任何可疑或惡意活動。啟用日誌記錄以捕獲網路事件，並在發生安全事件時促進取證分析",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "軟刪除機制允許恢復意外刪除的 blob。",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "為 blob 啟用“軟刪除”",
+ "text": "進行安全審計和滲透測試，以識別和解決LLM應用程式的網路基礎設施中的任何網路安全弱點或漏洞",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "禁用 blob 的“軟刪除”",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
+ "severity": "低",
+ "text": "Azure AI 服務已正確標記，以便更好地管理",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "容器的軟刪除使您能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
+ "severity": "低",
+ "text": "Azure AI 服務帳戶遵循組織命名約定",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "為容器啟用“軟刪除”",
- "waf": "安全"
+ "text": "應啟用 Azure AI 服務資源中的診斷日誌",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "禁用容器的“軟刪除”",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "為了安全起見，建議禁用密鑰訪問（本地身份驗證）。 禁用基於密鑰的訪問后，Microsoft Entra ID 將成為唯一的訪問方法，該方法允許保持最小許可權原則和精細控制。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "通過強制使用者先刪除刪除鎖，然後再刪除存儲帳戶，防止意外刪除存儲帳戶",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "在存儲帳戶上啟用資源鎖定",
+ "text": "使用 Azure Key Vault 安全地存儲和管理密鑰。避免在 LLM 應用程式的代碼中硬編碼或嵌入敏感密鑰，並使用託管標識從 Azure Key Vault 中安全地檢索它們",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，以便無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;一旦存儲帳戶包含不可變的 blob，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "考慮不可變的 blob",
+ "text": "定期輪換和過期存儲在 Azure Key Vault 中的密鑰，以最大程度地降低未經授權訪問的風險。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並且對伺服器進行身份驗證。",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
+ "text": "使用 tiktoken 了解對話模式下令牌優化的令牌大小",
+ "waf": "成本優化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "遵循安全編碼做法，以防止常見漏洞，例如注入攻擊、跨網站腳本 （XSS） 或安全配置錯誤",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "強制執行 HTTPS（禁用 HTTP）時，請檢查是否不要對儲存帳戶使用自定義域 （CNAME）。",
+ "text": "設置一個流程來定期更新和修補 LLM 庫和其他系統元件",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於最大程度地降低憑據丟失的風險。",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "遵守 Azure OpenAI 或其他 LLM 的使用條款、策略和指南以及允許的用例",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "了解基礎模型和微調模型的成本差異以及令牌步長",
+ "waf": "成本優化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
+ "severity": "高",
+ "text": "在可能的情況下，批量請求，以最大程度地減少每次調用的開銷，從而降低總體成本。確保優化批量大小",
+ "waf": "成本優化"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
- "waf": "安全"
+ "text": "設置成本跟蹤系統，用於監視模型使用方式，並使用該資訊來説明通知模型選擇和提示大小",
+ "waf": "成本優化"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": ".強制執行最新的 TLS 版本將拒絕來自使用舊版本的用戶端的請求。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
- "service": "Azure Storage",
- "severity": "高",
- "text": "強制實施存儲帳戶的最新 TLS 版本",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "為每個模型回應的令牌數設置最大限制。優化大小以確保其足夠大以實現有效的回應",
+ "waf": "成本優化"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "在可能的情況下，應優先使用 Microsoft Entra ID 令牌，而不是共用訪問簽名",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
- "severity": "高",
- "text": "使用 Microsoft Entra ID 令牌進行 blob 訪問",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "查看提供的有關設置 AI 搜索以實現可靠性的指南",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "為使用者、組或應用程式分配角色時，請僅授予該安全主體執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "IaM 許可權中的最小特權",
- "waf": "安全"
+ "text": "規劃和管理 AI 搜索向量存儲",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但與服務 SAS 相比，它提供了安全優勢。",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
- "severity": "高",
- "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "應用 LLMOps 實踐來自動化 GenAI 應用程式的生命週期管理",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取了密鑰的副本，但一旦密鑰掌握在多人手中，就不可能將使用方式歸因於特定使用者。僅依賴 Entra ID 身份驗證可以更輕鬆地將存儲訪問許可權與用戶綁定。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 Microsoft Entra ID 訪問（和使用者委派 SAS）。",
- "waf": "安全"
+ "text": "評估計費模型的使用方式 - PAYG 與 PTU",
+ "waf": "成本優化"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "使用活動日誌數據來確定查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
- "severity": "高",
- "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
- "waf": "安全"
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "在模型版本之間切換時評估提示和應用程式的品質",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果已過指定的時間間隔且尚未旋轉鍵，則會顯示提醒。",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
- "waf": "安全"
+ "text": "評估、監控和優化您的 GenAI 應用程式的特性，如接地氣、相關性、準確性、連貫性、流暢性、",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS 過期策略指定了 SAS 的有效時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們將看到警告。",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "考慮配置 SAS 過期策略",
- "waf": "安全"
+ "text": "根據不同的搜索參數評估 Azure AI 搜尋結果",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "通過存儲訪問策略，可以選擇撤銷服務 SAS 的許可權，而無需重新生成存儲帳戶密鑰。",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "考慮將 SAS 連結到儲存存取策略",
- "waf": "安全"
+ "text": "只有在嘗試了其他基本方法（如提示工程和RAG處理數據）時，才將微調模型視為提高準確性的方法",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
- "waf": "安全"
+ "text": "使用提示工程技術來提高 LLM 回應的準確性",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中擁有存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
- "severity": "高",
- "text": "請考慮在 Azure KeyVault 中儲存連接字串（在無法使用託管標識的情況下）",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "紅隊您的 GenAI 應用程式",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只會在短時間內有效。如果無法引用存儲訪問策略，則這種做法尤為重要。近期過期時間還通過限制可用於上傳到 blob 的時間來限制可以寫入 blob 的數據量。",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
+ "severity": "中等",
+ "text": "為最終使用者提供 LLM 回應的評分選項並跟蹤這些分數。",
+ "waf": "卓越運營"
+ },
+ {
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"severity": "高",
- "text": "爭取縮短臨時 SAS 的有效期",
- "waf": "安全"
+ "text": "考慮配額管理做法",
+ "waf": "成本優化"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "創建 SAS 時，請盡可能具體且具有限制性。首選單一資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
+ "checklist": "Azure OpenAI Review",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
"severity": "中等",
- "text": "對SAS應用窄範圍",
- "waf": "安全"
+ "text": "使用負載均衡器解決方案（如基於APIM的閘道）在服務和區域之間平衡負載和容量",
+ "waf": "卓越運營"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
+ "severity": "中等",
+ "text": "在全域級別實施錯誤處理策略",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
+ "severity": "中等",
+ "text": "確保所有 API 策略都包含一個元素。",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"severity": "中等",
- "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
- "waf": "安全"
+ "text": "使用策略片段可避免在多個 API 中重複相同的策略定義",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "SAS無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能很有意義。",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
- "severity": "低",
- "text": "在用戶端使用SAS上傳檔后，請考慮檢查上傳的數據。",
- "waf": "安全"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
+ "severity": "中等",
+ "text": "如果您計劃通過 API 獲利，請查看“獲利支援”一文，瞭解最佳做法",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "使用「本地使用者帳戶」通過 SFTP 訪問 blob 儲存時，“通常”的 RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更具限制性。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點目前支援的唯一身份管理形式",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"severity": "高",
- "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核隨著時間的推移是否需要訪問。",
- "waf": "安全"
+ "text": "啟用診斷設置以將日誌導出到 Azure Monitor",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"severity": "中等",
- "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
- "waf": "安全"
+ "text": "啟用 Application Insights 以獲取更詳細的遙測數據",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "存儲支援 CORS（跨源資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放鬆同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"severity": "高",
- "text": "避免過於寬泛的 CORS 策略",
- "waf": "安全"
+ "text": "針對最關鍵的指標配置警報",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"severity": "高",
- "text": "確定應如何加密靜態數據。了解數據的線程模型。",
+ "text": "確保自定義 SSL 證書儲存在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
- "severity": "中等",
- "text": "確定應使用哪種/是否應使用平臺加密。",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
+ "severity": "高",
+ "text": "使用 Azure AD 保護對 API（數據平面）的傳入請求",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"severity": "中等",
- "text": "確定應使用哪種/是否應使用用戶端加密。",
+ "text": "使用 Microsoft Entra ID 在開發人員門戶中對用戶進行身份驗證",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "description": "利用 Resource Graph 資源管理器 （resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true） 查找允許匿名 blob 訪問的存儲帳戶。",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
- "severity": "高",
- "text": "考慮是否需要公共 blob 匿名訪問，或者是否可以對某些存儲帳戶禁用公共 blob 匿名訪問。",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
+ "severity": "中等",
+ "text": "創建適當的組來控制產品的可見性",
"waf": "安全"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
- "severity": "高",
- "text": "利用 storagev2 帳戶類型獲得更好的性能和可靠性",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
- "severity": "高",
- "text": "利用 GRS、ZRS 或 GZRS 儲存實現最高可用性",
- "waf": "可靠性"
- },
- {
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"severity": "中等",
- "text": "對於故障轉移后的寫入操作，請使用客戶管理的故障轉移",
- "waf": "可靠性"
+ "text": "使用後端功能消除冗餘 API 後端配置",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"severity": "中等",
- "text": "瞭解 Microsoft 託管的故障轉移詳細資訊",
- "waf": "可靠性"
+ "text": "使用命名值存儲可在策略中使用的通用值",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
- "checklist": "Azure Storage Review Checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"severity": "中等",
- "text": "啟用軟刪除",
+ "text": "對於DR，利用高級層，跨兩個或多個區域擴展部署，實現99.99%的SLA",
"waf": "可靠性"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"severity": "中等",
- "text": "使用長期可撤銷令牌，緩存令牌並使用 Microsoft 標識庫以靜默方式獲取令牌",
+ "text": "在兩個或多個可用區中部署至少一台設備，SLA 提高 99.99%",
"waf": "可靠性"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
- "severity": "中等",
- "text": "請確保登錄使用者流已備份並具有復原能力。請確保用於登錄使用者的代碼已備份且可恢復。與外部進程的彈性介面",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
+ "severity": "高",
+ "text": "確保有一個自動備份例程",
"waf": "可靠性"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"severity": "中等",
- "text": "自訂品牌資產應託管在CDN上",
- "waf": "性能"
- },
- {
- "checklist": "Identity Review Checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
- "severity": "低",
- "text": "擁有多個標識提供者（即使用您的 Microsoft、Google、Facebook 帳戶登錄）",
+ "text": "使用策略添加故障轉移後端 URL 和緩存，以減少失敗的調用。",
"waf": "可靠性"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
- "severity": "中等",
- "text": "遵循 VM 規則，實現 VM 級別的高可用性（高級磁碟，一個區域中的兩個或更多磁碟，位於不同的可用性區域）",
- "waf": "可靠性"
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
+ "severity": "低",
+ "text": "如果需要以高性能級別進行日誌記錄，請考慮事件中心策略",
+ "waf": "操作"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"severity": "中等",
- "text": "不要複製！複製可能會產生目錄同步問題",
- "waf": "可靠性"
+ "text": "應用限制策略來控制每秒的請求數",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "性能"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"severity": "中等",
- "text": "對多區域具有主動-主動",
- "waf": "可靠性"
+ "text": "配置自動縮放以在負載增加時橫向擴展實例數",
+ "waf": "性能"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"severity": "中等",
- "text": "將 Azure AD 域服務標記添加到其他區域和位置",
- "waf": "可靠性"
+ "text": "在 Azure 沒有靠近後端 API 的區域的地方部署自承載閘道。",
+ "waf": "性能"
},
{
- "checklist": "Identity Review Checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"severity": "中等",
- "text": "將副本集用於DR",
+ "text": "將高級層用於生產工作負載。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"severity": "中等",
- "text": "遵循 Azure 機器人服務中的可靠性支持建議",
+ "text": "在多區域模型中，使用策略根據可用性或延遲將請求路由到區域後端。",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "severity": "中等",
- "text": "部署具有本地數據駐留和區域合規性的機器人",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
+ "severity": "高",
+ "text": "注意APIM的局限性",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "Azure Bot Service",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
- "severity": "中等",
- "text": "Azure 機器人服務在全域和區域服務的主動-主動模式下運行。發生中斷時，無需檢測錯誤或管理服務。Azure 機器人服務在多區域地理體系結構中自動執行自動故障轉移和自動恢復。對於歐盟機器人區域服務，Azure 機器人服務在歐洲境內提供兩個完整區域，並提供主動/主動複製，以確保冗餘。對於全球機器人服務，所有可用的區域/地理位置都可以作為全球足跡。",
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
+ "severity": "高",
+ "text": "確保自承載閘道部署具有復原能力。",
"waf": "可靠性"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
"service": "APIM",
"severity": "中等",
- "text": "在全域級別實施錯誤處理策略",
- "waf": "操作"
+ "text": "在APIM前面使用 Azure Front Door 進行多區域部署",
+ "waf": "性能"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
"service": "APIM",
"severity": "中等",
- "text": "確保所有 API 策略都包含一個元素。",
- "waf": "操作"
+ "text": "在虛擬網络 （VNet） 中部署服務Deploy the service within a Virtual Network （VNet）",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
"service": "APIM",
"severity": "中等",
- "text": "使用策略片段可避免在多個 API 中重複相同的策略定義",
- "waf": "操作"
+ "text": "將網路安全組 （NSG） 部署到子網，以限制或監視進出APIM的流量。",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
"service": "APIM",
"severity": "中等",
- "text": "如果您計劃通過 API 獲利，請查看“獲利支援”一文，瞭解最佳做法",
- "waf": "操作"
+ "text": "部署專用終結點以在未將APIM部署到 VNet 時篩選傳入流量。",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
"service": "APIM",
"severity": "高",
- "text": "啟用診斷設置以將日誌導出到 Azure Monitor",
+ "text": "禁用公網訪問",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.ApiManagement/service",
+ "checklist": "Azure API Management Review",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
+ "severity": "中等",
+ "text": "使用 PowerShell 自動化腳本簡化管理",
"waf": "操作"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
"service": "APIM",
"severity": "中等",
- "text": "啟用 Application Insights 以獲取更詳細的遙測數據",
+ "text": "通過基礎架構即代碼配置APIM。查看 Cloud Adaption Framework 中的 DevOps 最佳實踐 APIM 登陸區域加速器",
"waf": "操作"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
"service": "APIM",
- "severity": "高",
- "text": "針對最關鍵的指標配置警報",
+ "severity": "中等",
+ "text": "促進 Visual Studio Code APIM 擴展的使用，以加快 API 開發速度",
"waf": "操作"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
"service": "APIM",
- "severity": "高",
- "text": "確保自定義 SSL 證書儲存在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
- "waf": "安全"
+ "severity": "中等",
+ "text": "在工作流中實施DevOps和 CI/CD",
+ "waf": "操作"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
"service": "APIM",
- "severity": "高",
- "text": "使用 Azure AD 保護對 API（數據平面）的傳入請求",
+ "severity": "中等",
+ "text": "使用用戶端證書身份驗證保護 API",
"waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
"service": "APIM",
"severity": "中等",
- "text": "使用 Microsoft Entra ID 在開發人員門戶中對用戶進行身份驗證",
+ "text": "使用用戶端證書身份驗證保護後端服務",
"waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
"service": "APIM",
"severity": "中等",
- "text": "創建適當的組來控制產品的可見性",
+ "text": "查看“緩解 OWASP API 安全前 10 大威脅的建議”一文，並查看適用於您的 API 的內容",
"waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
"service": "APIM",
"severity": "中等",
- "text": "使用後端功能消除冗餘 API 後端配置",
- "waf": "操作"
+ "text": "使用授權功能簡化後端 API 的 OAuth 2.0 令牌管理",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
"service": "APIM",
- "severity": "中等",
- "text": "使用命名值存儲可在策略中使用的通用值",
- "waf": "操作"
+ "severity": "高",
+ "text": "加密傳輸中的資訊時，請使用最新的 TLS 版本。盡可能禁用過時和不必要的協議和密碼。",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
"service": "APIM",
- "severity": "中等",
- "text": "對於DR，利用高級層，跨兩個或多個區域擴展部署，實現99.99%的SLA",
- "waf": "可靠性"
+ "severity": "高",
+ "text": "確保機密（命名值）存儲在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
"service": "APIM",
"severity": "中等",
- "text": "在兩個或多個可用區中部署至少一台設備，SLA 提高 99.99%",
- "waf": "可靠性"
+ "text": "盡可能使用託管標識向其他 Azure 資源進行身份驗證",
+ "waf": "安全"
},
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
"service": "APIM",
"severity": "高",
- "text": "確保有一個自動備份例程",
- "waf": "可靠性"
+ "text": "使用 APIM 前面部署應用程式閘道來使用 Web 應用程式防火牆 （WAF）",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
+ "severity": "中等",
+ "text": "確保使用的是應用程式閘道 v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
+ "severity": "中等",
+ "text": "確保將標準 SKU 用於 Azure 負載均衡器",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
+ "severity": "中等",
+ "text": "確保您的負載均衡器前端IP位址是區域冗餘的（除非您需要可用區前端）。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
+ "severity": "中等",
+ "text": "應用程式閘道 v2 應部署在IP前綴等於或大於 /24 的子網中",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "description": "一般來說，反向代理（尤其是 WAF）的管理更接近應用程式而不是網路，因此它們與應用程式屬於同一訂閱。如果應用程式閘道和 WAF 由一個團隊管理，則將其集中在連接訂閱中可能是可以的。",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "使用策略添加故障轉移後端 URL 和緩存，以減少失敗的調用。",
- "waf": "可靠性"
+ "text": "部署 Azure 應用程式閘道 v2 或合作夥伴 NVA，用於在登陸區虛擬網路中代理入站 HTTP（S） 連接，以及它們所保護的應用。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
- "severity": "低",
- "text": "如果需要以高性能級別進行日誌記錄，請考慮事件中心策略",
- "waf": "操作"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
+ "severity": "中等",
+ "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"severity": "中等",
- "text": "應用限制策略來控制每秒的請求數",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "性能"
+ "text": "配置自動縮放，最小實例數為 2。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"severity": "中等",
- "text": "配置自動縮放以在負載增加時橫向擴展實例數",
- "waf": "性能"
+ "text": "跨可用區部署應用程式閘道",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "可靠性"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "arm-service": "microsoft.network/frontdoors",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"severity": "中等",
- "text": "在 Azure 沒有靠近後端 API 的區域的地方部署自承載閘道。",
- "waf": "性能"
+ "text": "使用 Front Door 和應用程式閘道幫助保護 HTTP/S 應用時，請在 Front Door 中使用 WAF 策略。鎖定應用程式閘道以僅接收來自 Front Door 的流量。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
- "severity": "中等",
- "text": "將高級層用於生產工作負載。",
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
+ "severity": "高",
+ "text": "使用流量管理器交付跨 HTTP/S 以外的協定的全域應用。",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
+ "severity": "低",
+ "text": "如果使用者只需要存取內部應用程式，是否考慮將 Microsoft Entra ID 應用程式代理作為 Azure 虛擬桌面 （AVD） 的替代方案？",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "安全"
+ },
+ {
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"severity": "中等",
- "text": "在多區域模型中，使用策略根據可用性或延遲將請求路由到區域後端。",
- "waf": "可靠性"
+ "text": "要減少網路中為傳入連接打開的防火牆埠數，請考慮使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式的安全且經過身份驗證的訪問。",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
"severity": "高",
- "text": "注意APIM的局限性",
+ "text": "使用 Azure NAT 閘道而不是負載均衡器出站規則來提高 SNAT 可伸縮性",
"waf": "可靠性"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
"severity": "高",
- "text": "確保自承載閘道部署具有復原能力。",
- "waf": "可靠性"
+ "text": "啟用 Azure 應用程式閘道 WAF 機器人保護規則集。機器人規則檢測好的機器人和壞的機器人。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
- "severity": "中等",
- "text": "在APIM前面使用 Azure Front Door 進行多區域部署",
- "waf": "性能"
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
+ "severity": "高",
+ "text": "確保 Azure 應用程式閘道 WAF 策略中是否啟用了請求正文檢查功能。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
- "severity": "中等",
- "text": "在虛擬網络 （VNet） 中部署服務Deploy the service within a Virtual Network （VNet）",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
+ "severity": "高",
+ "text": "在檢測模式下優化工作負載的 Azure 應用程式閘道 WAF。減少誤報檢測。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
- "severity": "中等",
- "text": "將網路安全組 （NSG） 部署到子網，以限制或監視進出APIM的流量。",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview?source=recommendations",
+ "service": "App Gateway",
+ "severity": "高",
+ "text": "在「防護」模式下部署應用程式閘道的 WAF 策略。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "部署專用終結點以在未將APIM部署到 VNet 時篩選傳入流量。",
+ "text": "向 Azure 應用程式閘道 WAF 添加速率限制。Rate limit 會阻止客戶端在短時間內意外或故意發送大量流量。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
- "severity": "高",
- "text": "禁用公網訪問",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
+ "severity": "中等",
+ "text": "對 Azure 應用程式閘道 WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎設施不堪重負的極大量請求提供保護。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
- "severity": "中等",
- "text": "使用 PowerShell 自動化腳本簡化管理",
- "waf": "操作"
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
+ "severity": "低",
+ "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選條件來阻止來自非預期國家/地區的流量。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"severity": "中等",
- "text": "通過基礎架構即代碼配置APIM。查看 Cloud Adaption Framework 中的 DevOps 最佳實踐 APIM 登陸區域加速器",
- "waf": "操作"
+ "text": "在使用 Azure 應用程式閘道 WAF 對流量進行異地篩選時，指定未知 （ZZ） 位置。避免在IP位址無法進行異地匹配時意外阻止合法請求。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"severity": "中等",
- "text": "促進 Visual Studio Code APIM 擴展的使用，以加快 API 開發速度",
- "waf": "操作"
+ "text": "使用最新的 Azure 應用程式閘道 WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。",
+ "waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"severity": "中等",
- "text": "在工作流中實施DevOps和 CI/CD",
+ "text": "添加診斷設置以保存 Azure 應用程式閘道 WAF 紀錄。",
"waf": "操作"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"severity": "中等",
- "text": "使用用戶端證書身份驗證保護 API",
- "waf": "安全"
+ "text": "將 Azure 應用程式閘道 WAF 紀錄發送到 Microsoft Sentinel。",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"severity": "中等",
- "text": "使用用戶端證書身份驗證保護後端服務",
- "waf": "安全"
+ "text": "將 Azure 應用程式閘道 WAF 設定定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "查看“緩解 OWASP API 安全前 10 大威脅的建議”一文，並查看適用於您的 API 的內容",
- "waf": "安全"
+ "text": "使用 WAF 策略而不是舊版 WAF 配置。",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"severity": "中等",
- "text": "使用授權功能簡化後端 API 的 OAuth 2.0 令牌管理",
+ "text": "篩選後端中的入站流量，使其僅接受來自應用程式閘道子網的連接，例如使用NSG的連接。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
"severity": "高",
- "text": "加密傳輸中的資訊時，請使用最新的 TLS 版本。盡可能禁用過時和不必要的協議和密碼。",
+ "text": "您應該對到後端伺服器的流量進行加密。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
"severity": "高",
- "text": "確保機密（命名值）存儲在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
+ "text": "您應該使用 Web 應用程式防火牆。",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "盡可能使用託管標識向其他 Azure 資源進行身份驗證",
+ "text": "將 HTTP 重定向到 HTTPS",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
- "checklist": "Azure API Management Review",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
+ "severity": "中等",
+ "text": "使用閘道託管的 Cookie 將流量從使用者工作階段定向到同一伺服器進行處理",
+ "waf": "操作"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
"severity": "高",
- "text": "使用 APIM 前面部署應用程式閘道來使用 Web 應用程式防火牆 （WAF）",
+ "text": "在計劃內服務更新期間啟用連接耗盡，以防止後端池的現有成員失去連接",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure 服務總線高級版提供靜態數據加密。如果您使用自己的金鑰，則數據仍使用 Microsoft 管理的金鑰進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
"severity": "低",
- "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "安全"
+ "text": "創建自訂錯誤頁面以顯示個人化的用戶體驗",
+ "waf": "操作"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "用戶端應用程式與 Azure 服務總線命名空間之間的通信使用傳輸層安全性 （TLS） 進行加密。Azure 服務總線命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將服務總線命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
"severity": "中等",
- "text": "對請求強制實施最低要求的傳輸層安全性 （TLS） 版本",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "text": "編輯 HTTP 請求和回應標頭，以便更輕鬆地在用戶端和伺服器之間進行路由和資訊交換",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "創建服務總線命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的 SAS 規則。此策略具有整個命名空間的 Manage 許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。 建議使用 AAD 作為 RBAC 的身份驗證提供程式。",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "避免在不需要時使用 root 帳戶",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "安全"
+ "text": "配置 Front Door 以優化全域 Web 流量路由和頂級最終使用者性能，並通過快速全域故障轉移實現可靠性",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "在 Azure 應用服務應用程式內或在啟用了 Azure 資源支援的託管實體的虛擬機中運行的服務總線用戶端應用不需要處理 SAS 規則和密鑰或任何其他存取權杖。用戶端應用程式只需要 Service Bus Messaging 命名空間的終結點位址。",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "如果可能，應用程式應使用託管標識向 Azure 服務總線進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中使用存儲憑據（SAS、服務主體憑據）",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "安全"
- },
- {
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "創建許可權時，請對用戶端對 Azure 服務總線的訪問提供精細控制。Azure 服務總線中的許可權可以而且應該限定為單個資源級別，例如佇列、主題或訂閱。",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
- "severity": "高",
- "text": "使用最低許可權數據平面 RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "安全"
+ "text": "使用傳輸層負載均衡",
+ "waf": "性能"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "Azure 服務總線資源日誌包括操作日誌、虛擬網路和IP篩選日誌。運行時審核日誌捕獲服務總線中各種數據平面訪問操作（例如發送或接收消息）的聚合診斷資訊。",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"severity": "中等",
- "text": "啟用記錄以進行安全調查。使用 Azure Monitor 追蹤資源紀錄和執行時審核紀錄（目前僅在進階層中可用 ）",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "text": "為單個閘道上的多個 Web 應用程式配置基於主機名稱或功能變數名稱的路由",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "默認情況下，Azure 服務總線具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路與 Azure 服務總線之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公有終端節點，則應禁用這些終端節點。",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"severity": "中等",
- "text": "請考慮使用專用終結點訪問 Azure 服務總線，並在適用時禁用公用網路訪問。",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "集中 SSL 證書管理以減少後端伺服器場的加密和解密開銷",
"waf": "安全"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
- "checklist": "Service Bus Review Checklist",
- "description": "使用IP防火牆，您可以將公有終端節點進一步限製為僅一組 IPv4 位址或 CIDR（無類域間路由）表示法的 IPv4 位址範圍。",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
- "severity": "中等",
- "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 服務總線命名空間",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Application Delivery Networking",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
+ "severity": "低",
+ "text": "使用應用程式閘道實現對 WebSocket 和 HTTP/2 協定的本機支援",
"waf": "安全"
}
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "October 02, 2024"
+ "timestamp": "October 21, 2024"
},
"severities": [
{
@@ -9995,15 +9995,15 @@
],
"status": [
{
- "description": "此檢查尚未查看",
+ "description": "尚未查看此檢查",
"name": "未驗證"
},
{
- "description": "有一個與此檢查關聯的措施項",
+ "description": "存在與此檢查關聯的操作項",
"name": "打開"
},
{
- "description": "此檢查已通過驗證，並且沒有與之關聯的進一步操作項",
+ "description": "此檢查已經過驗證，沒有與之關聯的其他操作項",
"name": "實現"
},
{
diff --git a/spreadsheet/macrofree/appservicewebapps_sg_checklist.en.xlsx b/spreadsheet/macrofree/appservicewebapps_sg_checklist.en.xlsx
index 0db3d1fce8ce99a37001aedb20a9a720887cdd39..fbf44d1d7b5ef2ca0099c9209a71c51bd4bc4a0c 100644
GIT binary patch
delta 676
zcmX@QoAKCgM&1B#W)=|!1_llW!?mFkc@J;`smKM}b3C~wUX!bj_daYOa&*7f%j#Kb
zZ`)ed@oU+2upVrB6z%bDThixtl}m4L&%U}Yy6{2rIm_?m{yU~_@R49&e=ee6A@h8h
zkoC60Ws~1IZ{SJR|F&Sq`6MUz;_Nw(6z%TvMeFVR!Dn#xvuT*Xjwg+eg#~WToZ;u8
znYQF_*v1oUhGLd-!jM_@8s}
z)mNq+Usun75>A^rm=3Tp14C-_X^w*~U`D_1TxKvsKTv=b#F*?9_6#hb9e$1xEbu4d
zC0O7^q(4N!D%u(m+>`5~&E!FWe^6Xt-y}8$hGPm048p*efq@3bKa(#4wJr9FuQxNKMv{;Q`xe7bDHo>^pg$uatIxHzSh>Gd!*%!zR24
zdBMWKpkctkz>91Kqw?ehF*0E7`(vaT%_iTDk%|G?DjvdKw1km?L7ka_fgeSOd^iI`
zMUH-Xeo=N(etx!IMQ#qdb*tlw^tJ#s^)fLqNTF!{FgY+*6Kq{=tTf}D$uncs*mR;n
FN&u0C?KS`a
delta 640
zcmX@MoAKywM&1B#W)=|!1_lm>CP&AKyazaeROE%Y2p`Ug*W~I0vzrY>TK{+bSm(KA
zn$Q~l+cyr+FqpAnTQ+V&w@AhYg>x^b?Y}uru
zEw$}g<-zdT{l?jb^{iQoZ^izWFPv&1wSf0-!L-7tI|BL*t9YirZaH2h^v>_J*!w@*
z+;c16ypl!3^k-xShVo?VXlq1hPp*$PlLv+UL2-e7lh_y-jwvuO2m>Pq1{xTDPreeZ1UBkt
zv^3K`j>+?VMJIpYV4Z9b!vhw!kCA3-@&yV@X$N>SGKnxlA{OYH$gl}7LSC>iFlZPs
zFz~{R1kw$RN|P7H$bhvUh>>PAoqQ)o3Svi$w7pz714BiQetCXTc2a(Rwq8YU4!Xgs
s3M-+9qN4QPAqi26
zEG3{|1cVR)0qN2bASC&c(A@p)_vhhBm^8eRZqjinUHL7j@iqf6bK6ZCIql<^!9(QGCQkg7B)k)B3s^
z)G1~7EEspxOuTO8s3c}l#^_k}kI)geV|_`9I_ko9Z^=I71Apzg!E(s!SEB7+08+X;
zWkHTv)n11;NG|KC)!$F8+nZGP0+%J+Z2Z4C@KvAu>ucNzE&1;ss@MAb)RTLS;D;a+
z*m8>TuB1kRi`-()U1f`wii(xG4%$!+J)L6~6}FfNcF{SoZhq7HzU=4Il{lc0^(D7{
z*X??Z`iO-Hzx`kCAk9029|#UnsyWs>Ac0@vn+t(m|KO?Yz@GQ}S?NqU)Xu!mRNb}f
znfRVvr*^?4EZJdm2b2Lj=N{ebw|QT>i?d>?(A>IIML?*n?MF`-d1xJH%qO1E>}H7u
zyMbd_npUy%C5oqNl+$=4B3C=RNj>Au1}4sV7nG(UfmKy)JuFSLzpzBS5zw90GFC0N
zIQ)8jHZOe|lKC`BH-S8>$EB#OqCw)h?S?v9GW!wg7_j07l4K4Hm?U8Q#@zaNk7(yRy2dY
zxkxWgj*Z|#WNJ?MD#wvLp~6+zHnNW*c)eVhFg8=@ra(>V??e_+AB0WJ`mJZ-ez2G!
zI2XCFs=&0FaJw=%{#uP(bcnQc`cKF*93H&9J~ktbpbplxRAK*4j`lZBY5QJH1rRf%
zkNiIu3HC44`F(?=QO6KyvfsLZFnr#$&eTw%3^dz`rRs#_@PTEb@rtPu&0%A!KKT;q
z)8m(^gkps+)Qcf5%&0~4&cM+Ej_#%|Gjkm9tjD?Wv}*d#VYy=
zASnZ8`Co0Gdg7dI$=2sb+J@x%e?elGCJnNxW_%}oR(`Dhysm}gSZtDm29O+4cY*eV
zspA!il@QEC*^AX%a;PWorj80V%(FRwr3yQlX+Ym
zx_s>1!>YX{yNWR5zKF>J-5O6*~E5<8}TJR
zc)_hbynKmFT{i#%YBTKjr=JEg;TjhZnyY6NmDkr78y1kD8QwhTpfXP$0Bbmc0qW#+
zWt%2Yt6@WJIn|;Rk8ZwoZ1V)E>*s=7OtRGtE(^~A*U(C6Fiti?n3%n
zUADZ%)*p9e-B-FWy7LB(2R}m28R(7nyi^e4pQ|<+B*j<3#Vjp$GEn*=Y}m$QrJy$%
z9g>WcV*#7{p!@2zbVdmi#bQU{7E+)&!SPC=QLEc&IzEc;e0e_iOwIsYV6~8x-W=>n
zD^YC|DHo}n4?Y~hE1_pxWS57RCf)X$Fdg<=Z2Afr=#*>1;Cw2plQ`g5?IBVb9P3<}
z3X)F9%o?;q*zesNarN*gxWKwp*<;55mSy>B(0R=BsqlbqrXASF$I!@&JUk@pR=z`f{fKnW+;WP3f
zE_B-2Ncl4|J%B1ritsn0vj~}xxsU*fsIy~^rzW`e!-6vv|0iSPu@#8GZ
z<###->+8&2ehsF8%3V6H?Z?k3qgLmemC?z)C!P%4<{|n$MX>5($0yg#&rE0
zkBV;76KP&g|Dsk%Q|xh{w&P{cM1cf)M2^n98xL2LQ}_`@TAFDrWm;>3Qal}sGA
z=(=1Gpjl@8t*o9%s!hETM=&EQzGKn(Yr2O@
znfT;#i8uzz{6=y%|t)s#BWsqrRT#
z&eO7(a{uo+)roB1-}GCxswIfpq+_$XT)pIU?W|YYS5Bs?Nb-J^1YOLzm^kj?oWCy!?wL5DuA|L-1cg@(RXtLwW#T0pF}nQ=Q|D
z(&5RfW}OJ1%*$-~N^asT+6B|_Lh&Db%(};!mFg{qW@0DZgVQox1Yf8xa^L#qs+~Bl
zUTRdVLPV9`jrWxkrOp!UX7NRCvl?@hj}mge{Y{<*`9UQrb8b~~oiBw>h}{Cx7F97&
z-VP}LHAqO0V$V#^5EAI&oyQb*vwTW6c&bY{?AXDai@8IFD@hdERBQW#WiONx%A0w+
zAzDG{c%)*9`D(FA#rdj!XWwsQWLbOf{)OAF)3=%yQ;J>ex?0{{?i6!2od2kEAOSa&
zbDAmH0p~M32GX{7&3({)2%1)1V7cm5de|NO4SLhzTtJ#waxs9JUA$v}cbJ%(uaUjN
z){jgWTY7*-l)?IPbYyk01D04TKSAe?iKy|lGakH43oMy=*;P&~H}2pj2_q`R&!D`y
zbYiOkYp@eu2PKgf^8kM9d{^wvm`XFYO#YaBcIWP%szqyA2yQ^TXA~2J5O(`Ig&2JS
z7{`x#RpPWzfP#m{g1g2!hVo)BpOz88(2fqSEg&-A%8la!rIQj}annJWOeLw)gbz#V
zgda9$%a-+^_Y$KPu+bi7z3#DF_6AL}NVkB5A{VI9yN8*nN!&hmX#ur~!4BQPOl|s1
zol4mVO3K9~IJ92N^*$$2G^qTy;j@rJbM{g(R=z3V%46c4kHLJke&0;O5h6
zz~NL^^FT)2hd>?DW%d<%V>O<4M!rSmf!w*B8%&l*ydflRO8gzEC=OER4e9nULTd5{
zfLas5j*uy>dEb$Cy^14Ma1L{VV*9Njv!u}4QhH6hNJ5!7h$IKcoip_R)tqrm7Yyt%
z_!&L3zOMHT-Ll9xbI#2pxOI6ox{_A-7=YgaA!9{3-(vcDb&e8JX3{(VGuHO`yEI%-@ELFCT+
z^uxKxXgZ`!TeA!xWWD`#-(i%0b=BU*r^MO-Y?=FYu~%WLbRDJ`XYSvhlq&pF8>^%h
z%)01V>kfOJbQt{2#NPKaTtWf66nl$m$4U9kY#_ujI`1rR6kcF2Z{
zTmaTUq=`<5F-(1KEfc3xGm#4FyHQ_Ryl8=)N=ofZq4sJm7(m&pY7A)?B$LsI3*d!8
zZOETh)yIa{2DSUOxLy)mW6E*K#lA4xf=`1eRH}q)RsS;PO?e>k%`evo&zf43&dO1*
zJ8P77*rRu#Ssec%70oUHkKo84%Hn|S*zunLz(tO>yM;L!jOrA)CG_qoo>
zclJ}D`rLPmO1|FNLcS?oS6%+rF0lhr{SU_aTx%&UN1X$;{UE6@?JqX|D`(5uij@-b
z3h#_yag);}b?+TWNLUiIHq;QMo~d*=N7r{!t^Zjwds(g(_Iv7&xhIO6kkvI*Uq7t1
zJCW#$7QoufwF5%a(?KT0`g)Fxe8;*RDije2#CEQmlY}gFvc=`A1W1Nn;!)MclBel1L+x*Th`?wi}Yj%ddYv$VwAict>o7Z_zvP0Tx(Eh6P$~i+n6*E
zV$e%9myj#7uC4ArK@|0HwEX@>iy^!mz#ru3XgT~vi>ACt9c1I^K^L3PTA?V;mZ0tn
ze7;$l-eMjLcr3QzMz>*K-LIbUf)pRVQR(WTfRYvnQLT)F9jj8oajnB9SWyZwo!J`d
zJYaxw>5ff}_yCIb?`CNtEl564f~17MSoKoYoEvi9f${-{AV@9
z;w&nNbvo?I-@vPU%RjJ6_T^=m63chJfgc=^E|F`FZ(In3=&p8sS<)MJ`Q?%&elH@S
z*y*$*RMr_n`Q){_%zPP}ge>W~ls@?+Mi;YuWoM-lsf5BEc#evSis1G{Vjft2anLTT*_C3BB>+2+}tB(Jq02hl-
zi|hEs1%qzXx9%ROLpqqO8SGKDayNaX{%|75)$H=PdQWHMl$?b{UmgMNvf7JS2oT|m
zvcr2#oj;0Ye>7Z(s(q08)}UAH;@Y(Jb?;!4m6=Y{w6Y>Yg(7fxQb3gK6Wq!3hm25zH?KM%5NTpV$>F549AkDf_a>r6+r5Yd3iND!SyY
zR;C8RGXg!pu0E+tYh~%xK&{>Sn}-(ymxF!%@bDN2cW|Thg2--9wzcnjQre)?D)ZXp
z2tsj4VbN^g`A^r@GhO8p4E$!-_3SbZ_IBp$WPq#6-spVF*Fv_|z1s@NuxPaqdE=1!7y>uC}od80<6bKj~tM&>cS|SjS
zvjPLhf(HAhiU@h$ZXEI0yaYs#U~b>lyZPrJPmg6~i_U#YGpU(6H{MlXTPgiK6l6CDXJvx+Kx^IP`4h#^VGHhV
ziMkg|RY_X&sz-rXuZSwoSGL`va?sfR<(V1lN&Eo&6WTUSA=shj*WoWfETUPIpeq)w
z3Ks@3p^T_gp
zi0gk;mdZJ;a-$oG#rYBcwvVo}YnBQg7;EuS#Cih<=5_MJW%~<#(}7;B$8w8h1+iC#
ztI4fXZQ1cNyl=Ne<>x7xc#INcq3%f)zZQBWZSR2Hr6vTcUYGD-!k;nPMFUBa_sdpz7Dxy(gZ$5tx`U8_Y(qDIyhi3;Zg?
zrTzj|gY!%!){v_A5Tb*8lWu5?vy1)h%Tf<5s-Xc~DeKo80YyZCQFH0SuM%*B)7RT+
zaG6*331M0xwTaz*#L*rMph__GjZwt)q0TAPr6WNnNV;QUsm+55eFLW)e0$nv=X)={
z38G{-b^F*`mia?c6~us$`JdzOE$gy|Oo2b%bewUEXm&))o>r_lXdY}tc3iL_pMf5z
zOt0f=3|=j9C)z0%1&AJ%P%c6hTGc)tgUW@kHk4@eIG=(ri>Xl8tiAWu%ceJUhi0TU
ziK{GgVc6q1iXIf*Pf44uXb*5i;%l06eP(bqC}Qi8S(w9r1REqsX24uz
z4`xJ`jim>Z@s_s`uGWGSof?bGsWNq|DubKUSR@*(Ao^aQ6Fc4FDRyP4V&qkVjydxC
zP^~|M&raKnub9AUS6+diZF7igNK@_y5+O-*kf2MX$-baa>SRE_;BYye-=+=w#Hoe0l)ixO36*WQ(f4mb|(e#miHz0ZtPvs49~Jb~kYKY=u+WM{DY&GuQS|)~c0d$C<}Sl{pea
z{RE)LQn(B_>$c?Cn(dQ21~L{vG8&pwK@G*Qc$8vqp;WMCNN_G5
zUul6}SzwlKU8|CsOs$*z>nLjRq=HPcRDbg45h#%1ba*`7H}F(D#i6q)rE-b#jU=dmP~~
zO)OT5#$n~;c_-N$W;pJo?eXwH5St?VJ>cPCk^TC#JIVSJ&m#NHKAgB8GL9E(#b7)U
zmx0v5ppse>c#!OT>G<-hh6>u6`(#U1b~geP`cN`*R%
zwSNCO>A1EiaH%ZANa0mr5u~5A_keC2^JL}7SVbFT#^j4yGPC>3DuBii
zlEDyC|27MUe}?T~oXQ})?_>Jf=yYaEJW+13$CsDHn15
zbIj6ssD30;$^6F)R==K;{%yfAD3?m^!Ky)m7`EwqSiL1DZnh&6;lE~h`I=_%t6-02
zQqS1INANhDo3fHmy4=bgpuh!Gy)QrQ%pebo?2DJg8BxA!iuR)}@xqe8$;xCV8n#u4d9Ggo>2;MN-AOLiQVw=iFoc6SCm3Hw@#iqo&g&KoQ?
z{9N{*oG%uO#+|+iQ5?EsZ}Q3=aH1yrmsw|6Tv+xDRaw5Viy%`p@FT$G)a0XV_tQ?;
zJb6jNvP0j8-?7
zo$<9Vpt|EEU5KeOiKdQA14nB!&Z%hD6F-w6}uZK2Vr=+Kgv;x~_^sO6Q$I
zAl~gu)xBWH)^AGeMP`&C7c=b0X!t^Fk0gS^PU1=M%;j1Nq5f@mS$7PoSjScFgY(L)
zy1Q0G%sKg-r+qKZ@KC(tcks$r((wJVYD{Cp{W77Pur@pWOLMKICV&(gMGT_a8RR43
zs{yn46OrB?Wv03uWvkBq==u2Jy^(Ezo&Jf4__xX*qD*C{hDuFh-;);ZmywIH?fYk}
zzYL}>Nq9a9sH}LIfZ@|kui4k;Qd$%7NtR_nJYe*Z7d{lBptU~pT=1of;LFJw@{~i5
z*%wO!*tH@Bjbj5-g`jukLw+=0R!a%MkE>xz9-HOc>GIBq1(GIp{1LsxDUku70C-!t
zsHO0*Q*!_;BR%nvH#p7BKJS8u6ziqtBm(8J_3a{;mpz%^i8BSXQoTekRZR&c^MLRe
zf8%(|j>w5gAJo90b1omQT8=u>pV);U<a_%$>7_QM$b1sGA!PB%~ZC-q9xN@0t77
zr70D?fe(**aSAIZWZids9lO(A$VE4+L?kFY0pJiEV;Q?>=ddy77?F(l~kz~&K%+)gV
zeS-oqC0C#2PI*}#ql(!4iIQCBksRpx?(Wx%Ew9z;vGIc(ML=bviy&`d&XT*f0KJS2
z`~!hNUnd{Q?lr9{f}K0{BLveP8eln~(^Ci0O7OG|brNA@4Bhj>)L>#LStIs6qV#PE
ziOsCJc^o&9W%mxsW`J0q8$e4Glb<9zD%mXB2x0y6%FCrrgGr-G12gmFrsz-0*6O~H
z+1EG#{SEo5*4(k<=(qFw6_u;VK&l~rPcL~{gvb=I48EP3-)rWO{Bd|SA#)Op;r$s^
z$&*c-5sc3X$+YY5D^_${r|^9REAmXwy#+_Bv!@~ZsJDZz=zg*4qFfSNFJ=!pI~V{#
zwz5?v`BlevH&mnuCHdYL%aX&dEh74c?aY7ZJIgZm7)q>`09@R<(U;k-Ej|JgM~ko|
zaxK|AA0H9AR3tSGH>w$Y4aTCQ%LB7@C8oXHjeSDuKgx2j+>tDkn1pyaxUH=?_wZQ_
z4R+M|S)6l~P8ynQ;4B2+Y_T&o;v1BxTpaZ&sWWkzE+VXTW3{Ew>4O8Sd2fF8G|d#O
z1M*T0*f1gb0}DJ+wE&y~3{BpM-6e1{T+cez_UY8eZ{r8AbY&I{wLa))UkOUgM#igzG-7>gjp7W4#V-WMgH0M%7oQTkFjc2T{
z8--eqB=Em_D{UV0skJR#G5zzUKYfKjjEzfE)=~e%5e|0X)n1{q8jo2s_@$9QUc_|#
zijmWh&1h?%)AM9B-2~?^DpQ=6<*EnuuE!n_P`zd6H_s;EQY9FBL?Wc}9PJbGhWG-uEpz$Z`o0~#X8kZW{goP%KNMyaTm9Bj}e^fw?UWg$rsustRhV~ub!VK6x
zMf3j|(;?ZR+G2O&Ec!+ZBkhn<{m`W&Ob%OSwoi!(8E>WAuj`j`jz;eUXP69XxXdPS
z^`QQ_*i!;YLoRK!H8aFxomJ<%w)mq)k7d;7f}Y;lW`%pM^X9Gb#J^tILT_sb48H!s
zNQgvV_H&ykPUdX{SEe2od`M6W-XNU)nlRK8qZ_erN~z|
z(y?Tt^1>y})&Vb4K=oI-uvup`^zi?eN)YPq_V{;@>kcB!JPEwt}f8?=eG
zTN_%IyhrZY%7V!~%TORjT#{yWa@&eVF48*Gf8Q3lrSu6587)Q_J&v)m+_9#ID{-NIdz#BZwl47oZkc}2yoI7
z@-uBAw9S{?Q9HvQL#5JD?C)5A>pLGy>S?94*>_B=Xcbi`Nvl1hM2{^h=-uSWPB$r~
z+gs2L3+RShAUT2NL%$U%eFB~MzCF6i|1kTfm9P7&x1w6gdZp~NRGF^Lsvz%Q~DFlT)*|H7qkhr
zA8CEc?4Nx~=C?jYxBu@}dH1(gnNM$(J+U6^1#t;kd`_*R8@>04W|xEsJmjKf0oYg?
z2A1Rn$jL7vl)s+Z*`1u8)9xl@KJp3magDHS_9lVT>_EO0Wm}JQd-`+0n3uNnoUUx;
z^gpcV?n>$Iw#lR1wOQY87VLDlw|Z#)Z0VMpDuO+dkOwSiW-$e{(;F!?z62Pq5B)ZE
zg&qW$<~b>Po_SmG5z0X{Kb!4}m5&C2LDqA|zB0ePuTXyd28TX_(fi!z!z3D6wOb@9
zSM?8UY@%Wm*ox$3sY!Z5R{xRS2Kt7wsmuADohgI;wJpsKW+COam$o%bz`jVH0W@S$
zJnVoW3oP>E3CSl~#|_$J%lTuYguPD(nJ8wqe{Nfl8r6!p6?s``C|mw*z^S-nOvf|-
z61I*=iivMzwZ1qkD-?I^(Q&og2c@{IZflvoy>?Ko={&X}`|+v2w*AE)vtg~emh<>j
ztbB~dGyQ`w>#lQuXvm9*=K#E_0*&t<3)@B{T4%l$D0zGeUj2uLK;!qumxkA$>m;6l
zopjKv*Pp+&EGcq!zmV2hgT@om0%G9;ji;Ji^k_rEQEyqTW9#20ma9KvjfybH4bwj;
zrDt_0>0D-_u*0p3XFrO#KB5J8*MmRqSO&Xb(_0m;Sa(C@ZKdZL&vqXM4E{bL)ueSx
z)B2#4oyX}|jc3;)&(i{}kQ5da>w5J#V>o`&%JBLT^Tg|!&xGwXOj$Lbl|=Txq77Mc
z-x6s2`Q(6?HOceJ
zqn*@!4L^VCZTm~Z3sLv}Vvv{RalAd2HumQh#~#Kb2QqOq1jswhF9E~rTZZ-jHY|C}
z{Xq-#@LDSk=#K;YH-U06#t!Z9@%M&*+M54|E1i_GGxww3Uh(L7$Vkzom;kW3ErX-g0
z$Nj~|#-K0O-Q0TE!}{S4(y!rcYz%4WXl+R&JiIyl;O+O@n!P|fbxG}Zs=U-SMlGj)
z6cFU4kq&ID&^ncdm!=5s;k$boTzPZR9xKs+Y;zUvJ>0mLk;simCVL!Y#if$|5enAf
zW66QrW9r##w>viV5UFDKFE7(f3@>FY{7t}y9tct+w848@#huT_%uTC?935`=4VHCA
z_Rucgxpy=|i?-=1Bia*8o6#m%x6{UUGB(wyzmFD4E}I&=I=#5$Wfkn?ki^)
z9r}yJM@RFY#lxR=Z!zS}e}YaS?ZcjtO{tFphedTxZt3f`+HEO$@Pk_-`zFKM%1MMxF)Lp-XYw?ug*CgOuwu;y*4>UV0JAyzDjx=y^@ECG6m)ou_E
zd{nG7qrOj#tP$9WGxQ9b(i=Cuzz0%_szGXu0(a1R?txj2fJ3(mjn2{Rd*gx7^P9Wa
z$Lga&O+50yL-hSFI{W@51HdGQjZz^K1SSmTg{djA+E?+jKT>dK)DsOFbKTfc?%$y)
z{F0GrpG(}v{$B>Z-*>PxL7>c0zhmcFNmg)wn*vK$;)3;oS!iqCzUj0T4A=i>$t{n|
zkwei_?}KUP+iYEzqLnZ014aR#7WAX@%CyC+_jfRD;$|H)XbUBMkwn|T(!dHA2F7W?
zwnXwDmYY1pC|kp9z#JF0tu3XH{rWt9%aS#xw6-w`qqRtHzg?)asuxL<7*5=y(ZjEs)qz4VQ;&uvv_1iW!6E5a-@Vh&*ygWS6s8bWJvLRc^;l++;(5#3ZZK$Rw
zV1<2iY1#qkJB@14XHE}SwSO$2@GXYsCF&f#Fzz)bq#hqnWBVN>F~wjOw4rOR=YCn^
zDW09-zb_EjAxuo!6sIb(8>&+?e)BgHJCw#_19je}fEkVR{NMyAYXG{nU(?b^TMpW)
zbYY``laCXxC}lO%4maE8r1~ij+GZm;42!xB-uvZToej+Gy2AeM5n7D)u#)Rs%$2kh
z($Qm$ZaHH-T+vQ>PR3KWTwF9^dMyr{@31;2@0^C?jz&85Iz-y(Uddo#C)p
z6@FOnO(RKqI2-+*Z(b#9+}!=Qq_V1V)B62$`OQuB_}o&;Vc56^A87pHzk?LdRtaj}
zXsQep|7$>_leXFTs$QY93&X3PhH2OvFDG^B)Eb#gNoD6k~JiG%QWsn4iAPmSS)dpq~Fy42*P(Tm4_ss2Tfr#X9{{
z8vkLip$xFbjxtg;_+dl0jQHuxZYskA-3?v)&nV0_mG`vA;#E%A1N4o1$%)v_W_~1K~H9wI~`^A(Z!RRd9d^sX$
zZC2D^dZvh|?2IP09vwmTeeJGWq3BZQ?a1k*HV9>rJSst*|43b|Dl%Ioc%we+pN1e_
z=vs|Hf(2Yj6)UTS!P8I315>x0DM??5+yDfKBv2!7@&5TF5JsigED`W^UPqAZf7B1N
zaP6bQvvt5lXb_(=l4?#Fok<8GOo)Z}P+3-|r?7G!(5uyy*=cIhfgqxBXL<;V(xs~$
zSh${CNky+tG;lyxwQKNH_u1gnnEa5Si@Hst4+P&VKy;fZH8(BCEkfS$wlx68#>zFn
z4lQ;f>+?y6R;T13OMA*Xk?)bDJ#Og)5(yUqaYg_1Ms^}Q-Vm=vCA2gzlq2xLL!#P1
z^M$o`=Cx9{7vsTfU#SxD=|Dm^^_{Q(%zaAd)8I8=NhO)`Ik0gFs51aQ8;{Sd!K-Yd
zFGngbDB6Ux&G1Qe*6{?p0wt7;PO+f1??8Kv3X-BKVKlb4jj9?grpRYY
zxuV(mFueL-qoti`(!7NNtATpPX`JZ00Hup1)??8@ar5D
zN}cajT(s&b|Cp-Gj+V8Ur94Q+6MgNvf)OeEq!Fzj39T3-wIEiK`eLoZqOQ$&%h-xn
z^_M3<4T!Id$oM14a@=WA(L?hIkAgd~d?E6RV2i<|b0_9BiOoN~uB6oh7YU>h2>{0t
z1{ifi$VmjmA~0HWwR;Yor#iCkMxF1W{;HFrmU%5F$@2YLMWI$2R!MGrm^_rI&YbVq
zjhVK<#Uxiq63=vbAoVqw*fw9XCI_8HDOid(hY`@=*rrOwKI$cW8fj#Hm@?vx8cJ_%
z>mF(RQle;{%RzfZuX$v`Q^beEV5mODX}z3OkiRC;%rd4=dpD$kFf`H;)T0Egtv-G11;KEMqb_wvYY??Bv}s#sKwh$8N^JC({YW0Mbl%
zW8kQT!pM~nSdk?c14X;#={=ezun9{Z#^FK8
f={?+LFuW-@%fGzA^l7IKn8REl0{ib;(7pXXQ((yi
delta 14916
zcmaib2{@E(`+mE$P$H(GJ##hN<7&1aysou#7ss}3
z+xBjI`1jv04}Lrhei^-rd9KL39UR@UZQEgFttkia>?PW+UgFSGsNj;5RzC93)6q-D
z-a;}QcK0W*T}3r?ul(IVGDgfU4P)<84Udnbxi>_2I@>B$dg4D??l*VtPGmMIcXYYv
zn(*Q;)>mquE$S}AZK{rPCHv_nyhyfSJ(b~lP5RaK9lPas>Ol@84`+@&b%j=QZ_{M^
zdGSf@#oNHA&oaS3+?L>XAEb{-7V2e9Q{Ra{H*skA>_b~sh}1P^zs|+1VQ{uNjp@-h
zLtWXAZ^9fy#hOFS!tlVZ>%pZ@N1JP9%j95e3
zU-zw|iba)?^H$QT+~vcf6Oq_M;t#VzV(^zgdUKGtbjZ`I#Y~QVgemTSFjm04{g0m{qY`s5{bbnjJEfSLCKcivVEBnL@8mTdBuS*C0f(
zF)C3pYktzY5^F2veRGr{ClA)~;Yvlm(;0L0id?Mc(9gd2hDsUUZ9^X8;uGyEy6ya7
zH4PbqvQoKD%2=WyQp=g5S0)aLaWSqMfHjTQ>!K`RSkg){Ik$|~MqLSak0pgQ0sYtL
zABs?txi=hvhU%!g)sCj~LKNIrm^F@_mhA^G$W0omL|9XjF_7ir<3?o3=^*$q9?BZ5
zq{>%9e5L1}F_u%8+DabsrIhf8*PODFGHW#qp0bi{qLri?Uh-0zlWe|U-pkqX8I?
zajgphceF9NxcNqpE(hEc=YV56&0PoTt3(@`weA=HIX@1Wr&Pu*YAGOQ4|3l~Smc(a
zJ#O*N$#3l|ryt10Yh=WKt{b`OyGEQ`Y8}&8YSPic&h?PhU8JJp6d{X$!`f2X7v9FJ
zOtUO*o9!CE=V>GBy-Y{LbTeGod;uZI+Q4*s3=9fw6S?DEWm`Pci#^J+V3U7H`onS6
z?;pMQ9%3~5wo%=8_`L}cKn@dhKYB2
z)YGPnB}9`3zthgP_T;|qVDgu`&1=LHcg_!7@2Kdl+C~#oks?yUM
z^@X7-&Py^GuOA;26ko$~*G>%I)@Svdbz2o#ReHNd&u^KblHi_clpi=9iV5bC=GshtIk)KWu>sdqAA3y`?
za#iB((dRNoa+aFD(nm)pOA-AJ?rY1_Sl`8%`t0UY3aCAvPOSQLQ1$8j}fw&cap)ens
zzqoO+=Q5_mv$7)6f3CZ_v#h_M4R|`0G+#7`?Q<<1AM>wITf?4dG+UX;P4yzQd|304
z3JLEJ!0@(@(lQ6WdjRJX5nfqLBfgT!IV(S{kBTl@pE}*xG%{nHCj-!=ynQTL
zgVa}l{=J>ndgATr^eZo9K0Jg#9cYa-U%i0=N1I@jSDw)zN3}|Y5!xCR=iviwgTQTN
zryPrYc3gb5w{TmPMlHXT@RGFfp={2sCZL`1;{T4WsKE-np!JovpVNrSHi;L*iBvQ~^4t-jDBu3tJ$
zYN-5HKRTINnQdloNlz;+jZuu6&SrmNXZK==(2LY<9E0kPk3Epiz3cI+YPn`55J&5#
zCifY(VIme)onvawzl~eo7EZK1Le?U0&}RPn+^)L>T|vavpqx8V$#H*3v7
zB~VFNvS-q%+ur$mz(?&rjW72
zvZ(h^Z1qCZD4)4a*zS>gmxr(=^cbBhg^djv%>jQc*q%T6d9_3L3R3#eUqJI`aO~pY
z``f*dFAsL-bX-}yG3WY}ZC)+*#gxWrgPtnGFRxRqp)X)s8Y2&+oVzx{~b{=7_i)W&$3*g0G@>J
z8_Scn;bN*tNz9gSYE!T10!USTd2M+so=F!HliQLU>9yKM{waOqgeL?k`i+_p`6_t|
zHlS}invxJUGFAQ-vc+uY16$B^C?LXQ(|0`Xvhv9@qCVWO)i~!QR3Y639%eLW$LEOhR(>p
z7k&Xaif>zHhjs=B|LbHz+=
z2?bIDwoFu6$*fb54?N+vsEtQSfx!*Y3GT_CUxu70GY^3`*9%Y41R7ks4_gGO?~QmR
zUW4CzINCb5(B{!J#f^HeotV^SSRxh5suM(Dd9ddC(>;PZWmI=#81EhPvrW#2{I-rh
zNV>T28fWg28P0EQCN(r$M+jU4YfQs2uJ!?cE)D(
z_&8GDRVV|-MK<@`lf3*W)+#E>u+I4w+@p*U3mx}hCx|e=R!)e|tz_A7zP^zzq&#~v
zM`xhLa1w0d>g?qr7LNEpjM?>)@Elx5JGb+t5AU%(Wfx*koMTwOBt(Wu!sp;AF^G&sS4S$C}fOsmV
zDVQXW-bZN&bn>W26dSYSXy;S=)U-O2M=Ni@6a3*k8ed|DWSZQ3;Bu`+>OKYdd2$}kbr?x|91nkF2RA6O
z209+&BOUdU!qK+bO5=G=WKKQo1Vmg{)KJ;s7V$Gt7L!=)Rf9e@SX>#&?V~z-;fw=H
z-ql4I4d2hLRhh?LXXW8JmF{b;s)Fj$At$8ohZsn6vz^kr4dC;M}JgkyaN4j8i%`QBKfHPVl7=hnNPS86O%SVGUmG0ualldYvdT
zsVYvpEiJ?IMEbUATTtc%i08Ph+qoj$*Hq=y3VI
z^2a={cL;y?@FK^NvY)GI05PCVFDqNk{j?W7b}q!z>fN(#c}mdpFlYE#@rBfxlDV$2
zY4?|AUGB=J1R;m`y<jZM5=5cCws)1g<%{2KjE
z*J9VM=HI$cuc#SvI7+S&e}L9IIU)8I%r%!Va-}@ZG(I|Dm;D-
z2VU($ELQ=w_XeNEjxK*CDK(vykjIFyR}49HbrOTEgW
z8udIb!|fc~_x%NEgTeZ~^y}kex+*p*v}L><+azGxT8I&bR7sujx%&O6dv&(AQh^kT
z%#XV07hhS@6tY;?FkF%qGo7^b*$0ByjvYDfkN1H%f-SGVLZj2&z7BgWqDa+;vglr2
zI_T633GO5f2G>;xw~S9&D`BF$3?`{kx-3z+QV-<1@}|u~`YSlWt6hl0izMs<&@pG3
zmm6-8rW8U@^#3*?o*}<0YMQu=mgp$T_{*mNaM%auLCD1mWXZc5R<-^3OG!>QH!L%q
z858YdcN6Nn#0wiUDZXXOF9XX`=K3}?mbL6zf=LLQ7^PXU^=a+Q%@X9cfcEi(Wkal=
zHxYhR(dJ!NZM;7Cq#=e#9B(MV3#??NgG$Muy~?+pcRS9sbc#_WF!$3jP9N#bVKAR#
zp3ubjYu%P!OD77+AC%IvAD^#$Wt@2Vo1u*3e$VrIx{#QxnA*ZK0t-gEwEL*}()e3x
z?^Y_2s|zpA;6;Y&AU-}$UMs6U5dIamV3366
zABSJ;y&A-MBx^s~u}AqxqSh(W5#q_ja#Iqek&0NZeo@msa_Sm&79)&)(0j(V-?}qE
zS_27gI!`s?PuV|Hu1oYNsWf()hTZbOU{K3#$wM5A(B4+`yV!Fi*+!aXLMo@6#zqbz
z%);VRW56p=fWR9)31=f!jD)Q*r7p8Rmf7Bk_X+MG
z!m{DBdCgFYdI9H=p0py)m+h8_dy*A|bj_y@GkR5yT}g>SwSD1UU964NIf?tK&;(@Y
zva5>LG|nM?P8P=LPZCYo{!PSjAi6P=q$w6YMeZ!zliXP2p?TEb|u;u4=EMCcU;akC4I>xw5KD{Pwkk}$%*-f
z2?K#As*cs2{^rO!NiMoz1I=_d
zL$FCL@Hp~Sh+W}$=UwIRos${%e6f;lrFlp9Gwy*L7co#iy9DVIm^*IQEB%)>bqd`z
zUf4pDYEL65#IrVg8ZTlpyKSdu%xzI
zcTr)LG*b-`tdUy@uo*KrI(B-#Hcc*u@V#{uwQ_`LPBVc{6sW&?vUE*&aNljO@{D7{
zj&R727;Vb>u2p`9v1@fHfxDJj^tqA}ybpjVNc2jR-#*j^`-YDK^t>A#H*g)nwA;*Y`Dml`h&_s(QNTPG(JsD);@&x|GGX<;ns>3!)(&drmz2oc?0YP5pvL
z9~{)G|2m;_!w~ygsldhXYI~Y-t%D7hBEo4fOm@Zbd$$$g2~o?*oswa9MIj3J4&7!u
zcok<6W8K>|{2Is{cMyM7x`60W7rHyq-~&mA`jYoJNyUu-L~fx;4%m;2&FO|t!$Ku^
z45qQWrc7jC7jFlRi1r>`hH%6AZt2jLUCSdqbSnLKs)49i6er$N<*n#O*zCJweum*7zr#bQq1DA>W3
zMW>2V)KD<>C^q6D<7iriXytY@eC+Qb_-YpxD5_vnu7MfYUr9FH@8Ho$y+k9H_q
z2c5q1LCce1v50Mk6}ewLz})}-R#X1mOrCOm_AP^3TKf2%4v1lTMzDMo0_r!oYJX1`
zex|uAaZn(Cl-i8Cl(%*d+wMg;7=cUu>V6w+^aQ?e^v#xuaH9*39yl2krMoO~Zh{jC
z_iM+GQ@L_Nf$n2JuFc*ic3D5k0Bf(~E%ch-JN|ntHH%$_J4?k?j*|RBCW>HfEV{eH-1k&)^w>-H8kkkSsfu*=&Nr0C
z+s^t;M8E4l;yJPCCn8mr9jN&Us}eVp565UGiMnq|f=@Kx2KRW&f%Ovtt&@1|$t?NOdxepDTQI~gj%2O7~g*+z0C0}uVP4p+Gr
z>nk-sFCEWKe>P}9#$wIX&kv1V>ht-EEB~4?)n2=gpq7*93%lw`OtBVMY0tnm$z!yh
zTK77-&t=)1V?|HpV}n*MO*`Ha`GjK4sVLBZ*Wxp|ckyOnhL|q(TB|ladC*nq6%z{K
zuaR>l-FZ*ae~YWsU65=V1bDuji~4Zpn)?7Ag&uF-9+Lo^TPiy*|04p<8k3O1*o+v1
zC924JyIa^nT^l^AC~i-ia669v35r=XmtBYvSz9DIoy(afz)B#Dd5qJj3s=$DK)v9E
z(BIHcIxMg(`#BUVS~X$LWayY4Vmp8s;75^nk`b70z;MP9Ut^ye(f1JIEpMf-Xh6R9
zetJ+;Cu7tPnyUkxoeolHSj{Vhe01w@R(4CeN?2SfyOn&unx}&%P
zB@JQ(TRS68SC&FeFHU_O9&JxB|E|$$cHF@*URk_Oxn~-N$+7TV&gQbB?c`d}fx4;t
zW4(fb#N+5#NA%Cxvadzs7+y-GIi=yL6}F9`oR0WA68#~
zk94}FxRzw=IIyI2bP-#t?t_3E$Ls13Zu^4gz_Y)d@UbIMJ}89`_LRu+O}W(*ISrC_
zI0sfx8np(TQGxzi12-5)ERF!J0pr?TR(^65Lt-sxv`dAwDb_cy+z9nZn*4(}RUDf;
zok1BvOwfpn=@(5#!rll@>OM+|F7+vG;1!&y_6$OZtM;v>`l$|$1vMRAghZsdz5zRRE%$jyv<^N%fEA+?%aLgO#AFaR3lH&CwxxGL733u%j^T^=r-7YS#q3XFuc&LmJvF><9
zhEulujNZZ?LN42Pc{H)riFkr=v$Xm+AVOR@_Y9w{WC9HZn?v<+MsvtL2OPy(7__CQ
zC(fYH6_qW(z6BGBXm?rh5)TS@ms!AmwF{vA`qKbYyY3Y`)?ULD@O)Nx$-WQ!MQC7V
zDRX(8ymDc|^Lum?$?=VN(o9ytsq3Y!ML<=h(fhACFTKl3->jV2MvXUga;uU(u<*Bj
zX`=X>~chv`WO6LaKkxN
zEJ*ch#JorM4SNSA6U$&WPiXb0MX$h{(=AV3Yg0^}726tA7W{y{8P)v#yQviPw3D>T
zs8n9fr|W~qUA>RFm-&>}Bys2xcN9!W!KqjZYr3gYp^BH@;JzC&X}AFI{-_CxJ6~Us
z$Bym-)gt}YbC+H0;qk1?c5_`MMA1mqR5~8MaIK;^BTxlxwsI}%j=t{MWcKGcr#al0
z!J1vyck`mB?>PZ2$Pe@Qd)C31)@G-(5Nn7cmayEiRj!|fz@f5#pvLb#jm^)z{Z
zOGBb}VY058VtPkf&No=Mhb6+!4x_}MOQjFOYG5y9+`6`9CRI#BU`P+SqK5Mp20E?|j
za<4KVT1}7M!Y^Z#hRNaQo1TxV`)R|!XHpP;`W~6_N{GS|5;0p5N4zKcIGNr=apzb`LN56?-4&ymSJdYCEkXbb6uXsF&3~zdo!twDJ@?qf%!&>z~C4
z#d%l_k5|U#IQ6y?(djF*p@0v0&6iu>n}SU=bczlp>Q|DR8HVf6Ys9aJRn9*c7S#M<
zYV0X|nhhu^F_$GjH8s2%9FYC0lOWjm+GxK4UwdQ5Xezn|@9=@%^IdNN6Q4mJ^|!5-
z)BEBde4T;7>@Wkt*{}5mfeZu&BSac;@cnW`{2mLSya;lO3ZdIshq;nR+{+hf7UhxL
zfJs!qdeOm1Zw&(Zax^b9SBeDhs8BI<^Yx``R`;#l^i{~Nhx@schV**r?OH`gKP+p!
zoQl-Fb2Ro~GHp)h=i-;8k&FRv$)t*mo+O>4Xz`0Z6w~jmp}3Fz?V~;AKgcAS9)fBD
zP#~`cI==LkUku6?cEL9_txS9bFW+~O+^jisqh_o
z9KrYUtnXXAq~vZ}0DZ)dZ(q$mhL}zSGPJ}rIjnFsvaKSYr4t3CEe|?47l_%2aF3#4
zt8YZxYMj2|F%>?rat`2hZM_@tVx8)>aHY^YO!D<^FNA6dEee$#v|aE8J?&znk{Z^z
zexK^?Q;j*MxgGDP9b7p>`neC|jiVaGsYM=!x%ceMuuf~uNz9O%+jHJ4c6Q+oi@Y+d
zUJ@A&6-|g`dmj`vE$%>ka_GEp&GvIHz)}h!*L;g@!#;SzY@n6JtR-=64|We7Fr0aPuRug(iNuLncB!~M
z^iFoM1V)>jN{=1V1s|^%+*rboEZ(AbNQ2h=>n(^&eCnLE8$ktJ?hF{b%jl
z&%Q<;F!XuF*gXy3f5~qT+ftv-&?JRQkA;`*j_yqI;;@7
zNY1v(OU>(NNof9!UUq9wrR~3iPFw;J?lg~dxN?H<%PYWrWU^hNQ;qq$YUEzQD;n0G
zfGoJ$DGou@jg_S>W}2^9#YwfD|BVg17#z_qK~inD=8&w~bh(yH<2!O2E%`xpYcZT>
zxPYcY)6-poD7~|@e=NoWZ$6+vp$tIpI
z)?euen`F`ipREZUOXr8Th+tojZ4okW$+)$Zil+IUf{B(Zl1&@KTWQc#!NvN$+9h;C
z^C?@(DLCk)Q$C%4w@@GG0y!;w3~(;&IK1!4F?A7DbBWQ5n~Jdd4V8h^nn!4oM~WrV
zA?z5_uLQTq;bNVCuMCFP$uR6=7;Ysu%DGK)^x`jKV(+y{HeYPU#ol|h8AY4Q+f$Zd
z8hd_+QE3t8wOdoRsdC4LKF!RJrpyKH#vS=3r5)sbk*<$GqvDU1JCLR#TmX2}wnFCh
zy;#G-laU9=`#7F~r@j~meX~5!VoM4}cg-F#9-wPJ_iB91_S{2Ae!Wh#WY6Z_25)T%
zOH?B2_T96OBE%%3E^dk{_C{vI4n5{y8F`esOSAl={tiK7hGB}(&5hc)8Mr&0?Keuj
zK(N}(C8F-D2^|2(8LeHs?XA8AWAHD@
zUkQyaeZF1L)Z)&=2r)^qEw=J+*w(Uj?f3;c(003Kc|+kgL1TvD`cV{YB%O~1(|7+O
zE28r;|3=S|PzU)s27=$Gwhtt%?=6pcp!^P`xu__RV}4O1CRXCrJx07PTRE=#(D3wE
zxf_ijjtfn)6);6Q1cJP76+sJMbga_v*eZ2*f~XlemfXs*VSW#onrDBcrp}F3XmTGp
z=$6?zbu)8NI=~k6xu7F|s4-|RXbXBX1N!M>TlIO$^4V`;=QGyZ5UKM!p(s!PUrd}2
zI|7!?R-fDlR*&m5u*{0VlG|}c94xNq4`Q0zX;eWwwm&hbbinu*pnQdfgNYdpQg&K
zKUxdJzLR0t$1q%P0N#Se;hHMn{xGs<7|AelO?Y&4R3AqE{u{|>6ls%Y{PyEOb31J2oDZmq
zSWX#X<^R2ALlbDVAW6U2>>Hx;TcfMPpogvcTjByX!&_yveb8>R?a%s$gN`;^!w3V@
zdbbKz@jVfJU-S7a(`LW20}a<3Kk~r&W4plqMMH{7N=t6;5sXc9e&bmigW07&*jEOL
z&ty!+S+0NqBO@eXfMNb5@$FKIcdUtY`a|J+L9rI;se-RvwKFk4T1Og>7zX
z-%0(OS-tT@PyO4cTmcf#v=8gGMHZflK4f{g;q#jbLe^;kQd^-ds_Kc5Muvp6s+
zD-?C;370yEGst|4M9Fm$KW~r-Y_NE2oyE3w77s93T+ou^jcM1GPyBn|7DABW$nt~x
z1TVMnFoPd)8yq@MwncUwOZ}C)JRP3ezpTPi6`XfHStm~+H27{hIJWy2#}&ubC5T`I
zBkvW$fK)b@O+&V@e;W#p?X_+>eBdSy3{+j>>PDcY8)F}T^AWbbKIrrRSjufAVYe{+
zR8JuM=qX03x@}F`&yOeU288c!rSu)Uzwp&KflM8q^uN}#q%&FBDci~M%^a5!>PHDXe(R7kQq>E^0guZH++KbJU
z^3Ymt(%f^${P$werjYA31i*T#Z7hamcZ>B
zT5DmO`-9{st6d`Pd)EyBum!GL?7i)L=wYPPdOdTEK7M$FY5Q*knOpMT5c_t+fdqlgR=Ca)Q}qZ7&#wsFeu$7hzTA{PBY@JKP-mvF^#E?x
zaN(VKm*N#4{6={F09b|K$1ebna?5st0FXE(u|1jQeoc{5$R(va)?y$M7M?AXn?@Tu
z4+A8NFPc~G7fAfa-hoH|0*U(vNc;Z)31@%=T?sH{LJt5YOeEw*B|ftb+mr~8OV6P%&UhqRJn7eQV`6~BZ1A-Dg5VJ2oQzKX{5Z01^+_O@L<@~
z$87)R#=BdE##<%2M-TVYN;1|3`Q)OIl4RD-T)r!fA6XJMjs=YT5F^gJ?T
zO|iJk)V{H~OkF*@$NdMWTzd68ZT&7CA}{3D+ALZaL1S&?jC}lc!
zqosu`y^|UlXgK*>f`=zgySH2u-OT>sWREKeiUz+G1}>ecQ>Lc|)(8L|nj}VoK?jOK
ze>%W?jZQs0;m)y6qChnvM2?d1yU1)C$|e$AIs!L}@NR>m(nO?>&OaQ$b;>3-4-^t3
ziAnGlr88TtkU=6zK4Sn5Zi32;Udc79(;+{e#J<&&-9Y{*33?=XPzvD2J{4ZtJ1MUO
zUj8bgx&Q%i7d@{Mktm2z~JS8t<%9iE;~;QKe?`O=BY-~>hFW7U(p
z*S#b6U9wP~3SWBH1#bs${`V9yGUVNU?BA<7XfUF9iL}4Wy{r3VwI$N_vdJC>X-VwJ
zeU}wZ%a4Kqt)FuL`}_oF27gGc%L2-oDkEf&0dVGT214Y(?S#vDvkM4dC*>zV$bY6d
zsX&mChs((KYTUc@f|tUO*=i=p>sqWx12xIh6A55KHfrF%PKLLG328@$s-04z2Z$>u
zO+5ZHff6HNA2)B<;Qx4tXU2rdgO0#I1>)1b8SC^F?%jWjjVPugNmq=SwpavWXi{%>LQ{tsbnG%!%RGXDl{vM!fG%?-JjX@YWz
z|A$=uV@WuAT`tj@r%uxYsEJ8k{~xg;kV+c-kc^IhGlH-?JS4es_GMK4B>Z2w)JX<$
zAlm&6wVf?9~zmU@L;=AE7OGr4p~SP@JX2(@Ns{h;Wa)Yev|RQ%}&^im12|
zYcue^nT-^m6E3YA<%OVMkB<3J$}t2OUoZ`Wc~G^y;uBhY3Tk^GD%wN^lZwPq^NI>W
zn7_r^qNlgextPIW+SqFD$|F4N&C0n6Du43g_}JWJ-YO}34(M&t^HN4l_{w-)AckcO
zj(2%L<1Ao6)tWhV(9oT08eN>U*hm3Z!Xfyz0VsVgd0HG;4u{Z_YY>AiCAs*}u>Pff
zN8f$iYf~c5nB2w=52B?wVZuz;f?T74=$Kt7xxZ$tJ-1DC0JTctPbpbjOtbv){{Eq(
zz!#yVq04~VoEHtfyfjRkm=lN9%opgwW(%mmXB%j4bs%bI-GYbBn&ruvL8ub2vaq71
zLL-#T+4s}ea2c#n-*L#e-&%bc#ZkIoWj61^k(iXYfEGaM2z7$ZE74;)%3G8bYDycc
z6KPW+?<*jQjO7mbe%;@uOx{5z?XN`iPfvRQR74r=P4BESSs@t9ByV<_zqO0xM|qYj
zP2)}eDaHS@wOS^La_#n-p{UB*xr{Zf>AC*a)#QWJ`L&=U{c
zMSj1#gd6z0{B7uy-)Bvv3!8`RT`+7o^DH}y36mkc8>}rMxow^EuC6?iF5P70ilU!
zP@`SLH#y(v4nDcFkbF!UCU=3CzkXDliJFwHviiW&x4cqHO$Zx93jaFkdcke&Hi6Ov
zrI(Adti4OGS&<@oOtiuur4Ipyp`VtA=%cx7!w5_IP-l-#zwgHh%Hjy?1OUE(CY`&O
zBUd#P$66#ljkYOASh;`bBGLR8lf|2wrjpz8C?wA^9{zrSdi^M7?%o>O*M}6|6ikij
zU3dTt^45j!$;M~zs=69d$Tv=-mZ%D-@M8*w2u=zGU-dlxkID6S)+a+RD=U
z+gjG~YuRJEm^%kzikcE}~!|^L&|*
z^|r!glixXS;7Qj1wqVEkBq#Uc>^YAV?e6kL>+So&XK?njX_&x{CykGV1#Zrq;pd^5
zw&ZWwUycb(&iq^@A7-Sm)W>gPob$yjCgFAlRtniq1BWyNT{L8Cb{)IElJff;2qnmSS^XE7ln{ED?zQtYvegd&u
zQ_gmYYQMMhUvu;i>x!N?+wRsM5t=9ycq!-x8W
z(Q>>0F`|UhW)7wUY|OxL+I*VhkvEvJA;g3Q%y=FlzzSka{uTQSEbut)93xm@OTtUA
zz=A}7h`^^LYj|K!Hcd7MtIAKd1JfIlox$`sC~cEs0p^#dm_g)Itibf!6jv~9n(6@n
DIX%j}
delta 465
zcmex+it+C$M&1B#W)=|!1_lm>Mn}hqyazadROD4R*Mx~z0gA>(P_9t9SGXUv}!BHS=%Tk!hC-Gi~=&ygrc3omhBf
zE@#ZH+#-jPITIB47r35CI^MxbjI$
zN&G%(1}~u(4$TK0B95J?H|>5<`lC3ZVA&JHEy1ha|6Zft7L#-2MD^c4R#W_=g##ow
zJwvrlE@f}L7Vd9$U{POgukOj-xW3o*ECJm+S{|P~XtvWL|L9-m&oe?S&qjJh&RQ?E
z?b*>TeRKKrYdQb8u7qvf{muT7QL2fP^sa|G&rS9##xaCS>R<0{_^NSd?lZCbKXdtS
z{kd_~93_-Cb1)rXV+MxP=F=RHyupkOAto$f#`6dPRuE(Iuh?f`fyZ&@7{LNt5?+D@
z79{#Z1U@BM!vlM=X|g$3RerJ^nBI`=45q(9X`2)aFuy#-3?iRm1*YGoxPocZR1W~P
C5yy1^
diff --git a/spreadsheet/macrofree/appservicewebapps_sg_checklist.ko.xlsx b/spreadsheet/macrofree/appservicewebapps_sg_checklist.ko.xlsx
index db6db12543c1339563719b49f4a55ad117ad6a90..814f3d8ebb81b3a8b9a6e3add9a911b8514c5715 100644
GIT binary patch
delta 16918
zcmcJ1cT`i|x2+XH6i|ANAksvNh;*VLO`0N7lwL)o_Y#gGMd=cy7f}QiBoqatN(ZF~
zNDU!EkQPGkf#jW_pnl)|-FwFy@A1bbCwuL=*P3gtwNH|fOf>FCH|{@vP5s~@x_$fh
zk?*_k?&g!@pD4h8hN!J~QAeNjo&g%xh13gEuLWTgZ~O9z)7`x@rKy@+|84WKj?3ce
zO{1pAcF&)O+t^g2tk0S!icp!P7JOGYA}{sY#E)l&2Ni0@+-Nd$*(JRpC~CY{vO#gH
zjJ?>%e}VmbN{qN3P3hPJ3@yz-VuF?`zfI=0=QerF0Y&Pg?(+#Ybf$&-Qx+uvN@ZIu
z4u6U45cB2`i`It6e1tnD!;K@?vti$FUAm>OBQkRT2xi(A!)Z7Aeo%M)Dk5vO`am=H
zMe~t6=J2%Cwb79R*i~%G7~P4m#hdDVxdsJ`vrF~2zM0HQIjZAJ%G0_Rok}@?{om(uEPYM
zBR>XAjv&rsQ95UCW@&C6VQadnb?`vMwaKc5;Yx&*7@MC!p|T81LrcIW<;h8&ud>jS
zVzH~5Y;B5xR*?Mij>|7Mw&$p$0pdK?am{_D13g@YpPxVkz4wJ|akZvr@6$%t=i03NwYKJBN{@#HMQO)xQI
zsO%ODXij%r3!O5>ILBbmQkFiUF=+slaUi5Vi=X>Bfq=t#6uotgPablrWjrMSYl3nB0BWZw&L=+_wxWvi}$0kF`5kt!+fC^GmD~K
z3ruf-2*Jwrp?m(0JQV?KJcd=7{7Va`Hd-#ng}!8pzMc}aJbL5d2f6HC0vyxufPCn&
zkE;zC)@hOZaku|v!2^DG$#^GhfP`?~Qke)jnTPQ1BJalJ0^U2$z9I4xZT;{Il2UaH
zhnmvNYbdz@*0ScT>+=2~PN7;8U!OcfX5*;QQ2DKZ6>snMDz~HEPEnAS6$2RBrwI5O
zz5P=D*tZVo7<`G;zCTJA>d2l*3<0
zvt5w4qg(f*01zS7p}d;(H*VBCNb0WcxHaF;)-v*dHydO6eeUi$-tOth9D>$&V*Wte
z6o9s!ll7RB4fdh}^!Y2?*8Pq**?pf&9+@+ru44_1xB~}wuouLUV-5`&uK>Iy
zx4iJH(X}pbDbvl?qEVRb?&=`hs;YUQH5=F6L|wZyO_{zmQX=mZ6B0A7kixOaIY~gF
z9?pMDZ-=fxA$TTqHD1ZvMn+cb(a4(>%<48mpE!Y;y?*y)wTbU4ar+HjS}}7PLsxge
zFlrg|ZoXcEG3_-+ea*-6WnVnEx_4UDas?he9IkzVF|B_~66l&KPm6wOwh6Q)QmD&U
zTypMGKlz$DrRo(_<4ChUk)z2xfjHGu&FgZ42iU~)5Qt~4_Y=>w2Xdi^68yalgleTB
zq95_Thsg{i=F0V0El7egc7-s9y+{XTc+x0oeT~=Fi(Xqk+16ZUnf^ef(&10m?(f@L$i+7
zibyW?;zX%BRCy!I0ad0~fONon!UODL<)&?8aV_Qc^(Mx5Kqod}hC9k0#qymr6Sc}iZE
zt36a@^_<;7@w93{?wFH=LAn(1sx#X6Vc$mLsj(?wp?7KWl
zIaESsd{D`_hRu=>?M*5nUGc9%E!G*7TwK?k0w%NZ?Zo+1sOJGJ7e_Q5vg%@FGz|SU
zn?w4tUoOVLs+v_v{({ca2-DRObklGb?2`R~4n;uMnSG?{@-4LG+%f`)0Fw
z@q5s)gz||dOml#@%r;)Yrp<0bdPX5BiCzTk~Aj0YeOGwV*#oDF&4L-~Z7xXwt
zD9U05F057vRgJknH2J`Pr|j}qh6|`u{d5!AtQ!}biv;`g79DhQM`t`s1bSN>pUrk*
z1uMe4UKpr%M+RoG9!mN|E|TmxBOGm%<}?F2qb+&un^6#d6K7f7n&YHS)akK#7#`CT
z4d9Uw6Zbf3A9bh$Q#MPeY+HcKs>-dkY$7BZm@-FuM4C>{Z+%x?N`||6wggSkHW8~}
z^I{s&*lKHJa9QH#{=mA{vCPBS+loxqQy0jZG{iVU>O@DNo=q3i)s3xBJu-Ssn6<;G^4&sG5?ss(+-Zu+(?gZ5Pd_8$nKCd%Pere
z3z!Tf){k*}b}rgR2CPSkg-cQ>C#1i3i3t{2VG4=s&e(oG(#2TaC^>G6QEe{@`PMEl
zQIsqOkz`Ba(H3ubE}?V(+sx^HJN0QFCc2W}ED(uP)pfn!@*HW$t6ssXr#jXs*$a730&h%N%vEfc(kS
z@4U8cqZ!)X$?6kRlGc9gxz%GD?4~8mN(nhH->=@uF7h~=&FJ>-tH0bp9-PY*{jS%m
z6D2_9RNJ$fm;RC0&b>0K5O*=sDRX0UtF)U!CQMm0wsm5r=7p5seK*gO;_>lq1Fxpm
zM(T;aOm`049%JOWVM=`i?h?eD%?E@oSh{|O@QSXogyU*M?AomshrO&ZYj$0xW8F2|
z&eGcHCmI$irs-5LuZ~x&ik(%}@a>n3YOI24g%G4#an|q5^zJhaqd&?6=k>$FbZ3f%
zO(yd_ngU|!7$$E0kn}2H_eV$B4yQ|YRyhk)=A(>`PYyJcev7jVvpjn|GzzFB*s~QD
za`kMgA30cK?-Bt|iM|pw-=emo3!jI!N{ce$ue@YZ8&`BHy)${-W%A5*
zH=n7mez7dA+G#D9ynH)tHNFph>Vk@;r_NnGUb@c0>od*`B@c}dqP9T;XQ0*|skj0K
z4_CFj3##rJ*1`cViXH~~0i9zty=p+owi2I>Vn(VICNW8
ziYAVLDm#c0!lt`4{Of${S8TBne9`3|x(wKxR>OE3qcubOC
zXzrcP82XVIr5EFii}wm1gx4nTbWi6ZynP;dz!RZ{*YEmcKegQ(z5@JYci3p^{Ytn4X!9Ko$vc)9kv@
zFPPd4PP_r{?D_3cz^*>HX#3+tFl!324ByuS;GDAQlxf#IS{}L#o2xvL%+Go`}>S*02bT6(xH}~`_b$QcVr^f
z2JoX#pG3PZoRxKVFVc?)w|afJ|CvYA`G?g}ubK4Bw3jgJlIzuGS9!J6@96qQN<4t2
z*-=zFiiKS`$7zS_46>tWX*{Z_K0E8^7`yIUKAl{d9(T_P)8p}EIM>l@9l+4`(
z-bD0nO#n$#`l!{YFR@$OMF4|qt$9rYwc>ses~Hh0VR&~cdi*5
zNLRnZI3t=3%-DDs@Ebwy)#{Mxkx!k{=|_Ti%ou50zM2`BI$xEuVDUlsV637Q+B4<2SD1$K=142b^bu?vc5MA7
z5V@8HORGvV0o&#@R_&JGg$xAmfI&tT!IPaAi$wZAn^}dy3Xkg}jg#IjPI@w0mA{CN
z^{)ZWH&&(XlrK2@8ljz!;Jxl91(?=Bv>p9e&Sq=`s3FxNuP1%yK*Y$pxyrQ|)Gkzg
z^f8>`_PbSR)sgJ)r;^Y3EX1Cp$!W;_ME_U&)yIai8v?7LY}sA2XJ+(yR`O`e-2DwG
zMGcKPZ4ab#+=o>Y#tGvKBXxDC?wc#X?39aN!W$l}AVsB+r#E#42d*`eCf^+m+2XZc
z;f#dL%E&aTzos61!tJV$Y-IL*!sc{0G244sF8C{+pnH_L$Lerv%jY(`^gQ(3@XC>E
z)N{i)$21$>B(IW&So?1sMl#r|X9LQtCU~3N>u$zYp2aT^9(JhoE=a$N%t&ts*mJ&F
z=JBUETs)|CFW~%HRW`B2!|2SFTTJq8(WK{j$fim&dA}FHn{J0GK6?*CGxkrTM2BGVSP?@-#`uhD@N2VXfGC=}Il9
zIlX}uoNrHu8>YvT*dbf_xcIUwtf=x!y`e#1k;utN3+}{@+AgJ{d^%fm?z=+5Rh|yC
zDVQI*d}$sfMRH_88S;rk4Hv2_m(Eazq$Rreg~x8^FwY*=E~^m)S{vKX7OO9Yrq~O%
zArbjGfo??AzDrtq`0{Y7Vksfx4;r=3Yy*uR%M}3=ZjB4%3x)RNOB~K!o%L#F!W^wm
z*nG<@d%Y@o^`$h%m34T5>ub&Gq^xxe8)0mGSlvrSzGxwPN%pok(;VQfr8ZH!2J~OX
zov{rO8699}*eU~B78rQuC{rR>o%=U}y~JmFT%PnV&?O8XSYAG3hpdD0SoP~c}
zOKe31%3e(`5sSzdN2Pder$P%aJ+)ugWw6=Mb3ll+I{cu^m`3|n8hxQA&8
z935D1Eqa(NdHt2oXYBpeX5SS+DDT~nz+;)jBZDIY&)Z&F}un)`L0B7?DMl0Q6*HPd{<~M
zzBw=7c#XKeFx8hcpS;qO)6KQK7=@`l+;RB$xO9x=8(*Ur7@H%!UcLj2xYJmt^$P(I
z)B#~cP74t0evxx+Dag`me2!iG;}e^Oi)#MbUs@!VB~SPc->Oxgs+syWKWc=XiI~TV
z;xvqGr4tJ%8HZ5<=Y4+M7b#dWndyHPQhci*&XFNyg`D?Iyc%wJ3oo$5G&Bnr*{fM#q-~BP41pPS0JNkwFpb^Pa6vyoFuROfQ=a